WMI and WinRM
The first lateral movement technique we are going to cover
is based on the Windows Management Instrumentation (WMI),
which is an object-oriented feature that facilitates task automation.
WMI is capable of creating processes via the Create method from the
Win32_Process class.
To demonstrate this attack technique,
we’ll first briefly showcase the wmic utility,
which has been recently deprecated,
and then we’ll discover how to conduct the same WMI attack via PowerShell.
In order to create a process on the remote target via WMI,
we need credentials of a member of the Administrators local group,
which can also be a domain user.
In the following examples, we are going to perform the attacks as the user jen,
which is both a domain user and a member of the Local Administrator group
for the target machines.
We can test command on CLIENT74 connected as the jeff user.
Historically, wmic has been abused for lateral movement via the command line
by specifying the target IP after the /node: argument,
then user and password after the /user: and /password: keywords,
respectively.
We’ll also instruct wmic to launch a calculator instance with the process call
create keywords.
The WMI job returned the PID of the newly created process,
and a return value of “0”, meaning that the process has been created successfully.
Translating this attack into PowerShell syntax requires a few extra details.
We need to create a PSCredential object that will store our session username
and password.
To do that, we will first store the username and password
in the respective variables,
and then secure the password via the ConvertTo-SecureString cmdlet.
Finally, we’ll create a new PSCredential object with the given username
and secureString object.
Next, we want to create a Common Information Model (CIM)
via the _New-CimSession cmdlet.
We’ll first specify DCOM as the protocol for the WMI session
with the New-CimSessionOption cmdlet on the first line.
On the second line, we’ll create the new session against our target IP
and supply the PSCredential object along with the session options.
Lastly, we’ll define ‘calc’ as the payload to be executed by WMI.
As a final step, we need to tie together all the arguments we configured previously
by issuing the Invoke-CimMethod cmdlet
and supplying Win32_Process and Create as ClassName and MethodName, respectively.
To simulate the technique, we can again use CLIENT74 as jeff
and insert the above code in a PowerShell prompt.
Let’s connect to the target machine and verify that our technique worked.
Verifying the active processes on the target machine,
reveals that a new calculator process has been launched,
confirming that our attack has succeeded.
To further improve our craft, we could replace the previous payload
with a full reverse shell written in PowerShell.
First, we’ll encode the PowerShell reverse shell so we don’t need to escape
any special characters when inserting it as a WMI payload.
The following Python code encodes the PowerShell reverse shell to base64
contained in the payload variable and then prints the result to standard output.
As reviewing the entire PowerShell payload is outside the scope of this Module,
we should replace the IP and port with the ones of our attacker Kali machine.
Once we have saved the Python script,
we can run it and retrieve the output to use later.
After setting up a Netcat listener on port 443 on our Kali machine,
we can move on to client74 and run the PowerShell WMI script
with the newly generated encoded reverse-shell payload.
From the output , we can conclude that the process creation has been successful
and switch to our listener for a final confirmation.
Nice! We indeed managed to move laterally and gain privileges as the jen domain user
on an internal server by abusing WMI features.
As an alternative method to WMI for remote management,
WinRM can be employed for remote hosts management.
The winrs utility can be invoked by specifying the target host
through the -r: argument,
and the username and password with -u: and -p, respectively.
As a final argument, we want to specify the commands to be executed
on the remote host.
For example, we want to run the hostname and whoami commands
to prove that they are running on the remote target.
The output confirms that we have indeed executed the commands remotely on FILES04.
To convert this technique into a full lateral movement scenario,
we just need to replace the previous commands with the base64 encoded
reverse-shell we wrote earlier.
Lets start a listener first,
Once we run command, we should be welcomed with a reverse-shell from FILE04.
PowerShell also has WinRM built-in capabilities called PowerShell remoting,
which can be invoked via the New-PSSession cmdlet
by providing the IP of the target host along with the credentials
in a credential object format similar to what we did previously.
To interact with the session ID 1 we created,
we can issue the Enter-PSSession cmdlet followed by the session ID.
Once more, we’ve proven that the session is originating from the target host
through yet another lateral movement technique.