WEBVTT 00:00:01.640 --> 00:00:03.600 Welcome to Windows lab environment. 00:00:03.870 --> 00:00:05.340 As I mentioned, in my lab, 00:00:05.350 --> 00:00:08.850 I'm using a Windows 2016 machine that I previous compromised. 00:00:09.380 --> 00:00:11.950 This means that I have admin credentials to this machine. 00:00:12.690 --> 00:00:13.910 So to get us started, 00:00:14.030 --> 00:00:16.700 let me show you how I disabled the Windows Defender so 00:00:16.700 --> 00:00:17.980 you can do the same in your lab. 00:00:18.740 --> 00:00:21.360 In the real world scenario, you may choose to obfuscate your 00:00:21.360 --> 00:00:23.350 code, instead of deactivating your antivirus. 00:00:24.040 --> 00:00:25.870 But here, to keep things simple, 00:00:25.880 --> 00:00:29.070 let's just disable the Windows Defender. So we can start by 00:00:29.070 --> 00:00:34.690 going to the Start menu and then clicking Settings. In here, we 00:00:34.690 --> 00:00:36.850 go to the Updates and security option. 00:00:38.540 --> 00:00:39.030 Perfect. 00:00:39.170 --> 00:00:42.700 Then we go to the Windows Defender option and, 00:00:42.720 --> 00:00:45.820 as we can see, I have all the Windows Defender options disabled, 00:00:45.960 --> 00:00:47.470 including the real‑time scanning. 00:00:49.340 --> 00:00:52.520 Also, to make sure the Windows Defender is really off, we can go to 00:00:52.520 --> 00:00:56.970 the group policy settings and disable it there. For that, let's go 00:00:56.970 --> 00:01:04.120 to the Start menu and then type gpedit.msc. And then let's open the 00:01:04.129 --> 00:01:08.410 Group Policy Editor. In here, I'll navigate to Computer 00:01:08.410 --> 00:01:10.760 Configuration, Admin Templates, 00:01:11.540 --> 00:01:15.450 Windows Components, and then Windows Defender antivirus. 00:01:17.130 --> 00:01:18.380 Awesome. As we can see, 00:01:18.390 --> 00:01:22.270 I have an option here called Turn off Windows Defender antivirus. 00:01:23.340 --> 00:01:28.350 So I will double‑click this option and then select Enable. 00:01:29.440 --> 00:01:30.170 And after that, 00:01:30.240 --> 00:01:35.390 I would just click and apply. In this way, we assure that our Windows 00:01:35.390 --> 00:01:39.110 Defender will not bother us during the demo. And to apply all those changes 00:01:39.110 --> 00:01:41.350 that were made, let me quickly restart the machine. 00:01:44.040 --> 00:01:44.480 Awesome. 00:01:44.490 --> 00:01:47.880 If you follow the same step as I did in the Windows 2016 machine, 00:01:47.980 --> 00:01:50.350 you should be able to run PowerSploit without issues. 00:01:51.340 --> 00:01:54.850 Now first, let's start by downloading the PowerSploit from GitHub. 00:01:55.440 --> 00:02:00.790 So I open my browser and navigate to this GitHub page. In here, 00:02:00.850 --> 00:02:03.750 you see that PowerSploit has tons of modules and features, 00:02:04.140 --> 00:02:07.010 but in this course, we are focused on the collection tools. 00:02:08.039 --> 00:02:11.000 So let's go ahead and download the whole PowerSploit GitHub 00:02:11.000 --> 00:02:13.850 by clicking the Clone or Download button. 00:02:15.010 --> 00:02:15.480 Perfect. 00:02:15.490 --> 00:02:18.050 I'll save this in my desktop just to make things easier. 00:02:19.580 --> 00:02:21.950 Now, let me just extract the files to my desktop. 00:02:24.160 --> 00:02:25.830 Now, if you're familiar with Powershell, 00:02:25.920 --> 00:02:28.770 you know that this psd1 file is responsible for 00:02:28.770 --> 00:02:30.390 mapping out the modules of a tool. 00:02:31.440 --> 00:02:35.640 From my experience, most of the PowerSploits modules already mapped in this file, 00:02:36.080 --> 00:02:38.450 but one of the modules that I will be using is not there. 00:02:39.040 --> 00:02:45.090 So I will quickly open this file and add in this list the Get‑Microphone module. 00:02:46.740 --> 00:02:50.010 And don't forget to put it between single quotes and a comma 00:02:50.020 --> 00:02:53.250 after. You should type exactly as you've seen here. 00:02:54.740 --> 00:02:58.450 Now let me save this file and we should be ready to use PowerSploit. 