WEBVTT 00:00:01.840 --> 00:00:02.410 Hey there. 00:00:02.420 --> 00:00:04.930 Welcome to the Collection with PowerSploit course. 00:00:04.930 --> 00:00:05.830 In here, 00:00:05.880 --> 00:00:08.540 you'll learn how to use PowerSploit's framework to extract 00:00:08.540 --> 00:00:10.850 sensitive information from your target machines. 00:00:12.180 --> 00:00:14.290 So imagine you're in a red team engagement, 00:00:14.440 --> 00:00:17.260 and you already got access to a few Windows machines in the network. 00:00:18.000 --> 00:00:20.400 One thing is giving a report to the client saying 00:00:20.400 --> 00:00:21.750 their machines were compromised. 00:00:22.340 --> 00:00:25.260 Another thing is showing the client what kind of data a 00:00:25.260 --> 00:00:27.730 criminal could have access with this attack. 00:00:27.730 --> 00:00:29.290 From my experience, 00:00:29.310 --> 00:00:32.409 when you show to a client what kind of damage an attacker could make, 00:00:32.409 --> 00:00:34.750 the client appreciates more your work. 00:00:35.340 --> 00:00:37.410 For this reason, in a red team engagement, 00:00:37.470 --> 00:00:41.150 it is important to collect sensitive information from your target machines. 00:00:42.240 --> 00:00:45.500 So again, in our example, after getting access to some of the machines, 00:00:45.610 --> 00:00:48.660 you can implement keyloggers in the victim computer to collect 00:00:48.670 --> 00:00:51.110 everything they're typing without their knowing about it. 00:00:51.840 --> 00:00:52.530 Or also, 00:00:52.540 --> 00:00:55.180 you could take screenshots of the victim machine to get an 00:00:55.180 --> 00:00:57.930 idea of what the user is doing and what kind of sensitive 00:00:57.930 --> 00:00:59.250 information they deal with. 00:01:00.210 --> 00:01:03.410 Or you could search the victim computer for sensitive files, 00:01:03.410 --> 00:01:05.630 such as sensitive Excel spreadsheets. 00:01:05.630 --> 00:01:07.310 Or even more creepy, 00:01:07.310 --> 00:01:11.350 you can record audio from the victim microphone without them knowing about that. 00:01:12.190 --> 00:01:15.150 And this means that you can listen to anything they're saying in the room, 00:01:15.640 --> 00:01:16.970 and that's pretty scary, right? 00:01:16.970 --> 00:01:18.130 And again, 00:01:18.240 --> 00:01:20.440 this is the kind of information that will prove a point to your 00:01:20.440 --> 00:01:22.850 client that security should be taken seriously. 00:01:23.700 --> 00:01:26.510 One thing is giving to our client just a boring report. 00:01:26.770 --> 00:01:30.050 Another thing is giving a folder with a lot of sensitive information, 00:01:30.120 --> 00:01:33.150 including keylogger information and even microphone recordings. 00:01:34.040 --> 00:01:34.590 And also, 00:01:34.700 --> 00:01:37.120 some of the sensitive information can be used to escalate 00:01:37.120 --> 00:01:38.850 your privileges and move laterally. 00:01:39.340 --> 00:01:41.490 For example, with the keylogger information, 00:01:41.500 --> 00:01:44.950 you may be able to get passwords from other servers. 00:01:44.950 --> 00:01:49.220 Although in theory you can run all these collection attacks manually, 00:01:49.220 --> 00:01:50.820 when you have several targets, 00:01:50.830 --> 00:01:53.850 you need an automated away of collecting sensitive information, 00:01:54.440 --> 00:01:56.350 and that's where PowerSploit comes to place. 00:01:57.140 --> 00:02:01.050 PowerSploit is a huge framework with several tools for red team specialists, 00:02:01.540 --> 00:02:03.910 and some of those tools include collection tools, 00:02:04.150 --> 00:02:07.750 which help us to automate things like keylogging and microphone recordings. 00:02:09.090 --> 00:02:12.420 The PowerSploit framework was originally developed by Matt Graeber, 00:02:12.620 --> 00:02:15.750 and thanks to him, our job as red team specialists is way easier. 