Exploiting WinRM, also known as the Windows Remote Management
Protocol.
In this video, we'll be taking a look
at how to utilize the Metasploit framework to exploit
the Windows Remote Management Protocol.
All right.
However, before we do that, we actually
need to get an understanding of what WinRM is
and what it is used for.
So what is WinRM?
WinRM, as I said, stands for the Windows Remote Management
Protocol.
This is a Windows Remote Management Protocol
that can be utilized to facilitate remote access
with Windows systems.
So again, it's very similar to other remote management
protocols that you'd come across.
Or one very simple comparison is SSH.
However, they work entirely differently.
The main objective of this protocol
is to facilitate remote access or the ability
to execute commands remotely on a Windows system.
Now, when it comes down to the deployment use case of WinRM
and how it is utilized, these are the following reasons
or the following ways that you'll typically
find WinRM being utilized in a Windows environment.
So you know, WinRM is typically used
to facilitate remote access and interaction with Windows hosts
on a local network.
So again, if you're ever working within a Windows Enterprise
environment, you may come across systems that have
WinRM enabled or configured.
And that is essentially used to facilitate or allow
administrators to essentially remotely access those Windows
systems, and then, of course execute commands or perform
various aspects of functionality or execute
various types of commands on these systems remotely.
It can also be utilized to remotely access
and execute commands on Windows systems on the internet.
So if you're-- again, you're trying to perform some remote
tasks or commands, or you're trying to perform some remote
functionality on a Windows system,
you can utilize WinRM to do this across the internet.
So again, if you are trying to access
or if you're trying to execute a command on a Windows server
that's probably hosted in the cloud
or that is probably in another continent,
you can utilize WinRM to do this.
WinRM is also used by administrators
to manage and configure Windows systems remotely.
And again, as I said, that can be
done both locally or across the internet
or on a public network.
Now, WinRM typically utilizes TCP port 5985
for a standard unencrypted connection
and 5986 for an encrypted HTTPS connection.
All right.
So that is what WinRM is, and how it can be utilized,
and the ports that you'll typically find WinRM
configured to run on.
Now, in regards to exploiting WinRM,
we need to understand how WinRM in regards to authentication.
Because given the fact that it is a remote management
protocol, there needs to be some form of authentication
or security behind the actual connection between the client
and the server, right?
And that is typically facilitated or implemented
in the form of authentication.
So again, you can either utilize a username and password,
so on and so forth, and we'll be exploring
this in a few seconds.
Now, we can utilize the Metasploit framework
to identify WinRM users and their passwords
by performing a brute-force attack
as well as having the ability to execute commands
on the target system once we have obtained credentials.
So again, in this video we're not really
looking at exploiting a vulnerable version of WinRM.
We are trying to exploit WinRM itself by, first and foremost,
identifying a username and password combination that
can provide us with access.
And then we're going to take a look at the various Metasploit
framework modules that can allow us to execute commands
remotely on the target system with the actual credentials.
And then we can also utilize a Metasploit framework WinRM
exploit module that can be used to obtain an Meterpreter
session on the target system in order
to gain remote access to the target system via a Meterpreter
session.
And of course, the actual privileges
that we'll be able to obtain will depend on the credentials
that we're able to discover in regards to the permissions
associated with the user--
with the username and the password.
So it's going to be very interesting.
And in this case, we're going to be utilizing a lab environment
to conduct these techniques and to go
through the process of exploiting WinRM.
So start up your lab environment,
and we'll be able to get started.
So I'm going to see you within the lab environment.
All right.
So I am back in the lab environment.
And it provides us with the target IP address,
which is very convenient.
And of course, in your case it's going to be different.
So just keep that in mind.
I'm going to copy the target IP address.
And then I'm going to open up a terminal here.
There we are.
And I'm going to zoom in a little bit
here so you can see what's going on.
And the first thing I'm going to do
is, of course, make sure that the PostgreSQL database
service is started.
So service postgresql start.
That's going to start it.
And that will, again, help us or will essentially
allow us to communicate and interact with the Metasploit
framework database.
I'm now going to start up the Metasploit Framework Console.
We're going to give that a few seconds.
We are then going to create a workspace.
And in this case, we're just going to call it WinRM.
There we are.
