Alright,
on to our last demo where we'll be doing some lateral movement with PsExec.
To start that, we're going to laterally move to our Windows 10
machine and interact with it using a command prompt.
From there,
we're going to finish what we started in the last demo by
using PsExec to run commands from this Windows 10 machine
on our domain controller.
By using these techniques,
you'll learn how to effectively use PsExec to
laterally move throughout a network,
as long as you have permissions on your target.
Let's head back over to that Windows 7 machine and get started.
Alright, it's finally time to do some lateral movement.
So in order to do that what we're going to do is use our
same psexec command we've been using,
and this time the command we're going to run is
cmd​.exe with no further arguments.
So what this is going to do is start a command prompt on the remote workstation,
but allow us to interact directly with it in this same session.
So we'll go ahead and run that.
And once it starts up,
we see the familiar command prompt start in our Windows\system32 directory.
The difference is this time we're on the Windows 10 machine.
So, we have now successfully laterally moved to our Windows 10 machine,
but let's finish up what we started in the last module and run a
PsExec command against our domain controller.
We put everything that we downloaded to this machine in the C
drive, so let's change directory over there. We'll do a quick dir
to make sure that we still have everything,
which we do.
To speed things up, you can just use a copy command like this one to copy
that makeuser.ps1 file over to the domain controller.
And now we're all set to run it.
So, to do that, we're going to use the same PsExec command we've been using,
double backslash,
the IP address of the domain controller at this
time, and now we'll run PowerShell,
followed by the path to our makeuser.ps1 file.
Alright, and it looks like it succeeded, but we'll verify that in a minute.
Now, I will say if you get a handle is invalid error or a permission error,
Windows 10 and Server 2016 have a few security mechanisms built in,
which from time to time can trip you up with PsExec.
So if this happened to you,
go back and recreate the session with Windows 10, but manually
type in the credentials with a ‑u and a ‑p,
and that should help resolve it.
You can try the same thing manually using a ‑u and ‑p
against the Server 2016 server.
One way that we can check this is to actually log in to our Active
Directory server and see if the user was created, or if you notice,
we were able to run a PowerShell command.
Let's see if we can laterally move over and establish a
PowerShell session with our domain controller.
And this time we'll try to directly access the domain controller.
And this time we can see that we're able to jump directly into a
PowerShell session on the domain controller.
And now since we are in the domain controller,
we can run Active Directory PowerShell commands and we
can see if that user was created.
And for that, we type a get‑aduser and a name,
in my case I created an account called hackedGlobo.
And there's your verification that the script successfully created a
user called hackedGlobo on the Globomantics domain.
So now that we confirm that and we've laterally moved to two different machines,
let's do a quick recap of what we covered in this demo.
We started out this demo using PsExec to establish a command
prompt session with our Windows 10 machine.
From there,
we copied that PowerShell script over to our domain controller
and then used PsExec to run it and successfully create a new
user in the Globomantics domain.
We then verified that by first using PsExec to do a successful lateral move and
establish a PowerShell session with our domain controller.
We then used get‑aduser to verify that our script had
successfully run and created the user hackedGlobo.
So, I know that there are more efficient ways of accomplishing these same tasks.
As you can see, we could have gone straight from our Windows 7 machine,
established a PowerShell session,
and just created the user using a new aduser command instead of
writing a script and downloading it to Windows 10.
But again,
the goal of this course was to demonstrate lateral movement
with PsExec. So by going through this process,
you've learned how to successfully use PsExec to run different programs,
to run scripts,
and to laterally move into different machines
throughout a domain that you've exploited.