00:02:16.540 --> 00:02:19.340 He released the first PowerSploit more than five years ago, 00:02:19.350 --> 00:02:21.250 and since then, the project took off. 00:02:21.940 --> 00:02:24.440 Nowadays, there is a lot of contributors to this project, 00:02:24.450 --> 00:02:27.920 including Chris Campbell, Joe Bialek and Rich Lundeen. 00:02:29.190 --> 00:02:31.910 The PowerSploit framework is a collection of Microsoft 00:02:31.920 --> 00:02:34.710 PowerShell modules that can be used in pretty much all 00:02:34.710 --> 00:02:36.390 phases of a red team assessment. 00:02:37.440 --> 00:02:38.210 In this course, 00:02:38.240 --> 00:02:41.290 we focus on the modules that help us to collect sensitive information, 00:02:41.740 --> 00:02:44.600 but PowerSploit has actually more than 50 different tools, 00:02:44.860 --> 00:02:48.780 from privilege escalation to exfiltration modules. 00:02:48.780 --> 00:02:53.400 What I love about PowerSploit is that it is an open‑source tool, 00:02:53.840 --> 00:02:57.160 meaning that you download it and change the script as much as you want. 00:02:57.160 --> 00:02:59.900 You can find PowerSploit in this GitHub page. 00:03:01.430 --> 00:03:03.510 Another thing that I love about PowerSploit it is that 00:03:03.510 --> 00:03:05.350 it's a full framework for a red team. 00:03:05.820 --> 00:03:07.980 It contains scripts that'll help you pretty much all 00:03:07.980 --> 00:03:09.320 the phases throughout the assessment, 00:03:09.570 --> 00:03:12.950 from reconnaissance to privilege escalation and exfiltration. 00:03:12.950 --> 00:03:14.360 And also, 00:03:14.470 --> 00:03:18.200 PowerSploit already comes built‑in with most of the command‑and‑control tools, 00:03:18.360 --> 00:03:20.160 such as Covenant and Pupy. 00:03:20.160 --> 00:03:22.990 And this means that if you're using one of those tools 00:03:23.120 --> 00:03:24.650 to control your victim computer, 00:03:24.650 --> 00:03:27.550 it can remotely launch PowerSploit commands just by 00:03:27.550 --> 00:03:29.010 using the command‑and‑control tool, 00:03:29.640 --> 00:03:33.310 and you can even automate those attacks across several machines. 00:03:33.310 --> 00:03:35.370 And talking about automation, 00:03:35.460 --> 00:03:38.740 PowerSploit is capable of automating the collections of sensitive data. 00:03:39.110 --> 00:03:39.770 For example, 00:03:39.780 --> 00:03:43.250 we can use this framework to automatically search for sensitive files, 00:03:43.640 --> 00:03:46.650 recording microphone audio, take screenshots, 00:03:47.040 --> 00:03:49.170 or even running keyloggers in a target machine. 00:03:51.740 --> 00:03:53.190 If you're familiar with the red team kill chain, 00:03:53.680 --> 00:03:57.600 we can map the PowerSploit tool to all the phases after the exploitation. 00:03:58.240 --> 00:04:02.120 This framework contains scripts that'll help you to do internal reconnaissance, 00:04:02.350 --> 00:04:05.700 privilege escalation, lateral movement, defense evasion, 00:04:06.060 --> 00:04:09.230 collection, exfiltration, and much more. 00:04:09.230 --> 00:04:10.480 In this course, 00:04:10.480 --> 00:04:14.090 we'll focus on using PowerShell on the collection of sensitive data, 00:04:14.300 --> 00:04:15.770 which is on the action phase. 00:04:18.360 --> 00:04:18.839 Also, 00:04:18.850 --> 00:04:21.040 if we map the techniques that I will lay out in this 00:04:21.040 --> 00:04:23.000 course to the MITRE ATT&CK framework, 00:04:23.110 --> 00:04:25.870 you'll see the PowerSploit can execute attacks in pretty 00:04:25.870 --> 00:04:28.060 much all categories of the MITRE framework, 00:04:28.350 --> 00:04:30.270 except the initial access. 00:04:30.270 --> 00:04:35.750 In this course, we'll focus on one specific category, which is collection. 00:04:35.750 --> 00:04:39.290 Inside of collection, we have four main techniques. 