And we're currently working within that workspace.
We're now going to perform an Nmap scan on the target system.
And we're going to utilize the db_nmap command here
to essentially perform the Nmap scan within the Metasploit
framework console and consequently save
all of the results into the Metasploit framework database
in this particular workspace to be specific.
So we'll perform a SYN scan, some service version detection,
as well as operating system detection.
We'll then paste in the IP there, the IP of the target.
And then we'll hit Enter.
And that is going to start up the Nmap scan,
and it's going to save the results into the Metasploit
framework database so that we can access the results whenever
we want.
So I'm just going to wait for the scan to complete.
All right.
So the Nmap scan is complete.
And as you can see, we aren't able to identify
the WinRM service running here.
And that is primarily because we did not specify the actual port
range to use.
And by default, Nmap will scan 1,000 of the most commonly
used ports.
So we actually need to specify to Nmap
that we want to scan the entire TCP port range, which
is about 65,535 ports.
And that will, again, help us identify the actual service.
So again, we're going to give that
a few seconds to a couple of minutes, because, again, we're
going through the entire TCP port range.
Right.
Once the scan is complete, we can list out the services
by typing in services.
And as you can see, on port 5985 we
have the WinRM service running.
However, the actual banner provided to us by Nmap
doesn't indicate that.
However, we do know that port 5985 is set up for WinRM.
So the next option or the first order
of business in regards to actually confirming
whether we do have a WinRM service running on the target
is to actually check out the authentication methods that
are supported by WinRM on the target.
And in order to do this, we're going to search for a module.
So I'm going to say search, and the type
is going to be auxiliary.
And the name of the module or the actual module
itself is going to be WinRM.
So we can just say winrm.
And we are looking for the winrm_auth_methods module here.
That will tell us whether, first and foremost,
whether WinRM is actually enabled on the target
system, which we do know it is.
And it's also going to tell us the actual authentication
method supported by the WinRM service on the target.
So we're going to say use, show the options.
And what we're going to do is we're
going to set up the global variable for the RHOSTS value,
as we didn't do that already.
So I'm going to say setg RHOSTS, and paste in the target IP.
And if we show the options now, that should be set.
There we are.
As you can see, that is set correctly.
And we can then specify the target URI
of the WinRM service.
So to actually confirm this, we can actually
open this up in our browser.
And we can then paste in the target IP as well as
the actual port, which in this case is 5985.
So 5985, hit Enter.
As you can see, it tells us that the requested resource is not
found.
And then of course, if we try and access the WSMan service
or the actual directory, we can see
that it doesn't respond or provide us with any output.
And that is perfectly fine, as that's how it works.
So we'll just hit Run here.
As you can see it tells us that, indeed, WinRM
is running on the target system.
And the two authentication methods that are supported
are the Negotiate protocol and the Basic protocol.
So that means we can perform a brute-force on WinRM
on the target in order to identify both the username
and password that can consequently give us access
to the target system and, again, consequently allow us
to execute commands remotely.
Now, the name of the module that we
are going to be utilizing to do this is the WinRM login module.
So you can just search for it here,
that is winrm_login, hit Enter.
And that's the auxiliary module there.
And like previous services, we can utilize
this to perform a brute-force.
So I'm going to say use.
And we'll clear the terminal.
If I show the options, you can see
that we can specify the brute-force speed, which
we'll leave at 5.
And then of course, we need to specify
the target IP, which is done, as well as the target port, which
is 5985.
And the target URI is set to the default, which is WSMan.
So as you can see, this is used to specify
the URI of the WinRM service.
Now, we are going to be utilizing a few wordlists
for the user file, because we don't know what the username is
and the password is.
So we're going to perform a brute-force for both
the username and password.
In order to do that, we're going to set the user file
to /usr/share/metasploit framework/data/wordlists,
and we are going to utilize the common_users wordlist here,
or userlist, if you will.
We hit Enter.
And then we're going to set the password file
to /usr/share/metasploit framework/data/wordlists
and unix_passwords.
Once we're ready, we can just hit
Run to perform the brute-force.
As you can see, it'll go through all combinations here.
So we'll let that complete.
After a few minutes, we're able to identify
some legitimate credentials.
As you can see, it says right over here, login successful.
