Before we go,
I want to show you another really cool feature using
the latest version of PowerSploit,
which is searching for interesting files in the local
computer and domain shares. For this demo,
as we're using the latest features,
we'll need to download the development version of PowerSploit. So let me
open my browser and access the development branch of the PowerSploit
tool. You can access it directly by typing this link. In here, I will
just click on the green button to download the repository as a zip.
Awesome! The file now is downloaded. So I will quickly open it and
extract it to my desktop.
Done! Now same as with the last demo, one of the features that we'll be using
in this demo is not in the PowerSploit module manifest.
So I have to edit this file here and add this string in the file.
It basically allows me to load the Find‑DomainShare when we load the
PowerSploit. Perfect! Now let me save this file and close it.
Now let's open the PowerShell as an administrator.
And as we've done before,
let me just make sure that the execution policy is
disabled by using this command.
Perfect! Now let me go to the PowerSploit dev folder and then use
the command Import‑Module with the file that we just edited to load
all the PowerSploit's modules in memory.
Done! Now we are ready to start using the tool.
So let me show you one of my favorite scripts,
which is Find‑DomainShare. This script is able to scan the whole
domain and find open shares for us to access.
And if we're using the flag ‑CheckShareAccess,
PowerSploit will only show us the network folders that we have access to.
So it will save me a lot of time when searching for
sensitive files. When we execute this command, it may give
you some errors in the beginning,
but eventually it'll give us a list of all the shares in
the network that we have access to.
In my case,
I found those shares here. And take a look, there's one interesting
share called InternalFiles in the LAB‑DC1 computer.
So keep this one in mind.
We'll use these one later.
Now let me show another tool that I really like. This
tool is called Find‑InterestingFile.
Once I give a folder to this script, it crawls through the
folder trying to find interesting files,
for example, files that contain passwords or sensitive information.
And you can use this tool to search local files or files on the network folders.
So let me do a quick search on the admin folder of this computer.
In theory, it can search the whole hard drive,
but it may take a while, so let's focus on the admin folder.
Done! As you can see, there are quite a lot of files.
All of them appeared interesting for the tool. For example,
this file here is called creds.txt, and this sounds promising.
So let's take a look at it. It's in the Documents folder.
Here it goes.
This file contains several credentials for some servers,
and that's definitely something that will help you in your red team engagement.
And the interesting part is that it can also run the same command,
but with a flag ‑OfficeDocs, and in this way,
the PowerSploit will search for interesting Microsoft Office documents
such as spreadsheets and sensitive word documents.
As you can see in my case,
there're no interesting Office documents here. So let's try to
find something on the network shared folders. For that, I'll use
the same common, Find‑InterestingFile.
But now, instead of using the local folder,
I used a network shared folder using the UNC path for the folder.
So do you remember that interesting shared folder that we
found using the Find‑DomainShare tool? So,
yeah, let's search for interesting files in there. Now,
when I press Enter, it will search through the whole shared folder looking for
files with interesting information. And take a look, we found something there.
In here, we have the path for the sensitive file.
We can simply select this path, copy it, open up Windows
Explorer, and paste it in the search bar.
And then it will open the document for us.
And here we go, one more set of credentials for our
collection. That's pretty cool, right?