We have successfully gotten the username and password for some of the systems on our network.
Now, in order for us to fully take advantage of this,
we need to be able to remotely execute commands on that target system in our lateral attack on this,
and be able to avoid having to go to the system through things like MetaPtr,
because that's something that's not too terribly common in the firewall exemptions on base operating systems,
like Windows Defender and the firewall.
And I bring this up because there are a couple of tools that are within Kali that expand on lateral attacks.
In the regular start menu, you can go in there.
As a matter of fact, I'll pop over to the side screen real quick.
You can hit the start button and go down to section 10 for lateral movement.
And there's a couple of examples in there, but there's one in there we want to focus on.
That's up there, net exec.
And it's in the command line, it's nxc.
Now, I'll put all the codes below this, but the reason that I bring this up is because up to now,
we've been using MetaPtr in order to be able to go in, run commands, exfiltrate data,
do all sorts of different goody things to the actual targets that we're playing with.
But hear me out on this.
If we find a way to be able to run these commands on the target system without flagging the firewall rules
or any IDS IPS systems, that's always a benefit and a huge plus.
So, in this particular case, net exec will allow us to run commands on that target system from our Kali box
using a specified protocol.
Now, I'm going to highlight here and zoom in for you and then further explain this,
that you can see that net exec uses FTP, SSH, etc., etc., etc.
And each one of these protocols is assigned to a different port or common port assignment with IANA.
Now, why am I telling you this?
Well, because some of these are actually, by default, allowed through Windows Firewall.
For example, the one that we're going to be using, let me move up here real quick, is WinRM.
Now, WinRM is the Windows Remote Management Protocol and it uses two TCP ports,
5985 for plain text and 5986 for HTTPS.
And again, this is information that's good to have in your hip pocket,
but not necessarily required for the purposes of what we're doing here.
I just bring it up because WinRM is a protocol along with those ports
that is specifically stated to be allowed inside of that Windows operating system.
So, what this means is that if there's a network or system administrator
looking over logs and network traffic and things like that
and they see WinRM being executed, they're generally going to ignore it.
Because even though it is a remotely executed series of events that happens across the network,
it's not going to raise any suspicion.
Now, again, commands below, but what I'm doing here is using,
and I'll zoom in for you here real quick,
NXC, and the following is the actual protocol you want to use,
and in this case I'm using WinRM.
To the target IP address, which in this case is the domain controller,
dash U for administrator or username, dash P,
and you'll notice that I have a single quotation mark there.
That's because the way this transmits the data to the actual target
is done in plain text, and if you don't have those there
and you have special characters in your password,
it sometimes does not transmit correctly.
So the quotation, single quotation marks around that
force it to send it in that manner using those characters.
Weird, I know.
And I use the dash dash verbose to give us as much information about the target
giving us replies as possible, but the moneymaker here is the dash X.
This is where we're going to be putting in commands to run remotely
and have them executed for us.
In this case, I'm using something very simple,
DIR for directory listing.
Now, when I run this, and because it's a domain controller,
I don't have the actual domain in there,
and by default it goes to whatever domain it's on.
You can see here that I got a full directory listing of the computer itself,
or the directory that I'm in,
and I can even change it from directory to, let's say, ipconfig.
And right here we see the whole ipconfig.
Now, yes, it is in a little weird format,
but it's still nonetheless giving us commands that we can use.
And just to further mess with the actual system itself,
we'll do a shutdown, making sure I'm spelling that correctly,
dash F dash R dash T zero,
and you can see that it did send the command,
did it restart the domain controller?
Well, let's open it up and take a look.
Yes, yes it did.
So according to the permissions of the user account that you have,
you can send these commands to the target system
and have them run as you want,
masking it under a network protocol that is common
and should not raise any alarms.
But do keep in mind, this is a lateral attack,
and you're going to a specified system
and not necessarily going from one to the other,
basically elbow to foot, right?
So this is really handy when you're just trying to run commands
and get basic information
or just run something that's sitting on there like a script.
Let's say, for instance, you want dummy to run
so you can't open up a meter-reader session.
You could use NetExec in order to do that,
masking it under a common protocol
and have dummy dash dc dot exe
force a run using the credentials that you've already harvested,
either through the golden ticket or through some other method.