When you are going to use CrackMapExec as part of your
Windows network exploitation arsenal,
make sure to check out the integration with BloodHound.
BloodHound can help you find the fastest path to your target,
be it a certain user, box, or global admin domain pwnage,
it is able to map out all sessions, connections,
and elevation steps it requires to successfully obtain your goal.
Within CME,
there is functionality that allows you to set the host
you already own as such in BloodHound.
So it can plan a route with that information in its data pool.
CME also has the ability to inject payloads in the memory of a target system or
just execute a program remotely through these four methods.
CME will try them in this exact order.
Of course,
you can also specify the exact methods you would like to use by adding the
switch mentioned above and the method of choice behind it.
With the integration of BloodHound,
there should also be a possibility to spawn shells from CME.
Luckily, there are some nice integrations with Empire,
as well as Metasploit so you can connect through the API to launch
implants to your preferred post‑exploitation framework.
If you are not familiar with any of these integrated tools,
do check out their courses here, on Pluralsight as well,
and add those to your toolbelt too.
Lastly,
I would like to give you some technical information on
the technique used in this course.
Our industry colleague, harmj0y,
wrote a great article with everything you need to know about this
technique and even some pointers on how to defend against it.
With this,
I am sure that you will crack a box to map an AD network and exec
your payloads to achieve your goal like a boss.
Thank you for watching Lateral Movement with CrackMapExec on Pluralsight,
and I hope you join me and other authors to learn about more tools
to add to your red team arsenal in the future.