In this last demo, I want to show you one more cool feature of Seatbelt.
So far, we're collecting information about the local machine that I was using,
but we can actually collect information from remote machines with this tool.
Yes, that's right.
We don't even need to copy the executable to a machine.
If we have the credentials to log into a computer,
we can discover information remotely.
And that's really good because we can leave zero footprint on the server,
and the chance of getting caught by the antivirus is reduced because
nothing is saved on the disk of the remote machine.
It is important to note that not all modules can be executed remotely.
If you run Seatbelt,
we'll get the help page. And see those modules here with the plus
sign beside it? Those are the modules that can be executed remotely.
For example, we can remotely collect the local users of a server. And
to do that, it's really simple.
I'll use Seatbelt, then the module that I want to use,
and then another few variables here.
First, computername in which we define the IP of the
computer that I want to enumerate.
Then, I'll use the flag ‑username to define the user that I
want to use to log into the machine. In here, it is important
to specify the domain of the user.
Then, I use the flag ‑password to input the password of this user. As we
can see, we have a really secure password. And that's it.
Once I run this, it will execute the LocalUsers module in the remote
server. Take a look. We have here some interesting usernames, like this
Oracle user and a few other Microsoft SQL users.
And remember, we can remotely run any of the modules that have a
plus sign beside their name, like we can enumerate all the RDP
sessions to a server by just using the exact same module, but
with the flags computername, username, and password.
Easy, right? Also,
if you want to run all the modules that support remote execution,
it is really easy.
We just have to use the command Seatbelt, then ‑group=remote, and this will
tell the tool to run every module that supports remote access. And again, we
have to use the computername, username, and password flags as those will
collect a huge amount of information.
I will save the output to a file called remote.txt.
Once I press Enter, the Seatbelt tool will connect to the
remote server and start to collect information.
As in here, we are discovering information over a network.
This might take a little while, but to save you some time,
I'll speed up this video. Then, after a couple of
minutes, the execution is completed.
So, let's take a look at the output file.
Perfect.
We have a lot of information here.
Again,
this might be a little bit overwhelming, but we got some good
information in here, like the fact that the remote server is missing
some hotfixes, and this means that this server might have some
vulnerabilities that we could try to exploit.
Also, we have here the list of accounts in the Administrators group, and
this could be interesting because we could try to hack into one of those
Microsoft SQL accounts or Oracle accounts.
Those are good candidates because if you get access to them,
we have full access to the domain. Anyways,
that is a lot of information here.
There are over 3000 lines.
So, in a red team engagement,
take your time to review this output and I'm sure you'll find interesting
information that will help you in your red team engagement.