00:04:39.290 --> 00:04:41.890 The first one is the audio capture, 00:04:42.010 --> 00:04:45.020 in which you will use PowerSploit to record microphone audio 00:04:45.020 --> 00:04:47.350 from our victim without them knowing about it. 00:04:47.940 --> 00:04:49.150 And that's pretty creepy, right? 00:04:50.240 --> 00:04:54.450 The second technique is the T1056, which is input capture. 00:04:55.040 --> 00:04:57.070 In here, we use the keylogging module, 00:04:57.160 --> 00:05:00.380 which will record everything that our victim types in their computer. 00:05:02.180 --> 00:05:05.390 The third technique is a screen capture in which you use 00:05:05.390 --> 00:05:08.510 PowerSploit to take screenshots in a specific time frame, 00:05:09.140 --> 00:05:11.650 for example, one screenshot every three minutes. 00:05:12.410 --> 00:05:12.940 In this way, 00:05:12.950 --> 00:05:15.520 we can get an idea of what the user is doing and 00:05:15.520 --> 00:05:17.550 hopefully catch some sensitive information. 00:05:19.880 --> 00:05:24.450 The fourth technique is the 1039, which is data from network shared drive. 00:05:25.140 --> 00:05:25.470 In here, 00:05:25.470 --> 00:05:29.260 we use PowerSploit to find network shared folders and also find 00:05:29.260 --> 00:05:31.700 sensitive files inside of those network folders. 00:05:32.740 --> 00:05:33.540 That's pretty cool, right? 00:05:33.540 --> 00:05:36.880 As we can see, PowerSploit covers a lot of collection techniques. 00:05:39.540 --> 00:05:41.930 But before we get into the technical parts of this course, 00:05:42.010 --> 00:05:44.930 I want you to keep in mind that performing any of those attacks 00:05:44.940 --> 00:05:47.860 without authorization is legal in most countries. 00:05:47.860 --> 00:05:50.920 And this means that if you enter in a computer and start 00:05:50.920 --> 00:05:53.960 to collect data without authorization, you may go to jail. 00:05:53.960 --> 00:05:58.100 Especially the microphone recording attack is definitely a criminal offense. 00:05:58.100 --> 00:06:01.330 So it is important to stay legal .First, 00:06:01.330 --> 00:06:03.320 if you're working on a red team project, 00:06:03.380 --> 00:06:05.760 make sure you have a letter of engagement from the client 00:06:06.050 --> 00:06:08.240 detailing the dates that the tests will be executed, 00:06:08.240 --> 00:06:11.260 as well as the type of attack and scope. 00:06:11.260 --> 00:06:11.770 Also, 00:06:11.770 --> 00:06:15.740 it is important to have a formal document signed by the client detailing 00:06:15.740 --> 00:06:18.010 and authorizing the attacks that you will be performing. 00:06:18.640 --> 00:06:21.210 And this document is what differentiates a criminal from 00:06:21.210 --> 00:06:23.090 a professional red team specialist. 00:06:23.090 --> 00:06:25.440 And as a personal recommendation, 00:06:25.530 --> 00:06:27.930 always consult the client before executing any 00:06:27.930 --> 00:06:29.510 attack that may impact the network. 00:06:30.180 --> 00:06:32.140 So, bottom line, don't be a criminal. 00:06:32.140 --> 00:06:37.950 Now, let's understand the attacks that we'll be doing in our demos. 00:06:38.500 --> 00:06:41.880 Let's say you're working on the red team engagement in a specific client. 00:06:41.880 --> 00:06:45.600 At the beginning of the engagement, using malware and a phishing email, 00:06:45.600 --> 00:06:47.950 you're able to get access to someone's laptop, 00:06:48.500 --> 00:06:50.980 and this means that you have remote access to a Windows 00:06:50.980 --> 00:06:53.200 machine and that the machine is in the domain. 00:06:54.440 --> 00:06:57.570 Also, you worked a way and escalated your privilege in the machine, 00:06:57.750 --> 00:07:00.550 meaning that now you have admin access to that machine. 00:07:01.600 --> 00:07:04.060 So then you download PowerSploit on the machine, 00:07:04.120 --> 00:07:06.650 or you simply run it from memory using PowerShell. 