Hello.
I'm Matt Glass, and welcome to this course on Lateral Movement with PsExec.
In this course, I'll show you how to use PsExec to execute commands,
programs,
and open up command shells on remote Windows workstations
using a host you already exploited.
But first, let's look at what PsExec is and how it's used.
PsExec is a tool that was created by Mark Russinovich as
part of the suite of tools called PsTools.
This tool suite contains multiple remote administration tools executed from
the command prompt on Windows servers and workstations.
Although hackers can misuse these tools,
they're very valuable as remote administration tools in a Windows environment.
I use them frequently throughout my career to patch systems,
run commands, and gather information from devices that I administered.
PsExec is specifically designed to execute processes on remote machines.
The only prerequisite is that you have sufficient
permissions to execute those processes,
which is why PsExec is used for lateral movement and not
initial access or privilege escalation.
You can obtain PsExec by downloading the PsTools suite from Microsoft.
PsExec's main advantage as a remote administration tool,
and for lateral movement, is that you can execute these processes,
run programs,
or open command prompts in remote workstations without
installing any additional software.
You only have to run the command from the exploited workstation
against other Windows machines that you want to access.
On the kill chain, PsExec falls under lateral movement only.
It's not used for exploitation, escalation,
or any functions beyond the lateral movement. This is due to that
requirement for their permissions to execute against the system.
The ATT&CK knowledge base, developed by MITRE,
categorizes adversary tactics and techniques into multiple
categories to describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We will cover two techniques,
one under the lateral movement tactic and one under the execution tactic.
The first technique that PsExec can be used for is remote services. In
particular, the sub‑technique for Windows admin shares.
The other technique is system services,
in particular the sub‑technique for service execution.
PsExec can accomplish this by enabling adversaries who have already
exploited a Windows machine and gained sufficient privileges to
move laterally throughout the network.
They could use PsExec to open command prompts on other Windows workstations,
and obtain information from them.
Or, if they had sufficient privileges from the exploited user,
they could use PsExec to access Windows servers in the datacenter.
PsExec allows hackers to start processes,
run programs,
or open command prompts on any system they can access with the
credentials they obtained through exploit and privilege escalation
without installing any additional software.