In this demo,
we'll be using PoshC2 to harvest administrative credentials on our target
system to escalate our privileges in the Globomantics network.
We will then pivot to the enumeration of the Globomantics network to
identify additional systems to target with PoshC2 and move laterally
across the network creating additional accounts as we go to further
our Red teaming attack.
We will start again on our Kali system with the PoshC2 Server
running on the right‑hand side of the screen and our implant
handler running on the left side with our GLOBO‑PC‑01 implant
loaded. With our system ready,
we will start by harvesting the credentials of the IT admin
administrative account we uncovered during our previous enumeration
activities. PoshC2 has a simple module we can use for these purposes,
which we'll specifically target and brute force accounts found `in the
local administrative group.
We will run the command Brute‑locadmin and press Enter. For the
feedback on the PoshC2 server terminal screen, we see that the module
loads successfully on our victim system, and success, brute‑locadmin
has identified the credentials of our IT admin account as having a
password of password.
Armed with this information,
let's perform an ARP scan on the Globomantics network from the GLOBO‑PC‑01
system to identify potential systems we can target with our administrative
credentials. We will run arpscan in our implant handler to use the ARP scan
module and our target system will begin performing an ARP scan to provide us
information on what other systems reside on the same network. As we see from the
ARP scan results, there are a number of other systems found on the Globomantics
network for us to target.
We know from our previous enumeration activities that the
host IP of the CEO system is 192.168.1.5.
Let's direct our attack efforts at the system with an IP of 192.168.1.8 and
see if our admin credentials work on that system as well.
We will test to see if the IT admin administrative credentials also
have elevated privileges on our new target system by attempting to
create a new user account on that system. We will use PSexec, which has
a few modules built out in PoshC2.
We will first import the implant into PoshC2 running the command
loadmodule invoke‑psexec,ps1 and press Enter.
We see from the PoshC2 server terminal screen that the
module has successfully loaded so we can now run our module
with the invoke‑psexec command.
We will run Invoke‑PSexec and use the target switch with an IP address of
192.168.1.8 and now use the username switch for the IT admin and also with
the password switch with the password of password.
Now, we can use the command switch to have PSexec run a remote command.
After the command switch,
we will start with a single quote and type PowerShell.exe ‑C "net /add user
support password and close our double quotes and a single quote.
What this command will do when invoked is used PSexec to remotely run
PowerShell to run the net command to create a new account on the remote
system called support and with a password of password. Let's now invoke the
command and see if our IT admin account is an admin on the target system as
it is on GLOBO‑PC‑01. We see from the PoshC2 terminal window that the command
was successfully run and that the IT admin account has been authenticated on
the remote system and is indeed a local administrator on the 192.168.1.8
system.
We can do this using the net local group command. By promoting
this account to an administrator, it will allow us to run
additional commands on the remote system more discreetly than
continuing to use the IT admin account,
which may help to evade detection as we attempt to move
laterally across the Globomantics network.
Now let's run our previous Invoke.Psexec command again and modify our
command switch information in double quotes replacing our net/admin command
with the net localgroup administrators support /add.
And now we press Enter to invoke the command. In consulting with the
PoshC2 server terminal window, we see this command was also successfully
run on the remote system. With our newly‑minted administrative account on
our remote target, let's move laterally by dropping our implant payload on
that system so we can perform C2 operations directly on it as we are with
global PC‑01. PoshC2 offers a number of modules to install implants
remotely,
as well as additional ways to construct implant
communication channels on a system including daisy‑chaining
the implants for command and control.
For our purposes,
we will install an implant directly on the system also using PSexec.
This time, we will run the command invoke‑psexec payload,
which is another module built around PSexec.
We type the command invoke‑psexecpayload,
followed by the target switch with the IP of 192.168.1.8 and the
username switch with our support account and the password switch
followed by the password of password and press Enter. The module will
now prompt us for a payload to use.
We will utilize the payload.bat script for our purpose and press Enter.
As we see in the PoshC2 server terminal window, the payload was sent to
the target, and followed by a successful notification that we have a new
implant, number three, running on the GLOBO‑INFRA system, which is now
available to us. Reloading the implant handler by pressing Ctrl+D to
close our session and typing posh to reinitiate our session, we now see
both implant two an implant three available to use in command and control.
It is also good to call out here that unlike the
implant on our Globo‑PC‑01 system,
the GLOBO‑INFRA implant is already running from a privileged account as
designated with an asterisks next to the system username. We can go ahead and
press 3 to choose our new target system and continue lateral movement and
attack objectives across the Globomantics network.
This will end our demo where we harvested administrative
credentials from our victim machine and pivoted across the
network to identify additional systems to target.
We then used our gathered information to gain access to the GLOBO‑INFRA
system and provision new administrative credentials to further our attack and
lateral movement in the Globomantics network during which we remotely loaded
our PoshC2 implant onto our new target.