00:02:58.910 --> 00:03:00.950 So let's start by opening PowerShell. 00:03:01.400 --> 00:03:05.350 For that, I'll go to the Start menu, type Powershell, 00:03:06.590 --> 00:03:11.230 right‑click on the icon, and select Run as administrator since 00:03:11.230 --> 00:03:13.000 I have admin privilege for this computer. 00:03:14.840 --> 00:03:19.030 Perfect. Now to be able to run a known Microsoft script, I'll disable 00:03:19.030 --> 00:03:21.850 the script execution policy by using this command. 00:03:22.940 --> 00:03:23.530 Basically, 00:03:23.670 --> 00:03:26.460 this tell PowerShell to bypass the execution policy 00:03:26.460 --> 00:03:28.350 restrictions that this computer may have. 00:03:29.940 --> 00:03:33.150 And here, Windows give me an alert saying that this may be dangerous, 00:03:33.540 --> 00:03:34.190 but it's fine. 00:03:34.200 --> 00:03:37.290 We can bypass this and all future alerts by typing 00:03:37.300 --> 00:03:41.510 A and pressing Enter. Perfect. 00:03:41.510 --> 00:03:44.490 Now, let me navigate to the PowerSploit folder that is in my 00:03:44.490 --> 00:03:50.600 desktop. In here, I'll import the PowerSploit framework by using 00:03:50.600 --> 00:03:55.580 the import module command with the file PowerSploit.psd1, which is 00:03:55.580 --> 00:03:56.880 the file that we just edited. 00:03:58.390 --> 00:04:02.510 Once I run this command, all the PowerSploit features will be loaded in memory. 00:04:04.240 --> 00:04:06.400 Awesome. To check if this was successful, 00:04:06.410 --> 00:04:07.570 I'll just use the command, 00:04:07.570 --> 00:04:11.240 get help and then the name of any module from the PowerSploit, 00:04:11.520 --> 00:04:13.930 for example, Get‑TimedScreenshot. 00:04:15.840 --> 00:04:16.560 And there you go. 00:04:16.570 --> 00:04:17.829 It is perfect, it works. 00:04:18.060 --> 00:04:20.470 We can see that we got a Help page from the PowerSploit, 00:04:20.690 --> 00:04:23.750 which means that the tool is loaded and you're ready to start some fun stuff. 00:04:24.480 --> 00:04:27.040 So let me clear this screen so we can start fresh. 00:04:27.540 --> 00:04:29.650 Also, to organize the files we collect, 00:04:29.730 --> 00:04:35.890 I will create the folder in my C drive called exfiltration. And inside 00:04:35.890 --> 00:04:39.440 of this folder, I'll create three folders, one for the screenshots that 00:04:39.440 --> 00:04:44.750 we collect, another one for the audio that we will collect, and another 00:04:44.750 --> 00:04:46.050 one for the keylogger files. 00:04:47.430 --> 00:04:49.190 If you're in a real red team engagement, 00:04:49.380 --> 00:04:53.030 make sure you create those folders in a hidden place and do not use obvious 00:04:53.030 --> 00:04:56.820 names. Here, I'm using easy names so you can follow the demo, 00:04:57.040 --> 00:05:00.290 but try to save those files in places where people never check, 00:05:00.810 --> 00:05:04.050 for example, instead of the Windows folder or in a hidden directory. 00:05:05.800 --> 00:05:06.110 Cool. 00:05:06.200 --> 00:05:07.650 So let's go back to our Powershell. 00:05:08.510 --> 00:05:09.860 Let's run our first attack, 00:05:10.050 --> 00:05:14.250 which is capturing one screenshot every 10 seconds and saving to a folder. 00:05:15.440 --> 00:05:22.340 So I'll use the module, Get‑TimedScreenshots, and then use the flag ‑path 00:05:22.550 --> 00:05:25.150 to specify the folder I want to save my screenshots, 00:05:26.190 --> 00:05:28.040 and this is the folder that we just created. 00:05:29.610 --> 00:05:33.650 Then I use the flag interval to specify the interval between screenshots. 00:05:34.350 --> 00:05:37.150 my case, I want 1 screenshot every 10 seconds. 