In this demo, we use WMIOps to gather information from remote Windows hosts.
We're going to use some of the functions to gather system
information from Globomantics hosts and other functions to
move files between systems.
Using these functions allows you to leverage WMIOps to gather more information
about potential targets and move files between machines.
Let's head over to the lab and get started.
For these examples,
I'm going to start gathering more information about one of
Globomantics' servers with the IP 10.0.0.19.
Let's start by listing the active processes to try to
determine what's running on the machine.
Immediately,
we gather some information about what this server likely is
from some of these running processes.
The presence of Microsoft.ActiveDirectory.WebServices.exe lets us
know the Active Directory is running on a server.
The WebServices.exe actually enables us to run Active
Directory PowerShell commands against it.
But more importantly,
this tells us that the server is the domain controller for Globomantics.
Similarly, the presence of DNS reinforces this conclusion.
We can also see vmtoolsd.exe at the bottom.
This indicates that this is likely a VMware virtual machine.
Now that we know the function of the system,
let's start exploring different directories that might give us the names
of some of the administrator accounts for the domain.
We can start by running Get‑SystemDrivesWMI to return the system drives.
In this case, the server's only running on the C: drive.
Since Microsoft creates a user profile for all the
users that log onto the system,
we can explore the user folder within the C: drive to see what other
administrator accounts might exist in the domain.
From this command,
we can see the globoadmin account and the built‑in
administrator account for the domain,
which is the account I'm using to access all the devices.
Just for fun,
I created a text file on the administrator's
desktop to try out the next command.
This simple text document just tells us that we are able to access the file.
We can start looking for this file using the
Find‑UserSpecifiedFileWMI command followed by our target,
the drive, and the final name.
Once that completes, we can see the path where the file is stored.
This function also supports searching for files by file extension,
which could be valuable in finding scripts or batch
files that may contain credentials.
To test if we can access the file, we use the Get‑FileContentsWMI command,
followed by the directory of that text document.
If the command is successful, we should return the file contents to the console.
Once that runs,
we see the content of that text file displayed here in the console.
While reading the file is great,
let's try one more command to actually download the
file to our exploited workstation.
For that, we use Invoke‑FileTransferOverWMI.
For this function.
We need to enter the credentials for the remote and local user.
For that, I'm going to use the administrator's account credentials.
I'll target the domain controller's IP address and specify
the file at C:\users\administrator\desktop\test.txt, and then
we need to set a download path.
In my case, I'm going to place this on the C: drive.
Once that completes,
we can check our C: drive for the file, and there it is. Let's open it
to confirm we got the right file, and we see the same message we saw in
our console. Before we move on to the next demo, let's do a quick recap
of what we've learned so far.
We started this demo by gathering process information using
Get‑RunningProcessesWMI and discovered the processes that indicated our
target server was likely a domain controller for Globomantics.test.
We then used Get‑SystemDrivesWMI to find all the system drives on
the server and Invoke‑DirectoryListing to find the user profiles. We
used Get‑FileContentsWMI to pull the file contents of a text file on
our administrator's desktop.
And then we downloaded that file to our exploited host using
Invoke‑FileTransferOverWMI. In the next demo, we'll complete
this course by using WMIOps to run PowerShell scripts and
laterally move through the network.