WEBVTT

00:00:01.650 --> 00:00:02.410
In this demo,

00:00:02.410 --> 00:00:06.710
we'll be using PoshC2 to harvest administrative credentials on our target

00:00:06.710 --> 00:00:10.270
system to escalate our privileges in the Globomantics network.

00:00:11.140 --> 00:00:14.850
We will then pivot to the enumeration of the Globomantics network to

00:00:14.850 --> 00:00:19.200
identify additional systems to target with PoshC2 and move laterally

00:00:19.200 --> 00:00:22.800
across the network creating additional accounts as we go to further

00:00:22.800 --> 00:00:24.070
our Red teaming attack.

00:00:25.640 --> 00:00:29.070
We will start again on our Kali system with the PoshC2 Server

00:00:29.070 --> 00:00:32.009
running on the right‑hand side of the screen and our implant

00:00:32.009 --> 00:00:36.480
handler running on the left side with our GLOBO‑PC‑01 implant

00:00:36.480 --> 00:00:39.200
loaded. With our system ready,

00:00:39.250 --> 00:00:42.360
we will start by harvesting the credentials of the IT admin

00:00:42.370 --> 00:00:45.920
administrative account we uncovered during our previous enumeration

00:00:45.920 --> 00:00:50.350
activities. PoshC2 has a simple module we can use for these purposes,

00:00:50.610 --> 00:00:54.250
which we'll specifically target and brute force accounts found `in the

00:00:54.250 --> 00:00:55.570
local administrative group.

00:00:56.340 --> 00:01:02.250
We will run the command Brute‑locadmin and press Enter. For the

00:01:02.250 --> 00:01:06.200
feedback on the PoshC2 server terminal screen, we see that the module

00:01:06.200 --> 00:01:11.360
loads successfully on our victim system, and success, brute‑locadmin

00:01:11.370 --> 00:01:14.860
has identified the credentials of our IT admin account as having a

00:01:14.860 --> 00:01:16.350
password of password.

00:01:17.040 --> 00:01:18.420
Armed with this information,

00:01:18.550 --> 00:01:22.490
let's perform an ARP scan on the Globomantics network from the GLOBO‑PC‑01

00:01:22.490 --> 00:01:26.840
system to identify potential systems we can target with our administrative

00:01:26.840 --> 00:01:32.280
credentials. We will run arpscan in our implant handler to use the ARP scan

00:01:32.280 --> 00:01:36.050
module and our target system will begin performing an ARP scan to provide us

00:01:36.050 --> 00:01:40.880
information on what other systems reside on the same network. As we see from the

00:01:40.880 --> 00:01:44.770
ARP scan results, there are a number of other systems found on the Globomantics

00:01:44.770 --> 00:01:46.010
network for us to target.

00:01:46.740 --> 00:01:49.680
We know from our previous enumeration activities that the

00:01:49.680 --> 00:01:56.160
host IP of the CEO system is 192.168.1.5.

00:01:56.910 --> 00:02:04.830
Let's direct our attack efforts at the system with an IP of 192.168.1.8 and

00:02:04.830 --> 00:02:07.460
see if our admin credentials work on that system as well.

00:02:07.940 --> 00:02:11.840
We will test to see if the IT admin administrative credentials also

00:02:11.840 --> 00:02:15.240
have elevated privileges on our new target system by attempting to

00:02:15.240 --> 00:02:19.970
create a new user account on that system. We will use PSexec, which has

00:02:19.970 --> 00:02:22.150
a few modules built out in PoshC2.

00:02:22.840 --> 00:02:26.670
We will first import the implant into PoshC2 running the command

00:02:26.670 --> 00:02:32.150
loadmodule invoke‑psexec,ps1 and press Enter.

00:02:32.740 --> 00:02:35.920
We see from the PoshC2 server terminal screen that the

00:02:35.920 --> 00:02:39.320
module has successfully loaded so we can now run our module

00:02:39.330 --> 00:02:41.290
with the invoke‑psexec command.

00:02:41.840 --> 00:02:46.790
We will run Invoke‑PSexec and use the target switch with an IP address of

00:02:46.800 --> 00:02:55.160
192.168.1.8 and now use the username switch for the IT admin and also with

00:02:55.160 --> 00:02:57.950
the password switch with the password of password.

00:02:58.540 --> 00:03:02.250
Now, we can use the command switch to have PSexec run a remote command.

00:03:02.840 --> 00:03:04.010
After the command switch,

00:03:04.010 --> 00:03:16.010
we will start with a single quote and type PowerShell.exe ‑C "net /add user

00:03:16.120 --> 00:03:21.370
support password and close our double quotes and a single quote.

