In this demo,
we're going to plan our post‑exploitation attack by
enumerating our victim system.
We will use a combination of PoshC2 modules and native Windows
commands to help us identify any potential system vulnerabilities,
as well as search for privileged accounts.
Additionally,
we will numerate network share locations connected to our target
system and exfiltrate data to our attack machine.
Starting on her Kali attack system,
we will open the Posh server in a terminal window with the command posh‑server.
Next,
we will open a second terminal window and run the command posh to start the
Implant Handler. We will use this split screen setup throughout our demo so we
may receive immediate feedback on the PoshC2 server for any commands run by the
PoshC2 Implant Handler against our compromised system. In the left terminal
window on our Implant Handler we can select our implant by selecting the number
next to the system.
Currently, we have a single implant to choose from.
However,
in addition to giving us some basic information about the
system on which the implant resides,
such as machine name and user we are connected to, this prompt
gives us the opportunity to switch between any exploited systems,
as well as send commands to all implants.
We will enter the number 2 and press Enter to start our command
and control activity on the GLOBO‑PC‑01 system.
We now get a PowerShell prompt indicating we are ready to send
our system commands. As I mentioned earlier, in addition to
running native Windows commands to gather information or take
action against our target system, PoshC2 is very extendable,
allowing any PowerShell script to run as a module by the framework.
We can see the extensive list of pre‑built scripts from the PoshC2
GitHub repo by running the listmodules command on the Impact Handler.
Scrolling up, we see a variety of scripts ready for us to run in our
attack engagement.
Another nice feature to call out here, which you may have noticed,
is the auto‑complete functionality,
which will offer you any relevant modules as you begin to
type your commands into the Impact Handler.
Let's now enumerate our target system by gathering some system
data. We will run the module get‑computerinfo.
This will allow us to review a number of pieces on our system,
including hotfixes applied, network data,
including the system IP address, as well as the physical resources at the
system's disposal. Gathering the system information can be key in
identifying potential vulnerabilities on the system,
which we can use PoshC2 or one of the compatible tooling modules
used to extend the functionality of PoshC2.
Next,
we will pivot and take a look at all the processes
which are running on the system.
This time, we will test out running WMI commands via PoshC2.
We enter wmic process list brief and press Return.
Reviewing this process information, along with the system information,
can help us to review any process vulnerabilities which can be exploited.
Speaking of vulnerabilities,
PoshC2 actually has a module to search just for that. You can run
find‑allvulns, and the module will hunt through the system,
identifying a potential vulnerability and if it
applies to the particular system.
Now let's search to see if the CEO has any mapped
drives or connected network shares,
which could potentially contain quite valuable information about Globomantics.
We run the command Get‑SMBMapping to search for shares.
And sure enough,
we have found a path to what appears to be a file server called GLOBO‑INFRA.
Let's dive deeper and see what the mapped drive actually contains.
We run ls, space, z:\ and press Enter. Jackpot! It looks like the
location contains some sensitive business data,
including payroll information.
Let's take advantage of this opportunity and copy some of
this data back to our attack system.
We can use the built‑in PoshC2 command of download‑file ‑source and in
parentheses z:\payroll.csv and press Enter. Reviewing our PoshC2 server, it
looks like the command was successful in copying the location.
All files we choose to copy from PoshC2 will be
stored underneath our project folder,
which in our case will be globo‑attack in the downloads directory.
Let's validate if the data actually transferred.
We will close out of the Implant Handler momentarily by pressing
Ctrl+D. At the terminal prompt, we will enter ls, space,
/var/poshc2/globo‑attack/downloads and press Enter.
Sure enough, the file is there,
and we have successfully exfiltrated data from the Globomantics network.
Let's move back into the Posh Implant Handler by typing
posh, and enter, and reselect our implant.
Now that we have a good understanding of the system
that the Globomantics' CEO is using,
let's direct our focus on the system accounts to identify any account with
privileged access. We can run get‑userinfo and press Enter,
which will load a PoshC2 module that enumerates the account information.
The command output offers us not only a complete list of all
users authorized on the GLOBO‑PC‑01 system,
but as we scroll up, it highlights the administrative group as well,
which will be a good target to focus on when we are ready to
start attacking the CEO and his system.
This ends our demo where we enumerated a compromised system to identify
potential weaknesses to exploit during our attack.
Additionally,
we were able to identify and expand our attack to connected network shares
and exfiltrate sensitive data from the Globomantics network