[MUSIC PLAYING]
Automating Windows local enumeration-- in this video,
we will be exploring the process of how
to automate all of the local enumeration stages
that we've gone through for the Windows operating system.
So why is this important?
Why would we want to automate what we can do manually?
Well, in addition to performing local enumeration manually,
we can also automate the process with the help of a few scripts
and Metasploit framework modules.
While local enumeration techniques or commands
are important to know, as a penetration tester,
you'll need to be time or resource efficient
when it comes down to time.
And as a result, you will need to learn
how to utilize various automated enumeration scripts
and tools to speed up the postexploitation phase.
Now, in addition to automating the process of enumeration
and enumerating information like system information,
users, and groups, et cetera, these automated enumeration
scripts will also provide you with additional information
regarding the target system--
like privilege escalation vulnerabilities,
locally-stored passwords, et cetera.
So the crux of what I'm getting at here
is that as a penetration tester, you're
going to have a fixed timeline, right?
And you are going to need to work based on the time
parameters allotted to you.
So when it comes down to postexploitation
and, more specifically, local enumeration,
while it is important to know how
to perform local enumeration manually,
you will need to, in most cases, speed up this process.
And that can be facilitated by various automation
scripts as well as a few Metasploit framework modules.
So that's what we're going to be exploring in this video.
Now, in regards to the Windows local enumeration
scripts that I'm going to be highlighting in this video,
I'm going to be covering one, and this is pretty much
the most pertinent one to what we have been doing.
We will be exploring other enumeration scripts
throughout this course, but for now, we're
going to start off with this one.
So the one we're going to be exploring
is called JAWS, right?
And JAWS is an abbreviation for Just Another Windows enum
Script.
JAWS is a PowerShell script that is designed
to help penetration testers and CTFers quickly identify
potential privilege escalation vectors on Windows systems.
It is written using PowerShell 2.0
and should run on every Windows version since Windows 7.
So the reason I've decided to showcase
this script is primarily because I use it quite a lot.
It is designed in PowerShell, which means, again,
you don't need to copy over an executable or any other script
that's designed in another language.
So it will run on every version of Windows since Windows 10--
or sorry since Windows 7, all the way
to Windows 10 and now 11.
Furthermore, it doesn't have any dependencies,
so you can run it without installing anything like .NET
4.5 et cetera.
So in terms of compatibility, it will
work on most Windows systems that you gain access to.
I'll be showing you how to utilize it
and how we will be transferring it into the lab environment.
Now, this video has its own lab environment,
so we're not going to be using the same lab environment we've
been using in the previous videos within the Windows
local enumeration section.
So we're going to start off by gaining access
to the target system.
We'll obtain an Meterpreter session,
and then we'll, firstly, explore a few Metasploit framework
postexploitation modules that will automate
local enumeration on Windows.
We'll then move on how to utilize the JAWS PowerShell
script.
All right, so fire up the lab environment,
and I'll see you there in a couple of seconds.
All right, so I'm back in the lab environment.
And you'll be provided with the target IP.
Of course, in your case, it's going to be different.
All you need to do is copy it.
So as I said, this is a new lab environment
with a differently configured target system.
So the first step that we need to perform
is to perform an Nmap scan on the target system.
And more specifically, we are going to be targeting
or we are interested in a particular port.
So this target system has WinRM enabled.
If you're not familiar with what we WinRM
is as a Windows protocol, you can
take a look at the system and host-based attacks course
to learn more about it.
But essentially, it runs on TCP port 5985 by default.
So we can perform a quick service version detection scan
on that specific port-- so 5985--
and we can paste in the target IP.
So we are going to be targeting the WinRM protocol that's
running on the target.
So we are just doing this to ensure
that it is up and running.
So we'll give this a couple of seconds.
There we are.
We can see that it is open, and it is running.
And don't worry about the service banner.
That really isn't important at this phase.
So in order to exploit we WinRM, we
are going to require legitimate credentials for the target
system, right?
And this lab environment already has these credentials
provided to you to actually streamline the exploitation
process.
So the username is going to be administrator,
and the password is Tinkerbell, all right?
So in order to utilize WinRM or in order
to exploit WinRM and consequently gain a Meterpreter
session, we are going to be utilizing a Metasploit
framework exploit module.
So I'll open up MSF console here,
and we can search for the module in question.
There we are.
And I'll just say search WinRM, all right?
And we are going to be utilizing the following exploit module.
So this is the exploit Windows WinRM WinRM script
exec you module.
And this requires legitimate credentials.
