Hey there.
Welcome to the Collection with PowerSploit course.
In here,
you'll learn how to use PowerSploit's framework to extract
sensitive information from your target machines.
So imagine you're in a red team engagement,
and you already got access to a few Windows machines in the network.
One thing is giving a report to the client saying
their machines were compromised.
Another thing is showing the client what kind of data a
criminal could have access with this attack.
From my experience,
when you show to a client what kind of damage an attacker could make,
the client appreciates more your work.
For this reason, in a red team engagement,
it is important to collect sensitive information from your target machines.
So again, in our example, after getting access to some of the machines,
you can implement keyloggers in the victim computer to collect
everything they're typing without their knowing about it.
Or also,
you could take screenshots of the victim machine to get an
idea of what the user is doing and what kind of sensitive
information they deal with.
Or you could search the victim computer for sensitive files,
such as sensitive Excel spreadsheets.
Or even more creepy,
you can record audio from the victim microphone without them knowing about that.
And this means that you can listen to anything they're saying in the room,
and that's pretty scary, right?
And again,
this is the kind of information that will prove a point to your
client that security should be taken seriously.
One thing is giving to our client just a boring report.
Another thing is giving a folder with a lot of sensitive information,
including keylogger information and even microphone recordings.
And also,
some of the sensitive information can be used to escalate
your privileges and move laterally.
For example, with the keylogger information,
you may be able to get passwords from other servers.
Although in theory you can run all these collection attacks manually,
when you have several targets,
you need an automated away of collecting sensitive information,
and that's where PowerSploit comes to place.
PowerSploit is a huge framework with several tools for red team specialists,
and some of those tools include collection tools,
which help us to automate things like keylogging and microphone recordings.
The PowerSploit framework was originally developed by Matt Graeber,
and thanks to him, our job as red team specialists is way easier.
He released the first PowerSploit more than five years ago,
and since then, the project took off.
Nowadays, there is a lot of contributors to this project,
including Chris Campbell, Joe Bialek and Rich Lundeen.
The PowerSploit framework is a collection of Microsoft
PowerShell modules that can be used in pretty much all
phases of a red team assessment.
In this course,
we focus on the modules that help us to collect sensitive information,
but PowerSploit has actually more than 50 different tools,
from privilege escalation to exfiltration modules.
What I love about PowerSploit is that it is an open‑source tool,
meaning that you download it and change the script as much as you want.
You can find PowerSploit in this GitHub page.
Another thing that I love about PowerSploit it is that
it's a full framework for a red team.
It contains scripts that'll help you pretty much all
the phases throughout the assessment,
from reconnaissance to privilege escalation and exfiltration.
And also,
PowerSploit already comes built‑in with most of the command‑and‑control tools,
such as Covenant and Pupy.
And this means that if you're using one of those tools
to control your victim computer,
it can remotely launch PowerSploit commands just by
using the command‑and‑control tool,
and you can even automate those attacks across several machines.
And talking about automation,
PowerSploit is capable of automating the collections of sensitive data.
For example,
we can use this framework to automatically search for sensitive files,
recording microphone audio, take screenshots,
or even running keyloggers in a target machine.
If you're familiar with the red team kill chain,
we can map the PowerSploit tool to all the phases after the exploitation.
This framework contains scripts that'll help you to do internal reconnaissance,
privilege escalation, lateral movement, defense evasion,
collection, exfiltration, and much more.
In this course,
we'll focus on using PowerShell on the collection of sensitive data,
which is on the action phase.
Also,
if we map the techniques that I will lay out in this
course to the MITRE ATT&CK framework,
you'll see the PowerSploit can execute attacks in pretty
much all categories of the MITRE framework,
except the initial access.
In this course, we'll focus on one specific category, which is collection.
Inside of collection, we have four main techniques.
The first one is the audio capture,
in which you will use PowerSploit to record microphone audio
from our victim without them knowing about it.
And that's pretty creepy, right?
The second technique is the T1056, which is input capture.
In here, we use the keylogging module,
which will record everything that our victim types in their computer.
The third technique is a screen capture in which you use
PowerSploit to take screenshots in a specific time frame,
for example, one screenshot every three minutes.
In this way,
we can get an idea of what the user is doing and
hopefully catch some sensitive information.
The fourth technique is the 1039, which is data from network shared drive.
In here,
we use PowerSploit to find network shared folders and also find
sensitive files inside of those network folders.
That's pretty cool, right?
As we can see, PowerSploit covers a lot of collection techniques.
But before we get into the technical parts of this course,
I want you to keep in mind that performing any of those attacks
without authorization is legal in most countries.
And this means that if you enter in a computer and start
to collect data without authorization, you may go to jail.
Especially the microphone recording attack is definitely a criminal offense.
