It's time for a demo where we use PsExec to execute some
commands on other Windows machines.
In this demo,
we're going to be running a command to obtain some
information about a Windows 10 target we have,
and we're going to see if we can run a few commands on that Windows
10 target to find some new targets on our network.
Using these features will allow you to run other
commands on remote workstations.
And this last scenario is used in a situation where you have exploited a
host, and you want to use it to try to find some new targets on the
internal network that it might have access to but which you can't reach
from your original hacking machine.
Let's head over to our exploited Windows 7 machine
and run a few PsExec commands.
All we need to run PsExec is to type the command,
and if you remember,
it's followed by a double backslash and then the IP address of our target,
which in my case is 192.168.178.60, and then we follow
that with the command we want to run. In this example,
I'll just run a basic ipconfig.
And once it goes through on that remote machine,
we can see the ipconfig results proving that it
actually ran on that remote workstation.
Now that we know how to use PsExec to run a command,
let's run something that gives us a little bit more information.
So let's try using PsExec to have our target host ping some
of the other workstations in its domain.
We'll start with having it ping the domain itself. To do that, we'll, again,
use PsExec, followed by the double backslash and the IP address of our target.
Then we'll follow that with a ping and our target host.
Let's start out trying to just ping the domain and see what happens.
Feel free to replace this if you actually set up a domain with a
domain or another workstation if you prefer.
And once it starts,
we can see that it resolved that IP address to 192.168.178.54,
which is the IP of the domain controller for this domain, and it
successfully received our pings.
So now that we've seen how to use PsExec to run commands on remote
workstations, let's do a quick recap of what we learned so far in this
demo. The first thing we did was use PsExec to run a simple ipconfig on a
remote workstation and verified that we can use PsExec to connect to that
remote workstation and were able to run commands on it with the current
permissions that we have.
We then used PsExec to run a ping against the domain and found the IP
address of the domain controller from that remote workstation.