Welcome to Windows lab environment.
As I mentioned, in my lab,
I'm using a Windows 2016 machine that I previous compromised.
This means that I have admin credentials to this machine.
So to get us started,
let me show you how I disabled the Windows Defender so
you can do the same in your lab.
In the real world scenario, you may choose to obfuscate your
code, instead of deactivating your antivirus.
But here, to keep things simple,
let's just disable the Windows Defender. So we can start by
going to the Start menu and then clicking Settings. In here, we
go to the Updates and security option.
Perfect.
Then we go to the Windows Defender option and,
as we can see, I have all the Windows Defender options disabled,
including the real‑time scanning.
Also, to make sure the Windows Defender is really off, we can go to
the group policy settings and disable it there. For that, let's go
to the Start menu and then type gpedit.msc. And then let's open the
Group Policy Editor. In here, I'll navigate to Computer
Configuration, Admin Templates,
Windows Components, and then Windows Defender antivirus.
Awesome. As we can see,
I have an option here called Turn off Windows Defender antivirus.
So I will double‑click this option and then select Enable.
And after that,
I would just click and apply. In this way, we assure that our Windows
Defender will not bother us during the demo. And to apply all those changes
that were made, let me quickly restart the machine.
Awesome.
If you follow the same step as I did in the Windows 2016 machine,
you should be able to run PowerSploit without issues.
Now first, let's start by downloading the PowerSploit from GitHub.
So I open my browser and navigate to this GitHub page. In here,
you see that PowerSploit has tons of modules and features,
but in this course, we are focused on the collection tools.
So let's go ahead and download the whole PowerSploit GitHub
by clicking the Clone or Download button.
Perfect.
I'll save this in my desktop just to make things easier.
Now, let me just extract the files to my desktop.
Now, if you're familiar with Powershell,
you know that this psd1 file is responsible for
mapping out the modules of a tool.
From my experience, most of the PowerSploits modules already mapped in this file,
but one of the modules that I will be using is not there.
So I will quickly open this file and add in this list the Get‑Microphone module.
And don't forget to put it between single quotes and a comma
after. You should type exactly as you've seen here.
Now let me save this file and we should be ready to use PowerSploit.
So let's start by opening PowerShell.
For that, I'll go to the Start menu, type Powershell,
right‑click on the icon, and select Run as administrator since
I have admin privilege for this computer.
Perfect. Now to be able to run a known Microsoft script, I'll disable
the script execution policy by using this command.
Basically,
this tell PowerShell to bypass the execution policy
restrictions that this computer may have.
And here, Windows give me an alert saying that this may be dangerous,
but it's fine.
We can bypass this and all future alerts by typing
A and pressing Enter. Perfect.
Now, let me navigate to the PowerSploit folder that is in my
desktop. In here, I'll import the PowerSploit framework by using
the import module command with the file PowerSploit.psd1, which is
the file that we just edited.
Once I run this command, all the PowerSploit features will be loaded in memory.
Awesome. To check if this was successful,
I'll just use the command,
get help and then the name of any module from the PowerSploit,
for example, Get‑TimedScreenshot.
And there you go.
It is perfect, it works.
We can see that we got a Help page from the PowerSploit,
which means that the tool is loaded and you're ready to start some fun stuff.
So let me clear this screen so we can start fresh.
Also, to organize the files we collect,
I will create the folder in my C drive called exfiltration. And inside
of this folder, I'll create three folders, one for the screenshots that
we collect, another one for the audio that we will collect, and another
one for the keylogger files.
If you're in a real red team engagement,
make sure you create those folders in a hidden place and do not use obvious
names. Here, I'm using easy names so you can follow the demo,
but try to save those files in places where people never check,
for example, instead of the Windows folder or in a hidden directory.
Cool.
So let's go back to our Powershell.
Let's run our first attack,
which is capturing one screenshot every 10 seconds and saving to a folder.
So I'll use the module, Get‑TimedScreenshots, and then use the flag ‑path
to specify the folder I want to save my screenshots,
and this is the folder that we just created.
Then I use the flag interval to specify the interval between screenshots.
my case, I want 1 screenshot every 10 seconds.
And then I use the flag EndTime to specify when the script will stop taking
screenshots. In my case, I'll put a few minutes from now.
Now let's run this.
While this is running, the PowerSploit will take 1 screenshot every 10
seconds and save in the folder that are created. And take a look, you can
see here in real time the screenshots showing up in the folder. And if
you open one of those screen shots,
you know that I can see everything that a person was doing.
That's pretty cool, right?
Now, let's stop this and go for a next attack,
which is recording the victim microphone.
And this is a really creepy attack since the person would
not know that they are being recorded.
And as I mentioned before,
make sure your client approve this kind of attack before executing it.
This kind of spying is a crime in several countries, so be careful.
So let's use the module,
Get‑MicrophoneAudio and then use the flags path to indicate the
folder that it will be saving the audio files.
And then let's use the flag length to specify how long we will record the audio.
In this case, I will be recording for 5 minutes, and that's it.
All we have to do now is run the script and take a look. As I'm
running these in the virtual machine, I got this error saying
that I don't have a recording device,
which means I don't have a microphone in the machine. In the red team
engagement, you see this error a lot if you're trying to attack a server or a
virtual machine since they usually don't have a microphone.
But if you're attacking a real laptop of a real user, this
script would run and would save the recordings into the
audio folder that I created.
Now let me show another really useful collection tool from PowerSploit,
which is the keylogger.
So let me use the module,
Get‑Keystrokes, and then use the flag LogPath to identify where
the keystrokes will be recorded. In my case,
I'll put the log file in a text file in the folder that we
created. And also, I will use the flag timeout to indicate that
I want to run the keylogger for five minutes only. Now all we
have to do is run this command.
Take a look, you may think that nothing is happening, but the command is
actually running the background and recording everything I type.
So if you go to exfiltration folder that I created,
you see the new text files in there.
So let's open it and take a look.
Once you open this text file,
we can see that every key that I typed is in this file and this
can be really useful for several reasons.
For example, with a keylogger,
we can easily get the username and password when someone is accessing
a website or another server. And this can be really interesting for
preview escalation or lateral movements.