In this demo,
we're going to start using WMIOps to execute commands and
take other actions against Windows machines and Globomantics
domain from our exploited host.
We'll use the WMIOps Invoke ‑ExecCommandWMI function to
execute commands against these remote hosts.
We'll also use the job scheduling and service manipulation functions
to manipulate services and schedule jobs remotely.
Using these features will allow us to take actions against
remote workstations using credentials we already obtained by
exploiting one of the machines.
Let's head over to the lab and get started.
To run commands on our targets,
we're going to use the Invoke ‑ExecCommandWMI function.
In this example,
we're going to try to use this command to make a change on the
Window 7 device's registry and enable Remote Desktop.
I'll start by going into the Window 7 machine and
confirming that Remote Desktop is not allowed.
And I've now set this to Don't allow connection to the computer.
To double check that that worked,
let's try to access Remote Desktop from the Windows 10 machine.
As expected,
we're no longer able to access the window 7 target from our
Windows 10 machine using Remote Desktop.
If we want to enable this function,
one way to accomplish that is to modify the registry
key that is disabling Remote Desktop.
We can do this using the Invoke ‑ExecCommandWMI function and having
it run a reg add command with the appropriate key.
Let's see how that looks.
We'll start by typing the command Invoke ‑ExecCommandWMI,
then specifying a target, which in my case will be 10.0.0.30.
Now use the ‑Command option and follow it with a reg add command.
The key we need to change is in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Hive.
The specific key is fDenyTSConntions.
This key is a DWORD, and we need to enter zero to enable Remote Desktop.
We'll then at a /f as well to force the change.
And once we run that,
we see a display confirming that the process was started
with a ProcessId and a ReturnValue of 0,
indicating that it ran successfully.
Now when we try to access the Windows 7 machine through Remote Desktop,
we get a prompt for credentials, and once we enter them,
we're able to access the Windows 7 machine.
Now that we confirm that we can make this change,
let's go ahead and log off the Remote Desktop and explore using
the Job Scheduler to make additional changes.
The Invoke‑SchedJobManipulation function in WMIOps allows us to make
changes to a remote workstation's Task Scheduler.
We can list, create, or delete jobs,
enabling us to schedule configuration changes.
For this example,
let's go back into our Windows 7 target and deactivate Remote Desktop.
Now that we deactivated it, this time we'll re‑enable it using a scheduled task,
which we'll create using the job scheduling manipulator function.
We'll verify again that we can no longer connect to the Window 7 machine,
and now we are set.
To create a scheduled task,
we start with the Invoke‑SchedJobManipulation function, and
then specify our target with ‑Targets.
In my case, it is 10.0.0.30 again.
Then we used to create option with ‑create, and will use the
reg add command from the previous example.
Now we just need to add a time,
which I'm going to set for about 5 minutes from now.
Once we run it, we should get a confirmation that it was successful.
We can check this using another feature of Invoke‑SchedJobManipulation
by using the ‑list option to see our created task.
Let's go ahead and run that to see what it returns.
If we saw an error on this task that we wanted to fix before it ran,
we could use the ‑delete and the JobId, 1 in this case, to
remove the task from the remote machine.
Based on this output, our task looks fine.
Since we have access to our target,
we can also check the task scheduler to see that it was created, and
we see that it populated in our task scheduler.
We can confirm that it runs by waiting for the execution time.
I'll pause the video here and come back after the time target passes,
and once the time target passes,
we just need to refresh the task scheduler, and we can see that the operation
completed successfully. For true verification, let's see if we can access a
remote workstation using Remote Desktop again. And we can establish a Remote
Desktop session again showing that we successfully scheduled the task to modify
the registry. Before we move on to the next demo, let's do a quick recap of
what we learned so far.
We started this module using the Invoke‑ExecCommandWMI to run commands
on remote workstations using our domain credentials.
We used this function to modify a register key and enable Remote
Desktop connections on our Windows 7 target.
Once that was successful,
we accomplished the same task through another method using
theInvoke‑SchedJobManipulation function to create a scheduled
task to modify the same registry key.
Using these functions enables you to take immediate actions or
schedule future actions on remote Windows machines.
In the next demo,
we use other WMIOps commands to gather information from a remote host.