[THEME MUSIC]
Exploiting WinRM, or the Windows Remote Management protocol.
Now that we've taken a look at how to exploit various Windows
services and protocols like SMB and RDP,
let's turn our attention to the final protocol
that we will be exploiting, and that, of course, is WinRM.
Now, you may not have heard about WinRM,
or if this is your first time hearing about it,
I'll be explaining that before we actually
get to the exploitation phase.
So before we get started with exploitation,
let's get an idea of what WinRM is, why it's used,
and the environments you'll likely find it in
or you'll likely find it configured in.
And the reason for that is because WinRM is a feature that
exists within Windows.
However, it is not configured to run by default
and needs to be explicitly configured and enabled
in order for it to work and in order for you to utilize it.
So first things first.
What is WinRM?
WinRM stands for the Windows Remote Management protocol.
It is a Windows Remote Management protocol
that can be used to facilitate remote access with Windows
systems over HTTP or HTTPS.
So the reason Microsoft implemented this feature
into Windows is primarily to make life easier
for system administrators.
So let's take a simple example.
In a standard company network, you'll
typically find a network of Windows systems,
and they could number--
or range from anything from 5 computers to 50 computers.
And, of course, this is a huge number
of computers to remotely manage and maintain.
And within that environment, you will
have a system administrator.
So a system administrator can utilize WinRM in order
to essentially access and interact with the Windows
systems on the local network, and WinRM can also
be configured to run across the internet.
So you can also configure WinRM to run on a Windows Server,
and then remotely access the Windows Server
and perform any types of commands or functionality
that you'd like to perform.
But that's really not the typical deployment case.
Well, in the shoes of a system administrator,
this is a fantastic protocol because, when they're
configuring the network, they can configure every Windows
host on that network to run WinRM or enable it-- or enable
WinRM on those hosts.
And they can then create a user account already,
or if they already have an administrator account
configured on those Windows hosts,
they can utilize those credentials to remotely access
these Windows systems.
And all they need to do is provide the user account
username and the password, and they
will be able to essentially execute
Windows commands, remotely interact
with them through a command shell, so on and so forth.
Now, in terms of the ports that WinRM runs on,
you'll typically find that it runs on TCP port 5985 or 5986
if an SSL certificate has been configured.
So always keep in mind that WinRM runs on 5985 and 5986--
or 5986, for that matter.
So now that you're aware of this protocol, let's
take a look at how authentication is facilitated.
So WinRM implements access control and security
for communication between systems through various forms
of authentication, one of them being just a simple username
and password authentication, whereby the administrator--
going back to our example--
can essentially just provide the target IP of the Windows system
that they're trying to access or interact with.
They then provide the user account username
and the password, and they'll be able to do what they want.
Alternatively, you can also provide a user account--
or, rather, the user account username and a password hash,
and authenticate with the password hash.
Now, in terms of exploitation, we
will be utilizing a utility called crackmapexec.
This is a penetration testing utility
that you'll typically find installed or pre-packaged
with penetration testing distributions.
And we can utilize this utility to perform a brute force
attack on WinRM in order to identify legitimate user
accounts and their passwords, as well as execute commands
on the target system.
So we can utilize it to find legitimate credentials
that we can then use to authenticate and run
arbitrary commands-- arbitrary Windows commands.
So, for example I can execute commands
like ipconfig, Who Am I, et cetera.
If we want to get a command shell,
however, we can utilize a Ruby script called evil-winrm.
And this utility-- again, we'll be taking a look
at how to use both of them, but this utility
is extremely helpful because once we've
obtained credentials, we can utilize it to get a command
shell session on the target.
We'll also be exploring the process
of obtaining a Meterpreter session through WinRM.
And, of course, that will be facilitated
through the Metasploit framework.
So we're going to be covering a lot of these techniques
and a lot of tools, and hopefully,
by the end of this video, you'll be comfortable with WinRM,
and you'll have a good understanding
of how you can perform an attack on it or on the protocol.
So the lab environment for this particular video
already has all of these tools prepackaged and configured,
so you don't need to download any additional tools.
So fire up the lab environment, as will I,
and I'll see you within the lab environment.
So I'm back within the lab environment,
and you will be provided with the target IP.
Of course, in your case, it's going to be different.
So I'm just going to copy that.
There we go.
And the first step, of course, will
involve performing an Nmap scan on the target
in order to identify whether WinRM is actually enabled
and running.
So I'll just zoom in a little bit here,
and we'll say nmap -sV.
And we can also specify the entire port
range or the specific ports that we're interested in.