00:05:37.840 --> 00:05:41.810 And then I use the flag EndTime to specify when the script will stop taking 00:05:41.810 --> 00:05:44.850 screenshots. In my case, I'll put a few minutes from now. 00:05:46.140 --> 00:05:47.150 Now let's run this. 00:05:48.440 --> 00:05:52.030 While this is running, the PowerSploit will take 1 screenshot every 10 00:05:52.030 --> 00:05:55.920 seconds and save in the folder that are created. And take a look, you can 00:05:55.920 --> 00:05:59.890 see here in real time the screenshots showing up in the folder. And if 00:05:59.890 --> 00:06:01.350 you open one of those screen shots, 00:06:01.520 --> 00:06:03.910 you know that I can see everything that a person was doing. 00:06:04.340 --> 00:06:05.250 That's pretty cool, right? 00:06:05.900 --> 00:06:08.580 Now, let's stop this and go for a next attack, 00:06:08.780 --> 00:06:10.950 which is recording the victim microphone. 00:06:11.540 --> 00:06:14.440 And this is a really creepy attack since the person would 00:06:14.440 --> 00:06:15.900 not know that they are being recorded. 00:06:16.640 --> 00:06:17.630 And as I mentioned before, 00:06:17.770 --> 00:06:21.350 make sure your client approve this kind of attack before executing it. 00:06:21.840 --> 00:06:25.550 This kind of spying is a crime in several countries, so be careful. 00:06:27.040 --> 00:06:28.390 So let's use the module, 00:06:28.460 --> 00:06:33.340 Get‑MicrophoneAudio and then use the flags path to indicate the 00:06:33.340 --> 00:06:35.350 folder that it will be saving the audio files. 00:06:36.420 --> 00:06:40.590 And then let's use the flag length to specify how long we will record the audio. 00:06:41.220 --> 00:06:45.420 In this case, I will be recording for 5 minutes, and that's it. 00:06:45.570 --> 00:06:50.470 All we have to do now is run the script and take a look. As I'm 00:06:50.470 --> 00:06:53.110 running these in the virtual machine, I got this error saying 00:06:53.110 --> 00:06:54.740 that I don't have a recording device, 00:06:55.090 --> 00:06:58.910 which means I don't have a microphone in the machine. In the red team 00:06:58.910 --> 00:07:02.350 engagement, you see this error a lot if you're trying to attack a server or a 00:07:02.350 --> 00:07:04.850 virtual machine since they usually don't have a microphone. 00:07:05.240 --> 00:07:08.440 But if you're attacking a real laptop of a real user, this 00:07:08.440 --> 00:07:10.930 script would run and would save the recordings into the 00:07:10.930 --> 00:07:12.150 audio folder that I created. 00:07:13.540 --> 00:07:16.870 Now let me show another really useful collection tool from PowerSploit, 00:07:16.950 --> 00:07:18.250 which is the keylogger. 00:07:19.370 --> 00:07:20.430 So let me use the module, 00:07:20.430 --> 00:07:24.890 Get‑Keystrokes, and then use the flag LogPath to identify where 00:07:24.890 --> 00:07:27.740 the keystrokes will be recorded. In my case, 00:07:27.840 --> 00:07:30.890 I'll put the log file in a text file in the folder that we 00:07:30.890 --> 00:07:35.330 created. And also, I will use the flag timeout to indicate that 00:07:35.330 --> 00:07:39.780 I want to run the keylogger for five minutes only. Now all we 00:07:39.780 --> 00:07:41.350 have to do is run this command. 00:07:43.100 --> 00:07:46.000 Take a look, you may think that nothing is happening, but the command is 00:07:46.000 --> 00:07:48.950 actually running the background and recording everything I type. 00:07:49.640 --> 00:07:52.320 So if you go to exfiltration folder that I created, 00:07:52.460 --> 00:07:54.250 you see the new text files in there. 00:07:54.840 --> 00:07:56.250 So let's open it and take a look. 00:07:57.740 --> 00:07:59.140 Once you open this text file, 00:07:59.150 --> 00:08:02.840 we can see that every key that I typed is in this file and this 00:08:02.930 --> 00:08:05.250 can be really useful for several reasons. 00:08:06.040 --> 00:08:07.540 For example, with a keylogger, 00:08:07.550 --> 00:08:10.680 we can easily get the username and password when someone is accessing 00:08:10.680 --> 00:08:14.690 a website or another server. And this can be really interesting for 00:08:14.690 --> 00:08:16.750 preview escalation or lateral movements.