So we are going to say use for because I'm
specifying the module ID--
so use for.
It's going to select that module and it's
going to specify the default payload, which
is a 32-bit Meterpreter payload, which is perfectly fine.
If we show the options for this module,
we have a couple of options that we need to configure.
We firstly need to set up the target IP
address, which can be done by configuring the Rhost option.
We then need to set the username and password for the target
system that we can use to authenticate with the target
system via WinRM.
So I'm going to say set Rhosts and paste in the target IP.
We then need to set up the username.
So as I said, the username in this case
is going to be administrator.
So this will provide us with administrative privileges
on the target system.
And then the password we will set to Tinkerbell, all right?
There we go.
And we also need to set one more option,
and that is the force Visual Basic script option--
so force VBS.
You can see this will force the module
to use the VBS command stager.
So in this case, we're going to say set force VBS to true
because it is currently set to false.
And we will type in exploit.
Now, this will take a couple of seconds
to, essentially, send the stager.
So you can see it's going to give you--
it's going to highlight the progress here.
In some cases, this might not work during the first attempt.
So be cognizant of that.
If it doesn't work, you can rerun the exploit module again.
So once it is sent the stager, the command stager,
it should execute it and we should be provided
with a Meterpreter session.
In addition to that, this module will also
run the postexploitation migrate module
that will migrate our process from the current process
into a different process.
And in this case, you can see it's
trying the SVC host process.
And once it's successfully migrated,
it'll provide us with an elevated Meterpreter
session with NT authority system privileges, all right?
So if I type in sysinfo, you can see
that this is a different target than the one we
used in the previous video.
So this is running Windows Server 2016 build 17,763.
And we have a 64-bit Meterpreter session.
If I type in get user ID, you can
see we have the highest privileges
available on a Windows system, which is NT authority system.
All right, so let's get started, firstly,
by taking a look at a few postexploitation
Metasploit modules that can automate what we did previously
in addition to gathering more information about the target
system.
So this is pertinent to when you have access
to the target system via an Meterpreter session.
Right now, in the previous set of videos,
I didn't highlight how you can enumerate
additional information like displaying the mounted drives
on the target system.
So again, if you wanted to get an idea of the other drives
that are connected to a Windows system via Meterpreter,
you can essentially say show_mount.
And that'll tell you the list of mounts and drives
that you have.
So if the target system had an external hard drive or a flash
drive connected to it, it'll actually display that here.
And it'll also display where it's been mapped to.
In this case, we only have the C drive.
The size is 30 gigabytes, and the actual available space
is 15 gigabytes.
So again, that's information that
might be useful at a certain point in time.
Now, let's take a look at some of the post
exploitation models.
In order to do that, I'm going to put
this session in the background, and we
are going to search for a specific module here.
So let's start off with the win privs
module, which will essentially display our user privileges.
So there we are.
That's the module.
So I'll say, use zero.
And because this is a postexploitation module,
we need to set our current Meterpreter session ID.
So if we type in sessions, you can see that our Meterpreter
session has an ID of one.
So we will say set session to one, and we can then hit Run.
So we did this previously using the get privs command when
we were exploring how to enumerate users and groups
or user and group information.
As you can see, this will give you
a little bit more information.
So it'll tell you whether the current user
is an administrator, whether it has anti-authority system
privileges, whether it is part of the local admin group,
whether UAC is enabled.
So User Access Control is not enabled in this case,
and the user ID is anti-authority system.
And then, it'll actually display a list
of Windows privileges assigned to the current user you
have access to.
So that's one module.
We can also search for another one that will essentially
display the logged on users.
So we can search for it, and I believe
we have already explored it.
But you can see, there we are-- post Windows gather
enum logged on users.
This will display or gather the logged
on users via the Windows registry.
So I'll say, use zero, and we're going
to set the session to one.
And I can then hit Run.
And then we also, as we already explored this,
we'll display the currently logged on users.
We can see we have antiauthority system and the administrator.
And for recently logged on users,
we can see that the only user account that has logged on
is the administrator user.
The other ones are network and service accounts.
We then have another interesting postexploitation module
called check VM, all right?
So I'll say search and check VM.
And this will essentially tell you
whether the target system is a virtual machine.
Now, this might be important if you
are trying to understand whether the system you have just
exploited is actually running on a bare metal system
or it is a virtual machine.
So I'll say search VM.
And we are looking for the Windows module,
so post Windows gather checkVM.
And we'll say use two.
There we are.
And I'll set the session to one, and then I can hit Run.
It's going to check whether the target is a virtual machine.