But for the purpose of being time efficient,
I'll just provide the target IP, and I'll hit Enter.
And, of course, I'll give this a couple of seconds--
or, a couple of minutes to complete.
The scan completes, but we see that we cannot identify port
5985.
And the reason for that is because the default Nmap scan,
or the default ports with an Nmap--
the default ports that have been scanned
with this particular scan here are only
limited to 1,000 of the most common--
1,000 of the most commonly used ports.
So what we can do is we can perform an Nmap
scan on that exact port.
So we are going to say port is 5985.
And, of course, we can change that to 5986
or just specify the range of ports that you'd like to scan.
In this case, we'll just say 5985, and I'll then hit Enter.
And, of course, this will take much less time
because we're only scanning one port.
So I'm just going to wait for this to complete.
There we are.
You can see 5985 is currently open.
Now, don't really pay attention to the actual banner
or the service version that's displayed here, primarily
because Nmap--
or, rather, Windows systems don't explicitly
have a banner telling you that this is WinRM.
So do keep that in mind.
But we do know that WinRM is running
on this particular port.
And, of course, we can confirm that this
is the case through the use of the crackmapexec utility.
So, for example, I'll just clear up my terminal.
We can launch the tool by saying crackmapexec.
There we are, and we hit Enter.
So give that a couple of seconds to start up.
And taking a look at the documentation,
you can see that this is a Swiss army
knife for pen testing networks.
And it's very important that I take you
through how to utilize this tool because you will be using it
a lot during a penetration test.
So the key area I want you to focus on here
is the supported protocol.
So not only can you use crackmapexec to attack WinRM.
You can also use it to attack SSH, SMB, and MSSQL.
However, in this case, we will be primarily focusing on WinRM.
So to perform the brute-force attack, we can say--
or, we can essentially just type in crackmapexec exec, and then
we specify the protocol that we are attacking.
In this case, it's WinRM.
We then specify the target IP.
There we are.
I've just pasted it in there.
We can then specify the actual list or the word list that
contains the usernames that we would like to perform
the brute force with.
In this case, we will-- because we're only
looking for specific types of accounts like the administrator
account, we will explicitly say we
want to perform an administer-- we
want to perform the brute force attack on the administrator
account in order to identify the administrator's account
password.
So we'll say administrator, and we can then
specify the actual word list that
contains the passwords that we would like to perform
the brute force with.
And the one that we're going to be using
is under usr/share/metasploit framework/data/wordlists,
and we are going to use unix_passwords.
And, of course, in your case, feel free to change around
or to utilize any different word lists
that you would like to use.
And, of course, you have the ability
to generate your own word lists when
performing password cracking.
So, again, in this case, this is just
for the purpose of demonstration.
Now, as I said, you might be thinking to yourself, well,
why are we only targeting the administrator account?
Well, let's take a few things into consideration.
We know that on a Windows system,
the administrator account is definitely there
because it's the first account that's created
when you install Windows.
And secondly, the administrator account
is typically the user account that's
going to be used or accessed by system administrators
for obvious reasons.
And, of course, thirdly, if we gain access
to the administrator account, that
means we'll have elevated privileges,
and we will not have to go through the process
of elevating our privileges manually.
So we have specified all the options there,
and we can just hit Enter.
That's going to perform the brute force.
So give this a couple of seconds.
There we are.
At the end, you can see tells us that we
have a successful brute force or authentication attempt,
and it tells us that for the username or the user account
administrator, the password is Tinkerbell,
and it'll tell you, right over here, Pwn3d.
If we take a look at the output at the beginning here--
I just want to cover that right now--
you can see that it actually connects to--
it actually connects to WinRM.
Don't worry if it tells you that it's
using the wsman or the wsman service
because WinRM is essentially an implementation of wsman
or Windows Management, or the Windows Management API.
So now that we've identified the credentials,
we can utilize crackmapexec to execute arbitrary
Windows commands on the target.
So, for example, we can say crackmapexec.
We then specify WinRM and then the target IP.
So I'll paste that in there.
And we can specify the username, which is administrator.
Here we are.
And the password in this case is Tinkerbell not.
A very strong password, but there you go, Tinkerbell.
And we can then use the X option to execute a specific command.
So, for example, I can say whoami, and I'll hit Enter.
You can see that it connects to WinRM.
It authenticates successfully, and it tells us--
it provides us with the output of our command, whoami.
So we currently server administrator.
And we can also execute other commands
that are vital during a penetration test,
like system info, which will enumerate
all the information pertinent to this particular system.
So I'll hit Enter.
This command usually takes a while,
so we're just going to give it a couple of seconds here.
There we are.
