Hello again, and welcome to the next demo for this course. We will be using
PsExec to run programs against different Windows targets.
In this demo,
we're going to look at how to structure a PsExec command
to execute programs on remote machines,
even if those programs aren't already on that remote workstation.
We're also going to use PsExec to attack our target and see if we can
obtain a connection to a new target through that one.
Using these techniques with PsExec allows you to run programs or scripts on
remote workstations that can create additional vulnerabilities.
Now that we understand what we're going to cover,
let's head back over to our exploited workstation and
start running some PsExec commands.
What we're going to do is use PsExec to run programs on our
remote machine and begin setting up our Windows 10
workstation for use in the next technique.
In order to do that,
we're going to set up over these two demos a process of getting files
onto our Windows 10 machine using the wget program to practice using
PsExec to execute remote programs on our Windows 10 machine. We'll be
using wget to copy over a PowerShell script and PsExec itself to the
Windows 10 machine.
And then in the next module, we'll use everything we set up to
create an account on the Active Directory server through our
Windows 10 machine. To get started,
let's head over to our Kali Linux machine and create that PowerShell script.
So to create the PowerShell script, what we're going to do is
first just create a file for that script,
which we'll call makeuser.ps1 and place it in our HTML directory.
This first line simply imports the Active Directory module
to our Windows 10 PowerShell session.
This creates a user named hackedGlobo,
and then I'm using this symbol to continue this command on the next line.
This line creates a simple password for the user,
and again,
I'm using this character to continue on the next line. And this
command makes sure that the account is enabled.
If you don't add the password and tell it to be enabled,
the account will be disabled with no password and not usable.
So, we want to have some way to test this and make sure that our
account is actually created. So now that we have this, we'll go
ahead and save this file, and start Apache.
Okay, now we can head back to our Windows 7 machine. Now,
I have already downloaded wget to this machine so that I can run it.
And it is a standalone executable like PsExec, so it doesn't
require installation on your target machine.
Running a program is slightly different,
but has a similar beginning of PsExec with a target after a double backslash.
And this time we used the ‑c to copy the program over to the remote workstation,
followed by wget.exe,
followed by the path to our Kali Linux VM and the file we want to download,
which in this case, will be makeuser.ps1.
Now we want to direct where wget saves this, so we use the
wget option ‑O, and we'll just go ahead and save it on the
C drive. And once that's hit,
we just run that command, and we'll see what happens.
And now we have confirmation that wget did, in fact,
download that file from our Kali Linux VM, and here we
can see it saved it as C:/makeuser.ps1.
So to run this command,
I also want to get PsExec downloaded onto our remote workstation.
So we're going to go ahead and use the same command, but this
time we're going to tell it to download PsExec, and we'll
also place that on the C drive.
Now that we downloaded that,
let's verify that it's actually on a remote
workstation using that same dir command.
And there it is. So we've got PsExec and our makeuser.ps1 file both saved on
our remote Windows 10 workstation ready for the next demo.
But first, let's recap what we learned in this demo.
We started out using PsExec to copy wget over to the remote workstation and
run a command to download a file to our Windows 10 machine.
We had created a makeuser.PowerShell file,
which we'll use in a later module, and successfully
copied it to the Windows 10 C directory.
We then used the same wget command to download
PsExec to the C directory as well, setting ourselves up for the next demo.