So it is important to stay legal .First,
if you're working on a red team project,
make sure you have a letter of engagement from the client
detailing the dates that the tests will be executed,
as well as the type of attack and scope.
Also,
it is important to have a formal document signed by the client detailing
and authorizing the attacks that you will be performing.
And this document is what differentiates a criminal from
a professional red team specialist.
And as a personal recommendation,
always consult the client before executing any
attack that may impact the network.
So, bottom line, don't be a criminal.
Now, let's understand the attacks that we'll be doing in our demos.
Let's say you're working on the red team engagement in a specific client.
At the beginning of the engagement, using malware and a phishing email,
you're able to get access to someone's laptop,
and this means that you have remote access to a Windows
machine and that the machine is in the domain.
Also, you worked a way and escalated your privilege in the machine,
meaning that now you have admin access to that machine.
So then you download PowerSploit on the machine,
or you simply run it from memory using PowerShell.
Then with PowerSploit on the machine,
we're able to run several collection attacks in that machine.
For example,
we use PowerSploit to take timed screenshots so then we can take a
look at what the person is doing in their computer and hopefully see
some sensitive information in there.
Also,
screenshots are a good way to see if the client security is
investigating something on the machine.
We also use PowerSploit to capture microphone audio from the computer,
and this means that we'll be able to listen to whatever the
person is talking without their knowing about it.
And this can be useful to listen for sensitive information and also to
know if the user is talking to any IT personnel.
Also, we use PowerSploit to deploy a keylogger in the system,
meaning that anything that a person types will be stored for us,
and this can be really useful to get sensitive information,
as well as getting user passwords.
And last,
we use PowerSploit to search for sensitive files in
the computer and in the network.
And here you'll learn how to automate file searches so you don't need
to be looking at every single file on the network.
That's very cool, right?
This shows you how much power a real hacker may have
if the machine is compromised.
It is scary to think that someone may have access to all
this data without me knowing about it.
One important thing that I want to mention is that PowerSploit
is usually detected by antivirus solutions,
and this means that if you're not careful,
you may get caught.
So in an engagement, you need to find ways to avoid being detected.
We'll not cover all these techniques in this course,
since it's an extensive topic,
and there's a few courses out there in detection evasion.
But basically, there are two ways of not getting detected when using PowerSploit.
First,
we can try to bypass the antivirus detection with some advanced techniques,
or we can simply use our admin privilege to disable the antivirus.
And actually here I'm talking not only the antivirus
solutions but any detection solutions such as host IPS
solutions and endpoint protection tools.
To bypass antivirus, there are a lot of techniques out there.
It all depends on which antivirus your client has.
But one really common technique is by doing script obfuscation.
If you're not familiar with script obfuscation,
I do recommend you a course here on Pluralsight called
Defense Evasion with Invoke‑Obfuscation.
In there,
you'll learn how to bypass most common antivirus
solutions by obscuring your scripts.
My advice for antivirus bypassing is to always test your
techniques in a cloned environment before sending the
script to your target machine.
For example, if your victim uses Windows 10 with Norton Antivirus,
then you should create in your lab environment a Windows 10
machine with the same antivirus solution.
So then you can test your obfuscation techniques and
ensure that it will not be detected.
Also in a real‑world red team exercise,
antivirus bypassing is the preferred method,
since it usually doesn't generate any suspicious logs.
For example, if you simply go and disable the antivirus,
the IT team may get a notification that someone deactivated the antivirus,
and this may look really suspicious.
But if you're simply bypassing the antivirus via obfuscation,
the IT team will not be informed at all.
Now, that being said,
in this course we will be simply disabling the
antivirus so you can run PowerSploit.
And although this is not the most recommended method,
it is the easiest way of running malicious code in a target machine.
Usually,
if I'm running out of time and if I don't care too much about being caught,
I simply use the admin account to go and disable all the
detection mechanisms in the machine,
and this may include the antivirus and the host IPS,
the endpoint protection tool, and even the Windows Defender.
So then I can be sure that I'll not be detected.
And as I mentioned before,
using this technique usually generates logs that something
suspicious is happening on the network.
However,
in some cases where we don't have enough time or we
don't care about being caught, this approach may be just fine.
If you want to get the most out of this course,
I do recommend you create a small lab environment
so you can practice this attack.
In here, I'm using a really simple Windows 2016 domain,
which includes a Windows 2016 domain controller and a Windows 2016 server,
which will be your victim.
And this simulates a corporate environment.
But if you don't want to create those complicated servers,
you can simply use a standalone Windows virtual machine.
Just keep in mind that depending on the version of the Windows you're using,
some attacks may not work, or they may require a different syntax.
So enough of talking.
Let's go to our demos and see how to collect sensitive
information from our victim machine.