And in this case, you can see that the target system is
indeed a zen virtual machine.
All right, so that information is very important
if you're trying to identify whether you've exploited
a virtual machine or a real workstation or laptop
for that matter.
We can also-- and this is something
that we didn't explore, but we can also
enumerate a list of installed applications or programs
on the target system.
This can be very important if you
are trying to identify a program that is installed on a target
system that might be vulnerable to a particular exploit--
more specifically, a privilege escalation
exploit or vulnerability for that matter.
So we'll search for a module called enum applications-- so
enum_applications.
And that's the one there.
This is a Windows post exploitation module.
So I'll say, use zero to select it, and set the session to one.
I will then type in run.
There we are.
So it's essentially going to enumerate
all installed applications on the target system.
And in this case, because this is a virtual machine,
it only has the following programs
installed-- so AWS PV drivers, AWS tools for Windows,
et cetera, et cetera.
All right, so we can also utilize
a few other postexploitation modules.
And the one that I'm going to cover now
is a postexploitation module that will essentially
enumerate all other computers connected
to the same network of the system
that you've just exploited.
So we'll search for it by saying enum search enum_computers.
All right, and we'll say use zero,
and we're going to set the session to one.
And we can then hit Run.
And you can see that the target system is not
part of a domain, which makes sense,
again, because this is running in the cloud.
If you performed this or ran this module
on a target system that is part of a network or domain,
it will enumerate the other systems
that are connected to that network, which, again,
is very important during the pivoting
phase of postexploitation.
A few other Metasploit modules that can automate what we were
able to do previously-- like enumerating a list of installed
patches or updates--
that module, in this case, is called enum patches.
So search enum patches.
And there we are.
So I'll Just say use zero, set the session to one,
and hit Run.
And that will essentially automate
the process of getting a list of installed patches.
So in this case, it'll sort out the information
based on what is really important for the penetration
tester.
So it'll give you the hotfix ID, and it'll
tell you when it was installed.
Now, when we were performing local enumeration manually,
we were able to identify additional information, which
is one of the reasons why I recommend that you learn how
to perform manual local enumeration before you actually
move on to automating it.
But this information is still very, very helpful.
Another post-exploitation module is the enum shares module,
which will essentially enumerate a list of SMB shares
that is accessible by or from the target system
you have exploited.
And this is, again, very useful when
you're working in a target environment that
has multiple systems connected to a network.
And in some cases, they could have share set up
to share files, et cetera.
So I'll say search, and we're looking
for enum shares so enum_shares.
And that's the module there.
So I'll say, use zero, set the session to one, and hit Run.
And you can see that no shares were found.
So again, this is essentially a list
of extremely helpful Metasploit framework postexploitation
modules for Windows local enumeration
or to automate Windows local enumeration.
Now, let's move on to JAWS, which,
again, is the enumeration script that I wanted to cover.
So in order to use it, you're going
to need to copy the PowerShell script from the GitHub
repository.
And I've already linked the link to the GitHub repository
within the slides.
So I'll just switch over to my browser
because the lab environment doesn't
have any internet access.
So I'm just going to switch over to my browser on my system,
and I'll show you how to copy the PowerShell script
and then how you can paste it within the lab environment.
So let me just switch over.
All right, so I'm currently on the JAWS GitHub repository.
As you can see, it'll give you a description as to what it is.
And the GitHub repository only contains the PowerShell script
called JAWS enum.
And it also provides you with really helpful information
regarding how to use this particular tool
within a command shell session as well
as a PowerShell session.
And it gives you a list of features here.
So this is all of the information
that it will enumerate for you.
So it will enumerate network information, the firewall
status and rules, running processes, files and folders
with full control or modify access, mapped drives,
and really a lot of information.
So you can now start to understand
why a tool like this or a script like this
is very useful because it will essentially
do all of this for you in terms of local enumeration.
So it'll enumerate, for example, system install files,
stored credentials, installed applications,
so on and so forth.
And you'll actually see how this works.
So in order to copy this to the lab environment,
because we cannot download the PowerShell script directly,
we are going to copy the content of the PowerShell script.
So I'm going to click on it there.
And this is the script right over here.
So we're going to click on Raw to get the raw output.
And you're now going to highlight all of this--
so control A, and then you can right click and copy that.
So once this is copied I can now switch over
to my lab environment where I'll show you
how to paste this into the lab environment clipboard.
All right, so I'm back within the lab environment
where we left off from.
And to paste what we have copied, what you need to do
is, on your keyboard, use the following keyboard combination.