00:07:07.540 --> 00:07:09.360 Then with PowerSploit on the machine, 00:07:09.420 --> 00:07:12.270 we're able to run several collection attacks in that machine. 00:07:12.270 --> 00:07:13.340 For example, 00:07:13.350 --> 00:07:17.260 we use PowerSploit to take timed screenshots so then we can take a 00:07:17.260 --> 00:07:20.330 look at what the person is doing in their computer and hopefully see 00:07:20.330 --> 00:07:21.650 some sensitive information in there. 00:07:22.620 --> 00:07:23.060 Also, 00:07:23.140 --> 00:07:26.220 screenshots are a good way to see if the client security is 00:07:26.220 --> 00:07:27.610 investigating something on the machine. 00:07:28.940 --> 00:07:32.500 We also use PowerSploit to capture microphone audio from the computer, 00:07:33.210 --> 00:07:35.280 and this means that we'll be able to listen to whatever the 00:07:35.280 --> 00:07:37.250 person is talking without their knowing about it. 00:07:37.940 --> 00:07:41.320 And this can be useful to listen for sensitive information and also to 00:07:41.320 --> 00:07:43.650 know if the user is talking to any IT personnel. 00:07:45.240 --> 00:07:48.650 Also, we use PowerSploit to deploy a keylogger in the system, 00:07:48.880 --> 00:07:51.850 meaning that anything that a person types will be stored for us, 00:07:52.400 --> 00:07:54.820 and this can be really useful to get sensitive information, 00:07:54.820 --> 00:07:57.270 as well as getting user passwords. 00:07:57.270 --> 00:07:58.310 And last, 00:07:58.310 --> 00:08:01.430 we use PowerSploit to search for sensitive files in 00:08:01.430 --> 00:08:02.900 the computer and in the network. 00:08:04.420 --> 00:08:07.530 And here you'll learn how to automate file searches so you don't need 00:08:07.530 --> 00:08:09.850 to be looking at every single file on the network. 00:08:10.540 --> 00:08:11.260 That's very cool, right? 00:08:11.260 --> 00:08:14.350 This shows you how much power a real hacker may have 00:08:14.460 --> 00:08:15.770 if the machine is compromised. 00:08:16.070 --> 00:08:18.780 It is scary to think that someone may have access to all 00:08:18.780 --> 00:08:20.250 this data without me knowing about it. 00:08:22.040 --> 00:08:24.900 One important thing that I want to mention is that PowerSploit 00:08:24.910 --> 00:08:27.150 is usually detected by antivirus solutions, 00:08:27.650 --> 00:08:29.510 and this means that if you're not careful, 00:08:29.520 --> 00:08:30.360 you may get caught. 00:08:31.340 --> 00:08:34.950 So in an engagement, you need to find ways to avoid being detected. 00:08:34.950 --> 00:08:37.299 We'll not cover all these techniques in this course, 00:08:37.429 --> 00:08:38.960 since it's an extensive topic, 00:08:38.970 --> 00:08:41.650 and there's a few courses out there in detection evasion. 00:08:42.289 --> 00:08:46.100 But basically, there are two ways of not getting detected when using PowerSploit. 00:08:46.980 --> 00:08:47.370 First, 00:08:47.380 --> 00:08:50.870 we can try to bypass the antivirus detection with some advanced techniques, 00:08:51.640 --> 00:08:55.450 or we can simply use our admin privilege to disable the antivirus. 00:08:55.940 --> 00:08:58.260 And actually here I'm talking not only the antivirus 00:08:58.270 --> 00:09:01.760 solutions but any detection solutions such as host IPS 00:09:01.760 --> 00:09:03.950 solutions and endpoint protection tools. 00:09:05.570 --> 00:09:08.250 To bypass antivirus, there are a lot of techniques out there. 00:09:08.740 --> 00:09:11.470 It all depends on which antivirus your client has. 00:09:11.780 --> 00:09:15.150 But one really common technique is by doing script obfuscation. 00:09:15.890 --> 00:09:18.090 If you're not familiar with script obfuscation, 00:09:18.330 --> 00:09:21.070 I do recommend you a course here on Pluralsight called 00:09:21.070 --> 00:09:23.550 Defense Evasion with Invoke‑Obfuscation. 