One interesting thing about PowerShell is that we can execute the
same localhost commands in a remote server.
So, in this demo,
we'll take a look at how to run host enumeration
techniques in a remote system using PowerShell.
All right, we are back to our lab environment.
I'm here on a victim computer logged as a low‑privilege user.
We saw in the previous demo how to enumerate
information about the local machine.
However,
PowerShell has a really cool trick that allows us to
collect information from a remote host.
For example, let's say we want to enumerate information about the other machine,
which is the domain controller.
First, to discover the domain controller name,
we can use the Get‑ComputerInfo and then LogonServer.
Then, this gave us the hostname of the domain controller.
Now, let's say I want to run the Get‑ComputerInfo in the domain controller.
For that, I can use Invoke‑Command, then the ComputerName,
which is the remote hostname that I want to enumerate,
then the flag ScriptBlock,
and the command that I want to execute in the remote host,
which is Get‑ComputerInfo.
Basically,
what PowerShell will do here is use the Windows Remote
Management protocol to log into the remote machine and
execute this Get‑Computer command in there.
So, let's run this.
Oh, take a look.
We got an error because my user here doesn't have
permissions to access the remote server.
So, let's run the same command, but now with a high‑privilege user in the domain.
For that, I will open a new PowerShell terminal as an administrator.
And in this new terminal, I will run the exact same command I tried before.
Perfect.
Take a look.
It works.
Since this user here has privilege to access the domain controller,
I was able to enumerate information about the
remote host from my victim computer.
And remember, we can modify this command as much as we want.
For example, I can add a filter to only retrieve information I want,
and this will be executed on the remote server and presented to me here.
This Invoke‑Command option is really useful when you are working on red team
engagement and you need to enumerate multiple machines.
You can collect all the information you need from one single terminal.
You don't need to manually log into each server.
Everything can be done from here.