I'm going to go ahead and import the complete PowerSploit module.
This will allow me to make use of all of the different
modules that exist within PowerSploit.
So continuing on with our activities,
we've identified users and groups that exist within this domain.
Now let's look at which users have actually logged into this local machine.
I can make use of the NetLoggedon command,
which will show me all of the users that have logged into this localhost.
As I scroll through the results, I can see the user name of JeffL,
but then I also have the user of RonHD.
Now this is great because I can possibly dump the cached credentials of RonHD.
Using the same commands that we've looked at earlier,
I can also check when was the last time his password was reset,
and this will give me a good indication if the cached credential
currently on the machine will work or not.
Another way to capture credentials is via Remote Desktop.
Depending on the security settings of Windows,
Remote Desktop credentials can also be cached.
By making use of the RDPSession command,
I can see all of the different sessions that have been
established using Remote Desktop.
Here, I can see that I've got JeffL, who is currently Active,
and I've also got RonHD, who has connected via Remote Desktop,
but his state is currently Disconnected,
so again, alluding to the possibility of capturing his credentials.
Let's start to move a little bit further away and look at the
different group policies that exist in the domain.
If I issue the command Get‑NetGPO,
this will show me all of the group policies that currently exist in the domain.
I can also further narrow this down by looking at which
of these apply to a specific machine.
For example, making use of the exact same command,
but this time appending it with a specific PC name,
it'll show me the group policies that are linked to that machine.
This will give you a good indication if different
computers have different policies,
and you could further enumerate those policies to
understand what they are doing.
When you look at DNS, you can get some really great information.
This type of information can easily be enumerated within the module.
By making use of the DomainDNSRecord and appending
it with a specific domain name,
it'll pipe out information about the different records.
Now when you take a look at the results,
you will see that you can get some really great information such as the name,
the distinguishedname, when the record was created and changed,
and the RecordType.
You could go one step further and also perform a filter
so that you can easily see the name, the RecordType,
and, of course, the Data.
Now from here,
you can look at performing additional attacks such as a DNS
zone transfer or poisoning the DNS cache.
PowerSploit also enables you to efficiently discover hosts on a network.
The functionality is baked into PowerSploit,
and you can easily make use of this by using the Invoke‑Portscan command.
Now this command has a number of different options that you can use.
Of course, the first thing that you need to do is specify the host subnet.
Now this can be specified either as a subnet form,
like what you see on your screen,
or you can also leverage a list as a text file and specify
the text file based on different IP addresses or subnets
that you would like to scan.
By making use of the PingOnly option,
this will check which of those hosts are alive,
and it will output those that are currently responding to a ping.
So I'll go ahead and perform the scan,
and it'll take a minute or so because I am scanning the entire subnet.
And let's see what results come back.
As I get the results,
let's quickly scroll through this to see which ones are alive.
Of course, I can perform a filter,
but I would like to show you what the output looks
like without any filters applied.
So in the list of results,
I've got a few machines which are currently active in responding to a ping.
So let's use the same Portscan command,
but this time actually scan for some ports.
I'm going to select the Hostname ending with 135 as my target.
So using the same command, I'll define my host.
This time I will use some tuning options,
and these are documented on PowerSploit's website, and I'm
going to be looking for the top 50 ports.
Now if I was looking for a specific type of port,
instead of using TopPorts,
I could make use of ports and then append it with the
port numbers that I'm looking for.
For example, if I'm looking for anything like 445, HTTP, and so forth.
But let's leave it as the top 50 ports and see what results we get back.
Now as I get the results back,
I can see that this specific host has four ports that are open,
two of which are really interesting, for example,
port 3389 and port 445.
So I'm going to go ahead and note this down so that we can
use this information in the next video.