00:09:24.440 --> 00:09:24.890 In there, 00:09:24.940 --> 00:09:27.370 you'll learn how to bypass most common antivirus 00:09:27.370 --> 00:09:29.350 solutions by obscuring your scripts. 00:09:30.740 --> 00:09:33.690 My advice for antivirus bypassing is to always test your 00:09:33.690 --> 00:09:36.180 techniques in a cloned environment before sending the 00:09:36.180 --> 00:09:37.350 script to your target machine. 00:09:38.040 --> 00:09:42.310 For example, if your victim uses Windows 10 with Norton Antivirus, 00:09:42.560 --> 00:09:45.360 then you should create in your lab environment a Windows 10 00:09:45.360 --> 00:09:47.320 machine with the same antivirus solution. 00:09:47.580 --> 00:09:50.230 So then you can test your obfuscation techniques and 00:09:50.230 --> 00:09:51.610 ensure that it will not be detected. 00:09:52.940 --> 00:09:55.190 Also in a real‑world red team exercise, 00:09:55.360 --> 00:09:57.960 antivirus bypassing is the preferred method, 00:09:58.040 --> 00:10:00.450 since it usually doesn't generate any suspicious logs. 00:10:01.140 --> 00:10:03.950 For example, if you simply go and disable the antivirus, 00:10:04.180 --> 00:10:07.850 the IT team may get a notification that someone deactivated the antivirus, 00:10:08.440 --> 00:10:10.050 and this may look really suspicious. 00:10:10.690 --> 00:10:13.900 But if you're simply bypassing the antivirus via obfuscation, 00:10:14.100 --> 00:10:16.930 the IT team will not be informed at all. 00:10:16.930 --> 00:10:18.870 Now, that being said, 00:10:19.050 --> 00:10:21.220 in this course we will be simply disabling the 00:10:21.220 --> 00:10:23.290 antivirus so you can run PowerSploit. 00:10:24.020 --> 00:10:26.000 And although this is not the most recommended method, 00:10:26.150 --> 00:10:29.350 it is the easiest way of running malicious code in a target machine. 00:10:30.340 --> 00:10:30.820 Usually, 00:10:30.830 --> 00:10:34.050 if I'm running out of time and if I don't care too much about being caught, 00:10:34.200 --> 00:10:37.320 I simply use the admin account to go and disable all the 00:10:37.320 --> 00:10:38.960 detection mechanisms in the machine, 00:10:38.960 --> 00:10:42.150 and this may include the antivirus and the host IPS, 00:10:42.640 --> 00:10:46.050 the endpoint protection tool, and even the Windows Defender. 00:10:46.940 --> 00:10:49.220 So then I can be sure that I'll not be detected. 00:10:50.040 --> 00:10:51.030 And as I mentioned before, 00:10:51.120 --> 00:10:54.010 using this technique usually generates logs that something 00:10:54.010 --> 00:10:55.750 suspicious is happening on the network. 00:10:56.840 --> 00:10:57.330 However, 00:10:57.430 --> 00:10:59.910 in some cases where we don't have enough time or we 00:10:59.910 --> 00:11:02.600 don't care about being caught, this approach may be just fine. 00:11:04.340 --> 00:11:06.050 If you want to get the most out of this course, 00:11:06.050 --> 00:11:08.570 I do recommend you create a small lab environment 00:11:08.710 --> 00:11:10.440 so you can practice this attack. 00:11:10.440 --> 00:11:14.040 In here, I'm using a really simple Windows 2016 domain, 00:11:14.170 --> 00:11:18.850 which includes a Windows 2016 domain controller and a Windows 2016 server, 00:11:18.940 --> 00:11:20.300 which will be your victim. 00:11:20.300 --> 00:11:23.000 And this simulates a corporate environment. 00:11:23.440 --> 00:11:25.490 But if you don't want to create those complicated servers, 00:11:25.670 --> 00:11:28.150 you can simply use a standalone Windows virtual machine. 00:11:28.740 --> 00:11:31.840 Just keep in mind that depending on the version of the Windows you're using, 00:11:31.920 --> 00:11:34.910 some attacks may not work, or they may require a different syntax. 00:11:35.640 --> 00:11:36.760 So enough of talking. 00:11:36.930 --> 00:11:39.280 Let's go to our demos and see how to collect sensitive 00:11:39.280 --> 00:11:41.150 information from our victim machine.