WEBVTT

00:00:01.640 --> 00:00:02.510
Before we go,

00:00:02.520 --> 00:00:04.570
I want to show you another really cool feature using

00:00:04.570 --> 00:00:06.290
the latest version of PowerSploit,

00:00:06.510 --> 00:00:09.020
which is searching for interesting files in the local

00:00:09.020 --> 00:00:12.420
computer and domain shares. For this demo,

00:00:12.430 --> 00:00:14.040
as we're using the latest features,

00:00:14.060 --> 00:00:18.790
we'll need to download the development version of PowerSploit. So let me

00:00:18.790 --> 00:00:22.550
open my browser and access the development branch of the PowerSploit

00:00:22.550 --> 00:00:27.780
tool. You can access it directly by typing this link. In here, I will

00:00:27.780 --> 00:00:30.840
just click on the green button to download the repository as a zip.

00:00:30.840 --> 00:00:37.310
Awesome! The file now is downloaded. So I will quickly open it and

00:00:37.310 --> 00:00:38.750
extract it to my desktop.

00:00:41.080 --> 00:00:44.750
Done! Now same as with the last demo, one of the features that we'll be using

00:00:44.750 --> 00:00:47.550
in this demo is not in the PowerSploit module manifest.

00:00:48.110 --> 00:00:52.350
So I have to edit this file here and add this string in the file.

00:00:53.140 --> 00:00:56.910
It basically allows me to load the Find‑DomainShare when we load the

00:00:56.910 --> 00:01:01.150
PowerSploit. Perfect! Now let me save this file and close it.

00:01:02.240 --> 00:01:04.950
Now let's open the PowerShell as an administrator.

00:01:06.340 --> 00:01:07.660
And as we've done before,

00:01:07.770 --> 00:01:10.170
let me just make sure that the execution policy is

00:01:10.170 --> 00:01:11.850
disabled by using this command.

00:01:13.520 --> 00:01:18.700
Perfect! Now let me go to the PowerSploit dev folder and then use

00:01:18.700 --> 00:01:22.290
the command Import‑Module with the file that we just edited to load

00:01:22.300 --> 00:01:23.950
all the PowerSploit's modules in memory.

00:01:25.780 --> 00:01:28.100
Done! Now we are ready to start using the tool.

00:01:28.830 --> 00:01:30.650
So let me show you one of my favorite scripts,

00:01:30.760 --> 00:01:35.160
which is Find‑DomainShare. This script is able to scan the whole

00:01:35.160 --> 00:01:37.820
domain and find open shares for us to access.

00:01:38.490 --> 00:01:41.510
And if we're using the flag ‑CheckShareAccess,

00:01:41.720 --> 00:01:45.410
PowerSploit will only show us the network folders that we have access to.

00:01:45.690 --> 00:01:47.970
So it will save me a lot of time when searching for

00:01:47.970 --> 00:01:51.290
sensitive files. When we execute this command, it may give

00:01:51.290 --> 00:01:52.670
you some errors in the beginning,

00:01:52.800 --> 00:01:55.110
but eventually it'll give us a list of all the shares in

00:01:55.110 --> 00:01:56.450
the network that we have access to.

00:01:57.140 --> 00:01:57.800
In my case,

00:01:57.850 --> 00:02:01.430
I found those shares here. And take a look, there's one interesting

00:02:01.430 --> 00:02:05.050
share called InternalFiles in the LAB‑DC1 computer.

00:02:05.640 --> 00:02:06.890
So keep this one in mind.

00:02:06.900 --> 00:02:07.950
We'll use these one later.

00:02:09.039 --> 00:02:12.040
Now let me show another tool that I really like. This

00:02:12.040 --> 00:02:14.050
tool is called Find‑InterestingFile.

00:02:14.540 --> 00:02:17.030
Once I give a folder to this script, it crawls through the

00:02:17.030 --> 00:02:19.150
folder trying to find interesting files,

00:02:19.460 --> 00:02:22.950
for example, files that contain passwords or sensitive information.

00:02:23.740 --> 00:02:27.750
And you can use this tool to search local files or files on the network folders.

00:02:28.740 --> 00:02:32.050
So let me do a quick search on the admin folder of this computer.

00:02:32.740 --> 00:02:34.790
In theory, it can search the whole hard drive,

00:02:34.920 --> 00:02:37.810
but it may take a while, so let's focus on the admin folder.

00:02:40.740 --> 00:02:43.150
Done! As you can see, there are quite a lot of files.

00:02:43.700 --> 00:02:46.850
All of them appeared interesting for the tool. For example,

00:02:46.930 --> 00:02:51.350
this file here is called creds.txt, and this sounds promising.

00:02:51.740 --> 00:02:54.150
So let's take a look at it. It's in the Documents folder.

00:02:55.700 --> 00:02:56.240
Here it goes.

00:02:56.540 --> 00:02:58.950
This file contains several credentials for some servers,

00:02:59.340 --> 00:03:02.150
and that's definitely something that will help you in your red team engagement.

00:03:02.840 --> 00:03:05.480
And the interesting part is that it can also run the same command,

00:03:05.510 --> 00:03:08.500
but with a flag ‑OfficeDocs, and in this way,

00:03:08.510 --> 00:03:11.800
the PowerSploit will search for interesting Microsoft Office documents

00:03:11.950 --> 00:03:14.510
such as spreadsheets and sensitive word documents.

00:03:15.300 --> 00:03:16.640
As you can see in my case,

00:03:16.750 --> 00:03:20.560
there're no interesting Office documents here. So let's try to

00:03:20.560 --> 00:03:24.370
find something on the network shared folders. For that, I'll use

00:03:24.370 --> 00:03:26.550
the same common, Find‑InterestingFile.

00:03:26.940 --> 00:03:29.170
But now, instead of using the local folder,

00:03:29.250 --> 00:03:33.350
I used a network shared folder using the UNC path for the folder.

00:03:34.140 --> 00:03:36.390
So do you remember that interesting shared folder that we

00:03:36.390 --> 00:03:39.060
found using the Find‑DomainShare tool? So,

00:03:39.060 --> 00:03:42.350
yeah, let's search for interesting files in there. Now,

00:03:42.360 --> 00:03:46.070
when I press Enter, it will search through the whole shared folder looking for

00:03:46.070 --> 00:03:50.350
files with interesting information. And take a look, we found something there.

00:03:51.040 --> 00:03:53.550
In here, we have the path for the sensitive file.

00:03:53.940 --> 00:03:58.110
We can simply select this path, copy it, open up Windows

00:03:58.110 --> 00:04:01.450
Explorer, and paste it in the search bar.

00:04:02.210 --> 00:04:03.950
And then it will open the document for us.

00:04:04.900 --> 00:04:07.390
And here we go, one more set of credentials for our

00:04:07.390 --> 00:04:09.450
collection. That's pretty cool, right?