Now that we have some background on PsExec,
it's time to dive into the demos and get some practical
experience using it for a lateral movement.
In this demo,
we'll be getting started with PsExec by copying it to a
Windows host we exploited and then exploring the available
options and command structure.
Let's first head over to the lab and take a quick
look at the environment I'm using, and then we'll get started.
For this course, I've set up two hosts that are running VMware ESXi,
each with three virtual machines on them.
This first one is just running the domain controller for
the small Windows domain I created,
and a Windows 2016 server that we can use as one of the targets.
I also have a Kali Linux workstation, which will be
providing PsExec to our target host.
On the other VMware host, I have three work stations,
one running Windows 7 and two Windows 10 hosts.
The Windows 7 workstation will serve as the exploited host for this environment.
You can follow along in this course as long as you have one host to run PsExec
commands from and a target host to run them against. For the ease of
demonstration with this course, I've opened up a remote desktop on this Windows
7 host to simulate that I've accessed it with the global admin credentials
using some kind of exploit beforehand.
In reality,
you'd likely have a shell or some other form of access, but
since this course is focused on PsExec,
I'm trying to make the environment as ideal as
possible to simulate PsExec for you.
But before we can start using it,
we first have to get it onto our target workstation.
There are multiple ways which you could transfer a
program to your target workstation.
I chose to use my Kali workstation as a web server
and host the file using Apache.
So all I have to do is navigate to my Kali Linux machine,
which is at this IP, and then type PsExec.exe, and I'll be able
to download the file. So I'll save this as PsExec in my
Downloads folder, and then I'm all set.
Alright, so we'll just navigate to the folder where we stored that. In reality,
you'd probably want to start somewhere other than
the Downloads folder, but again,
the focus of this course is on the operation of
PsExec, not covering your tracks.
So, with that in mind,
to run PsExec all you have to do is type the command and
that will pull up our list of options.
So it didn't show up on this machine because I've run PsExec on here before,
but in a normal situation,
the first time you're running PsExec you'll see this option accepteula here.
You're going to need to run that the first time, and if not,
it will give you a warning letting you know that you have to
do that, and what that is is just accepting the end user
license agreement for this tool.
Now that we got that out of the way, let's explore a few of the options.
So up here we have the command structure for a typical PsExec command,
which is going to be psexec followed by a double backslash and either the
computer name or the IP address of your target host.
You can also list your targets in a file, and reference that file
using the @ symbol followed by the file name.
We can then specify other account credentials if we have them followed
by another series of options that we can select,
such as ‑c, which, if we're going to run a program on the remote system,
we can tell PsExec to first copy that file to the system
and then run it locally. We have ‑d,
which won't wait for the process to terminate before moving on. A
scenario in which you would use this is if you wanted to spawn some sort
of process or maybe a shell on the remote system or start a program, but
you don't want PsExec to hang up waiting for that program to finish.
Using ‑d will tell PsExec to actually start that process, but then
PsExec will just let you know it started along with the process ID, and
move on.
We have ‑f, which operates the same way as ‑d,
except that it ignores any errors that might be caused if the file
already exists on the other program. We have ‑i as well, that actually
causes it to interact with the remote desktop.
While this is not ideal in a hacking scenario, I've used this
option in a system administrator role before. So you know
PsExec runs silently in the background,
transparent to the user's activity, under whatever credentials
you're using to run the command. What dash I will do is
actually show them what you're running.
So if you wanted to spawn a program that you want a user to interact with,
this is a good option to use, but for our purposes this is
not something we're going to mess with.
We have ‑h to try to use an account's elevated permissions if they're available,
‑l to do the opposite and run the commands only in a limited user instead of
running them from the Administrators group, and further down we can specify a
certain timeout for a connection to our remote system.
We also have ‑s here to try to run the process under the system account.
We also have options to set working directories, another
copy option using ‑v, and other options to try to mess with
the user interface down here.
So a quick recap of what we learned so far in this demo. We went over the lab
environment that we're using for this course, we copied PsExec to our target
machine and navigated to that directory so that we could run it, we also
looked at PsExec's command structure and some of the available options that
we'll explore in this course.