So if we take a look at the output,
this command will tell us that it's running Windows Server
2019, and it provides us with the build number right
over there.
And, of course, what we've done here--
we've not utilized any exploit code
or exploited a vulnerability within WinRM.
We've simply performed a brute-force attack,
and we're now utilizing the WinRM protocol
to legitimately execute commands on the target system.
And, of course, executing commands on a target system
will have its own number of logs, which you can,
of course, clear very easily.
But this is relatively safe because, again,
if WinRM is enabled on a target, a firewall rule or exception
will be added so you can communicate
with the system via WinRM, without any restriction.
So that's cool, but can we obtain a command shell session?
Well, we can, and the tool we'll be using-- or, rather,
the Ruby script that we'll be using is called evil-winrm.
So there we are.
It's already configured on this system.
And in order to use it, we can essentially say evil-winrm,
and then we specify the username, which, in this case,
is administrator.
And we can then specify the password, which I will
encapsulate in single quotes.
Tinkerbell.
There we are.
And then the IP is specified using the i option,
and we can paste that in there.
This will automatically provide us
with a command shell session.
So I'll hit Enter.
There we are.
You can evil-winrm shell version 2.3, establishing connection
to the remote endpoint, and we get a command shell session
facilitated through PowerShell.
So we currently have access to the target system,
and we can do whatever we want.
So, for example, I can say whoami, ipconfig, net user,
and you can see we have other user accounts on the system
like sysadmin, auditor, et cetera, et cetera.
So this is great.
We've established access with the target system,
and we can always establish access
with the target system via WinRM as long
as we have the credentials that we were able to identify.
We can also obtain a Meterpreter session
through the use of the Metasploit framework.
So I'll open up a new tab here, and I'll
start up the PostgreSQL Database Service.
And we'll also start up msfconsole here.
And we'll just wait for this to start up.
So that is started up.
So the module that we're going to be utilizing
is a module called WinRM Script Exec.
So winrm_script.
That should bring it up.
There we are.
That's the module here.
So this is an exploit module for Windows and WinRM,
and it essentially allows us to perform remote code execution.
But more specifically, it will allow
us to essentially establish or obtain a Meterpreter session.
So I'll say use, paste that in there,
and it's going to say no payload configured.
It'll use the default 32-bit interpreter payload,
which is perfectly fine.
Of course, you can change that to a 64-bit payload
if you want.
We then need to set up the target IP,
so I'm just going to copy that here.
If we show the options for this particular module,
we can see that we need to specify the actual target,
the target IP.
The rport has been configured to 5985,
which is fine in this case.
So we'll say set RHOSTS.
There we are.
Paste in the target IP.
And, of course, you have the ability
to configure the payload options for the Meterpreter session.
So your LHOST value here is your IP, your Kali Linux IP address.
And the LPORT option is the port you will be listening on
for the connection from the Meterpreter payload,
once the second stage is executed.
In this case, we want to set the force VBS option to true.
This will essentially force the module
to use a Visual Basic command stager.
So we'll set FORCE_VBS to true.
And we then need to specify the username and the password.
So in this case, the username is administrator,
and the password is Tinkerbell.
So I'll say set USERNAME and set the password to Tinkerbell.
There we are.
And we can then hit exploit.
So it's going to begin sending the command stager.
So we'll give this a couple of seconds to complete.
This particular exploit module might not work,
and you have to keep retrying it.
In this case, let's see whether we'll
be able to obtain a Meterpreter session.
So it completes sending the stage,
and you can see that it tells us right away,
a Meterpreter session one opened.
And the current session is under the process xyjhd.exe
as server administrator.
It'll successfully migrate to SVC host for stability
as anti-authority system.
So we can say sysinfo.
There we are.
We now have a 64-bit Meterpreter possession
because it migrates to a 64-bit process.
And we then get the privileges associated
with that process, which, in this case,
is NT AUTHORITY/SYSTEM.
And we have successfully been able to obtain an Meterpreter
session on the target system via WinRM.
And, of course, this particular exploit module
requires credentials.
So you will need to perform the brute-force attack beforehand.
And as I said, there's multiple tools
that you can use to attack WinRM.
One of them is crackmapexec and, of course, evil-winrm.
Of course, if you want to utilize the Metasploit
framework for exploitation, you can also do that as well.
So that is going to conclude the practical demonstration
side of this video.
So that is going to conclude the Windows exploitation
section of this course.
In the next section, we'll begin taking a look
at the various privilege escalation
techniques we can use to elevate our privileges on Windows
systems after we've gained initial access on them.
So I'll see you in the next section.