Welcome back to our lab environment.
Now that we have the Seatbelt ready, let's begin doing some discovery.
Let's start by doing some basic information gathering.
Let's use Seatbelt to get information about this local machine.
For that, I'll type Seatbelt.exe, and then OSInfo.
As you can see here, I have some information about this operating system,
like what is the Windows version and even the
specific release that is installed.
And this can be really useful to exploit vulnerabilities in the
operating system so we can try to escalate privileges.
I also have here some other cool information,
like the fact that this is a virtual machine in the time zone of my server.
All right, now, let's get some information about the users in this machine.
Let's use the Seatbelt module called LocalUsers.
Then, take a look, we have here only three local users,
the Administrator, the DefaultAccount, and a Guest account.
We can even see the last time they changed their password and
the last time they logged into the system.
Now, let's say that I want to save that information in a file.
No problem.
That's really easy.
I just have to run the same command,
but with the flag ‑outputfile and then the name of the file that I want to save.
In my case, I will call it local‑users.txt.
Once I run this, all the output is saved into a file.
So, let me open this file to show you the result.
As you can see here,
we have exactly the same information that we had in the terminal.
All right, let's say that now I want to know what is installed on this machine,
and again, with Seatbelt that's really easy.
We use Seatbelt.exe and then the module InstalledProducts.
And once I run this,
Seatbelt will list all the installed software in this machine.
As we can see, we have a lot of stuff in here,
like the 7‑Zip software, Visual Studio, Google Chrome,
and much more.
And actually, talking about Google Chrome,
since we have it installed on this machine,
let's do some discovery related to this browser.
Let's say I want to know all the websites that were accessed in the last days.
That's really easy.
We'll use Seatbelt with a module called ChromiumHistory.
Then, as you can see here, I have all my history,
like the GitHub page I accessed today and even the Google search I made.
Pretty cool, right?
Now you know why I love this tool.
And this is just the beginning.
There are literally dozens of modules in this tool,
and the reality is it would take me hours to go through one by one.
But, let me show you another cool thing you can do here.
Instead of running module by module manually,
we can use module groups to run several modules at once.
For example, let's say you want to execute all the modules
related to users, like enumerating users, enumerating groups,
collecting browser history, etc.
That's really easy to do that.
I just have to use Seatbelt with the flag ‑group and then ‑user, and this
will tell the tool to use other user‑related modules.
As we can see here, we've got a lot of information, and if
you're using this tool for the first time, all this information
might be a little bit overwhelming.
So, take your time to review all the data and try to understand what it's
used for. In this case here, we got some interesting information. For
example, we even got the password hash for this user that I'm using, and
this can be useful in case I hacked into a computer and I don't know the
password of the current user.
I can simply use any password cracking tool to crack this hash and
get a plaintext password. Now, similar to the user‑related modules,
we have the system‑related modules.
Let's take a quick look at them.
I'll use the same command with the ‑group flag, but now with
the system related modules. And after a few seconds, we got
tons of information about the system.
I will let you explore every single option on your own, but let me
show you some interesting data here, like we can see that this
machine has Windows Defender enabled, so you can plan your attacks
to try to bypass this product.
Also, we have here the DNS cache, which can be useful to understand what the
machine does and how we relate it to the our machines.
We also have here some interesting processes.
Again, the Windows Defender process is running, so you need to be
careful when executing any malicious payload.
Also, we can see here some of the network shares of the server and
even we can see who is connected to this machine using RDP. For
example, we can see here that we have a Remote Desktop connection
from my laptop to this machine.
And this can be good to understand if there's anyone currently working at the
machine. In a real red team engagement, it is a good idea to wait until no one
is in the server to start to attack it. Anyway, that's a lot of information
here, and I'll let you explore that on your own. But wait, if you think that's
a lot of information, let me show you something. You can use Seatbelt with the
option ‑group=all, and this will execute every single module of this tool. And
for that, I will also use the flag ‑full so all the results are fully shown.
And, as this will generate a lot of information, I will save the output into a
file name discovery‑all.txt. Once I run this, Seatbelt will execute every
single module and save the result into the file.
Once this is done, we can check the output file. As we can see here, we have a
lot of information and it would be impossible to review the whole file
together. We have here over 13,000 lines of information.
And as you can imagine,
this tool was able to collect pretty much everything you could
collect from environment variables to password hashes.