DCOM
In this section,
we will inspect a fairly recent lateral movement technique
that exploits the Distributed Component Object Model
or DCOM
and learn how it can be abused for lateral movement.
We are going to demonstrate this lateral movement attack
as the jen user logged in from the already compromised Windows 11 CLIENT74 host.
From an elevated PowerShell prompt,
we can instantiate a remote MMC 2.0 application
by specifying the target IP of FILES04
as the second argument of the GetTypeFromProgID method.
Once the application object is saved into the $dcom variable,
we can pass the required argument to the application
via the ExecuteShellCommand method.
The method accepts four parameters:
Command,
Directory,
Parameters,
and WindowState.
We’re only interested in the first and third parameters,
which will be populated with cmd and /c calc, respectively.
Once we execute these two PowerShell lines from CLIENT74,
we should have spawned an instance of the calculator app.
Let’s connect to the FILES04 machine
using remote desktop to verify that our method succeeded.
Because it’s within Session 0,
we can verify the calculator app is running
with tasklist and filtering out the output.
We can now improve our craft by extending this attack to a full reverse shell
similar to what we did in the PsExec section earlier in this Module.
Having generated the base64 encoded reverse shell with our Python script,
we can replace our DCOM payload with it.
Switching to our Kali machine,
we can verify any incoming connections
on the listener that we simultaneously set up.
Excellent!
We gained a foothold on an additional internal box
by abusing the DCOM MMC application.