00:03:22.140 --> 00:03:26.290
What this command will do when invoked is used PSexec to remotely run

00:03:26.290 --> 00:03:30.490
PowerShell to run the net command to create a new account on the remote

00:03:30.490 --> 00:03:35.990
system called support and with a password of password. Let's now invoke the

00:03:35.990 --> 00:03:40.230
command and see if our IT admin account is an admin on the target system as

00:03:40.230 --> 00:03:45.470
it is on GLOBO‑PC‑01. We see from the PoshC2 terminal window that the command

00:03:45.470 --> 00:03:49.420
was successfully run and that the IT admin account has been authenticated on

00:03:49.420 --> 00:03:55.570
the remote system and is indeed a local administrator on the 192.168.1.8

00:03:55.570 --> 00:03:56.050
system.

00:03:56.540 --> 00:04:00.350
We can do this using the net local group command. By promoting

00:04:00.350 --> 00:04:02.970
this account to an administrator, it will allow us to run

00:04:02.970 --> 00:04:06.060
additional commands on the remote system more discreetly than

00:04:06.060 --> 00:04:08.250
continuing to use the IT admin account,

00:04:08.640 --> 00:04:11.340
which may help to evade detection as we attempt to move

00:04:11.340 --> 00:04:13.650
laterally across the Globomantics network.

00:04:14.540 --> 00:04:19.029
Now let's run our previous Invoke.Psexec command again and modify our

00:04:19.029 --> 00:04:24.110
command switch information in double quotes replacing our net/admin command

00:04:24.280 --> 00:04:30.890
with the net localgroup administrators support /add.

00:04:31.540 --> 00:04:35.270
And now we press Enter to invoke the command. In consulting with the

00:04:35.270 --> 00:04:39.560
PoshC2 server terminal window, we see this command was also successfully

00:04:39.560 --> 00:04:43.970
run on the remote system. With our newly‑minted administrative account on

00:04:43.970 --> 00:04:48.140
our remote target, let's move laterally by dropping our implant payload on

00:04:48.140 --> 00:04:52.830
that system so we can perform C2 operations directly on it as we are with

00:04:52.830 --> 00:04:57.600
global PC‑01. PoshC2 offers a number of modules to install implants

00:04:57.600 --> 00:04:58.140
remotely,

00:04:58.390 --> 00:05:00.700
as well as additional ways to construct implant

00:05:00.700 --> 00:05:03.730
communication channels on a system including daisy‑chaining

00:05:03.730 --> 00:05:05.660
the implants for command and control.

00:05:06.440 --> 00:05:07.300
For our purposes,

00:05:07.300 --> 00:05:11.450
we will install an implant directly on the system also using PSexec.

00:05:12.140 --> 00:05:15.960
This time, we will run the command invoke‑psexec payload,

00:05:16.170 --> 00:05:18.950
which is another module built around PSexec.

00:05:19.940 --> 00:05:22.830
We type the command invoke‑psexecpayload,

00:05:23.060 --> 00:05:30.500
followed by the target switch with the IP of 192.168.1.8 and the

00:05:30.500 --> 00:05:34.260
username switch with our support account and the password switch

00:05:34.540 --> 00:05:38.620
followed by the password of password and press Enter. The module will

00:05:38.620 --> 00:05:40.690
now prompt us for a payload to use.

00:05:41.440 --> 00:05:45.950
We will utilize the payload.bat script for our purpose and press Enter.

00:05:45.950 --> 00:05:50.390
As we see in the PoshC2 server terminal window, the payload was sent to

00:05:50.390 --> 00:05:54.510
the target, and followed by a successful notification that we have a new

00:05:54.510 --> 00:05:59.010
implant, number three, running on the GLOBO‑INFRA system, which is now

00:05:59.010 --> 00:06:04.330
available to us. Reloading the implant handler by pressing Ctrl+D to

00:06:04.330 --> 00:06:09.160
close our session and typing posh to reinitiate our session, we now see

00:06:09.160 --> 00:06:14.290
both implant two an implant three available to use in command and control.

00:06:14.840 --> 00:06:17.390
It is also good to call out here that unlike the

00:06:17.390 --> 00:06:19.580
implant on our Globo‑PC‑01 system,

00:06:20.440 --> 00:06:24.660
the GLOBO‑INFRA implant is already running from a privileged account as

00:06:24.660 --> 00:06:29.600
designated with an asterisks next to the system username. We can go ahead and

00:06:29.600 --> 00:06:34.470
press 3 to choose our new target system and continue lateral movement and

00:06:34.470 --> 00:06:37.020
attack objectives across the Globomantics network.

00:06:38.090 --> 00:06:40.900
This will end our demo where we harvested administrative

00:06:40.900 --> 00:06:44.320
credentials from our victim machine and pivoted across the

00:06:44.320 --> 00:06:46.990
network to identify additional systems to target.

00:06:47.320 --> 00:06:50.640
We then used our gathered information to gain access to the GLOBO‑INFRA

00:06:50.640 --> 00:06:54.980
system and provision new administrative credentials to further our attack and

00:06:54.980 --> 00:06:59.150
lateral movement in the Globomantics network during which we remotely loaded

00:06:59.150 --> 00:07:01.770
our PoshC2 implant onto our new target.