Now that we've dumped the credentials,
let's go ahead and perform a lateral movement attack.
I'm going to make use of the new agent that we've got established,
which is a high privileged agent.
The first thing that I'm going to do is discover what
computers are currently active.
A great module to use to do that is the
situational_awareness powerview/get_computer module.
What this module does is actually queries the domain to see all of the
computer objects that exist. Within the options, I'll leave everything
as it is and go ahead and run this module.
Taking a look at the results,
I can see all of the computer objects that exist in this domain.
Now, I need to move to a higher privileged account, so
I'm looking for an Admin‑PC, and hopefully on that
Admin‑PC once I establish an agent,
I can go ahead and reperform the dumping of
credentials to steal the admin credentials.
So looking through the list,
I can see that there is one computer which is of
interest to me, and this is the ADMIN‑PC.
So let's go ahead and make use of another module to actually establish an
agent onto this machine. I'll continue to use my elevated agent, which has
been established on the ATTACKER machine, and this time I'm going to make
use of a lateral movement module.
Now there are a number of different modules that I can use, for example,
I can make use of psremoting if I knew that psremoting was enabled.
But the one that I'm going to select is the smbexec.
I'll populate the fields, and the computer that I'm
going to be targeting is the admin‑pc.
I need to populate the domain, and then for the hash values,
I'm going to use the hash value from the credentials that
we've dumped in the previous video.
Remember, one of those users was RonHD, who was part of the helpdesk group.
We've also identified that that helpdesk group is part of the local
administrators group on our initial targeted machine.
So there is a good possibility that this helpdesk group is also part
of the local administrators group on that Admin‑PC.
Once I specify the hash and the username, I need to go and actually define
the listener that I want to use. Now I can go ahead and create multiple
listeners, I can leverage a listener for Dropbox, or a different type of
HTTP listeners, or even an http_hop listener, but I'm going to keep this
simple and just make use of the HTTP listener for the sake of this
demonstration. I want to ensure that my command is obfuscated, so I will
set the value to True, and then I'm going to go ahead and submit this task.
Now that the task has been submitted,
I'll give it a minute or so, and I should get a new agent established.
So as I jump to my agents,
I can see that now I've got a new agent established. This time,
take note that this is an elevated agent because I have used the
hash value of the user account of RonHD, which is part of the
helpdesk group, which ultimately is part of the local
administrators group on the Admin‑PC.
Now this is great because I do not need to escalate my privileges.
Now, I can interact with this agent, and I can see that it is
established to the ADMIN‑PC at a high‑privilege level.
So I'll go and dump the credentials using the same method that
I've used before, and let's see what credentials turn up. Now
that the task has been completed,
let's quickly scroll through this output and see what we can find.
Take a look at the account that we've just discovered.
This seems to be an admin account for the GLOBOTICKET domain.
Remember initially, we've discovered that this domain, globomantics.com, has a
bidirectional trust with GloboTicket. We now have an account that we can use to
interact with machines on the GLOBOTICKET domain.
But what about the domain admin for GLOBOMANTICS? Well,
as I scroll down,
we have captured that account as well. We've got a
username of SamiraA, who is part of the domain admins
group. Looking at my credential store,
I now have all of these credentials saved. From here, I can go ahead
and do a DCSync on the globomantics.com domain or I can create the
golden ticket and ultimately own the domain.
I can also jump further and move laterally across to the other forest,
which is GLOBOTICKET, and then perform some additional
task to ultimately own that domain.