Plink
Administrators may want to avoid leaving OpenSSH on their Windows machines,
so we’re not guaranteed to discover an OpenSSH client.
Even if we find ourselves on a recent version of Windows,
the network administrators may have removed it.
Before OpenSSH was so readily available on Windows,
most network administrators’ tools of choice
were PuTTY and its command-line-only counterpart, Plink.
We’ll use Plink in this section, since in a security assessment,
we will more likely have a shell than GUI access.
Let’s get familiar with Plink by using it in the lab in a revised scenario.
In this scenario, we find that MULTISERVER03
now has a web application on TCP port 80 exposed.
All other inbound ports are blocked by a firewall,
so RDP is no longer available either.
We can compromise MULTISERVER03 through the web application,
drop a web shell on it, and gain a reverse shell using that.
We have previously found credentials we could use to connect to the RDP service.
This is blocked by the firewall, so we can’t connect directly.
The OpenSSH client has also been removed,
so we can’t create a remote port forward using that.
However, we have another option:
we can create a remote port forward using Plink.
Let’s try this out.
First, we will get an interactive reverse shell from MULTISERVER03.
From our initial exploitation, we uploaded a basic web shell.
We can browse to this URL and run whatever Windows commands we want -
these will be run as the i-i-s default app pool user.
We can use this web shell to download nc.exe to MULTISERVER03,
which we will then use to send a reverse shell back to our Kali machine.
To download nc.exe onto MULTISERVER03,
we first need to host it on a server that MULTISERVER03 can access.
We can easily configure Apache2 on our Kali machine to do this.
Apache2 is installed by default on Kali,
so we just need to start the apache2 service.
We can then find nc.exe from our Kali windows-resources/binaries directory
and copy it to the Apache2 web root.
Once the executable’s there, we should be able to download it to MULTISERVER03.
We will use a PowerShell wget one-liner from our web shell to download nc.exe.
From the web shell,
we’ll run a command that will instruct PowerShell to download nc.exe
from our Kali machine web server,
and write it to C:\Windows\Temp on MULTISERVER03 with -OutFile.
Once the PowerShell command is executed,
our payload is downloaded from our Apache2 server to
C:\Windows\Temp\nc.exe on MULTISERVER03.
We can then set up a Netcat listener on port 4446 on our Kali machine.
Once the listener is running, we’ll execute nc.exe on MULTISERVER03
using the web shell again,
passing -e to execute cmd.exe once the connection is established.
The shell quickly hits our listener.
We now want to download Plink to MULTISERVER03.
On our Kali machine, we’ll again use the PowerShell one-liner
to download plink.exe to C:\Windows\Temp.
With the Plink executable downloaded to MULTISERVER03,
we can now consider using it.
In this case, let’s set up Plink with a remote port forward
so that we can access the MULTISERVER03 RDP port
from our Kali machine.
The command syntax to set up a remote port forward with Plink is very similar
to the OpenSSH client remote port forward command.
After the -R option, we’ll pass the socket we want to open on the Kali SSH server,
and the RDP server port on the loopback interface of MULTISERVER03
that we want to forward packets to.
We will also pass the username and password directly on the command line.
We are presented with a prompt
asking if we want to store the server key in the cache.
We can confirm that the port has opened on our Kali machine using ss.
Port 9833 is opened on the loopback interface of our Kali machine.
New CNow we can connect to port 9983 on our Kali loopback interface
with xfreerdp as the rdp_admin user.aption
To specify a custom RDP port in xfreerdp, we simply append :9833 to the IP address.
The connection succeeds,
and we get an RDP connection through our Plink remote port forward!
In this section, we used Plink to create a remote port forward
to access the RDP service on MULTISERVER03.
We also considered some theoretical problems
when initiating Plink in more restrictive shells,
and explored piping keystrokes into Plink as a solution.