We get the username, which is "administrator,"
and the password, which is "tinkerbell."
All right.
So what I'm going to do is just terminate
the current brute-force.
And again, let's just crawl over to the actual results
here, which was, again, under the username administrator
and the password tinkerbell.
So now that we've identified the actual credentials
that we can utilize, we can test out
whether these credentials work by utilizing another WinRM
module that's afforded to us.
And that is the WinRM CMD module.
So we can search for that by saying search and then
specifying the type as auxiliary.
However, in this case, because we
know the exact name of the module, which is winrm_cmd,
we don't need to specify the type.
This is an auxiliary module.
All right.
So I'm just going to copy that.
And we're going to utilize this module.
So I'm going to paste in the actual module name.
If we show the options, we have the ability
to specify the target IP, as well as the target port,
and the target URI specified as the default, which is, again,
exactly how the target system is configured.
So we can set up the username here
that we were able to identify, which is administrator.
We can then set the password to tinkerbell,
which is exactly what we were able to identify previously.
And then we can specify the actual command
to run on the target system to confirm whether this, indeed,
works.
We can change this to something a little bit
interesting like, again, we can set it
to the whoami command, which will essentially tell us
what permissions we have with the username administrator.
But of course, that is really easy to understand,
or that is self-explanatory.
We should be able to, again, identify
or have administrator access, which is great.
So I'm going to set CMD to whoami.
And then we're going to hit Run.
As you can see, it says right over here the output
of the command that we run tells us that we are currently
the server administrator.
So we should have administrative privileges
if we are able to obtain a Meterpreter session.
So in order to execute or to obtain a Meterpreter session
through WinRM, we can utilize another module.
And this is going to be an exploit module.
So we're going to search for the module winrm_script.
And this is the model here.
As you can see, that's an exploit module.
This will allow us to perform remote code execution.
And in this case, we'll be able to,
again, obtain a Meterpreter session.
So I'm going to say use, paste that in there.
It's going to set the default payload
to windows/meterpreter/reverse_tcp,
which is fine, because we really don't have an idea of what
the target operating system architecture is.
If we show the options here, you can
see that we need to specify first and foremost
the actual password, the username and password
for WinRM that we were able to identify.
The target IP and port is specified, as well as
the target URI.
You can then specify the LHOST option--
this is going to be your Kali Linux IP address--
as well as any open port that you
want to utilize to receive the reverse connection on.
So we will set the username to administrator,
and we'll set the password to tinkerbell.
And we can hit Run.
As you can see, it's going to tell us right over here
that we have an issue with the actual runtime.
So it's going to tell us, unexpected node test.
And the reason it's doing that is because we didn't actually
set the force VBS, or Visual Basic Script, option.
So I'm going to show the options again.
And if we take a look at the options,
you can see we have the ability to force the module to utilize
the VBS command stager, which in this case, we need to do,
instead of utilizing the PowerShell command stager.
So we are going to set the FORCE_VBS option.
And we're going to set that to true, because that is a Boolean
value.
And we're going to hit Run.
And it's going to send the command stager.
So it's going to tell us or provide us with the status.
So we're going to give this a few seconds.
And once it reaches 100%, we should be OK.
Once the command stager is sent, it'll then send the stage,
and we'll get a Meterpreter session.
It is then going to attempt to migrate to a specified system
level process in order to achieve
administrative privileges.
And in this case, you can see it tells us that the session is
admin but not system.
So it's going to get us NT authority system privileges.
As you can see, it does that by migrating
to the svchost process.
And if we, again, type in sysinfo,
you can see that we are running on a Windows Server 2016
system.
And we obtain a 64-bit Meterpreter session,
not really because we utilized the 64-bit interpreter payload,
but because we migrated, or this particular module automatically
migrates, to the svchost process,
which is a 64-bit process.
If we type in get user ID, you see that we now
have NT authority system privileges, which
are the highest level of privileges on a Windows system,
which consequently means that we don't
need to elevate our privileges.
So that is how to exploit the WinRM service that's
running on a target system.
And that is going to conclude the practical demonstration
of this video.
All right.
In the next video, we are going to be exploring
the process of exploiting a vulnerable Apache Tomcat web
server.
So I'll see you there.