In this demo,
we use WMIOps to run PowerShell scripts on remote hosts, enable
services, and laterally move through the network.
We'll use WMIOps to run PowerShell scripts remotely
and enable access on other systems.
We'll also use WMIOps commands to enable remote PowerShell access.
Using these techniques allows you to laterally move through a
network using the credentials you already obtained.
Let's head over to the lab and get started. To start this demo,
we'll send a script file over to the domain controller and use it
to create an account in Active Directory.
I called this script MakeUser, and it's included in your demo files.
It creates a simple user called Hacked in Globomantics domain.
We can copy this file to the domain controller using a simple copy command.
Once the file is copied,
we can execute the script using the Invoke‑ExecCommandWMI function
to run the script using a PowerShell command.
Once we get confirmation that this command ran successfully,
we can check in Active Directory to see if our
account was created. And there it is.
The Hacked account is listed in our Active Directory Users container.
Now that we know how to run scripts against remote servers,
we have one other test to accomplish, and that is to
leverage WMIOps for lateral movement.
To accomplish this,
we'll use the same Invoke‑ExecCommandWMI function to run a command to
enable remote PowerShell sessions. The command we'll run is winrm
quickconfig to enable remote PowerShell.
Once that succeeds, we can establish a PowerShell session using a few commands.
First,
we need to capture the credentials for our session and store them in a
variable. We can use Get‑Credential and store it in the value cred. And then we
just enter their credentials for our administrator account, and then that saved
those credentials under the cred variable.
Now we need to create the session and store that as variable as well.
We can use New‑PSSession with the credential we just captured and
target the domain controller by computer name.
Now we can enter the session using Enter‑PSSession
followed by our session variable.
And now we have a PowerShell session on our domain controller Let's
do a quick recap of what we learned in this demo.
We started out this demo by using the Invoke‑ExecCommandWMI
function to run a script on the domain controller and create
a user in Globomantics' domain.
We then conducted a successful lateral movement by using
the same function to enable remote PowerShell access and
entering a PowerShell session.
Throughout this course, you successfully downloaded and imported WMIOps,
used it to gather system information, enabled services using both
commands and the task scheduler, and successfully laterally moved
to another server within the domain.