So Control, Shift, and Alt, and that
will open up your clipboard options here.
So within your clipboard, the script content that you copied
should be pasted automatically.
If it's not, you can just hit control V to paste it.
Once the actual script that you copied
is highlighted under your clipboard,
that means that you can paste it into the lab environment.
So I'll close this side menu by saying Control, Shift, and Alt
again.
And we now need to create the JAWS script--
the JAWS PowerShell script.
So I'll open up a text editor here
within the lab environment.
And I'll just hit Control V to paste
in the content of the script.
There we are.
Now, if it doesn't copy, again, you can just
use Control, Shift, and Alt. And just make sure
that that is copied there.
So again, I can just paste in the content of the script
once more.
And I can then say Control, Shift, and Alt
to close that up.
And I can then say Control V, and you
can see that it's now pasted within the lab environment.
So this is the entire PowerShell script here.
So I can now click on Save.
And I'm going to save it on the root, desktop.
And where you store it is very important
because we're going to need to upload it to the target system.
So I will call this file JAWS enum--
so JAWS-enum.ps1-- because it's a PowerShell script--
and hit Save.
Now that that is done, we can close that up
and we can open up our current Meterpreter session.
There we are.
So I'll say sessions one.
And I'm going to navigate to the root of the C drive.
And within the root of the C drive,
whenever you're copying over exploit files or scripts
that you're using during a pen test,
always save them within the temp directory stored
within the root of the C drive.
If the temp directory doesn't exist,
you can create it by saying make directory temp.
And we're going to upload it within the temp directory.
So I'll CD into that directory.
And then we can utilize the built-in Meterpreter command
upload.
We're then going to specify where we saved the JAWS enum
script.
So root, desktop, JAWS-enum.ps1.
That is going to upload the PowerShell script.
And we can now open up a command shell session
by typing in shell.
And if I type in DIR, you can see,
we have it right over there ready to go.
So to execute a PowerShell script
from within a Windows command shell session,
we can type in PowerShell.exe.
We then need to set up the execution policy.
Because we are running a PowerShell script,
Windows by default doesn't allow users
to execute PowerShell scripts.
So we need to set the execution policy.
This will essentially allow us to run the JAWS-enum PowerShell
script without any issues.
So I'm going to say execution, and we're then
going to say policy bypass.
We then specify the file that we would like to execute so file.
We're then going to execute JAWS-enum.ps1.
We are then going to output the output--
or we're going to save the output produced
by the JAWS-enum PowerShell script into another file--
into a text file.
So we're going to say output filename,
and we're going to specify the file name here.
So I'm going to say-- we're going to call this
JAWS-enum.txt.
So what we're doing here is we're essentially saying,
I want you to execute the JAWS-enum PowerShell script
with PowerShell, and I want you to output the actual output
produced by the JAWS-enum PowerShell script into a text
file called JAWS-enum.txt.
The reason we are doing that is primarily because--
because we're enumerating all of this information or all
of the information you saw on the JAWS GitHub repository,
it's going to display a lot of information.
And we don't want that information
to be displayed on our terminal because we want to analyze it
within a text file so that we can actually
scroll through what we're interested in.
And of course, that is also very important for the purpose
of record keeping and note taking during a penetration
test.
So hit Enter.
If it runs successfully, you can see
it's going to say running JAWS enumeration.
It's then going to go through--
it's going to perform all of the enumeration checks
that we did during this section.
So it's going to gather user information.
It's going to get the processes, services, and scheduled tasks.
We also did that manually.
It's going to gather installed software.
It's also going to gather file system information as well
as a plethora of other information.
Now, I want to just give you a warning.
This script will take a couple of seconds
to a couple of minutes to complete.
Don't worry if it actually gets stuck at gathering file system
information.
Give it a couple of minutes.
Once it's done, you might get an error telling you
that a few checks failed.
That's perfectly fine.
It will still enumerate or automate
the process of enumerating a lot of information that's
very, very useful.
So again, I'll give this a couple of minutes, after which,
we can then download the JAWS-enum.txt file to our Kali
Linux system and analyze all of the information it was able
to get.
So I'll just give this a couple of minutes.
All right, so JAWS has completed performing or automating
all of the information or the actual local enumeration
process.
As I said, it might take a couple of minutes,
and you might get an error under the looking for simple priv esc
methods.
That's perfectly fine-- right over here.
Once it is done, if I type in DIR,
you can see that we have the JAWS-enum.txt that, again,
has quite a lot of data as you can see from the size there.
So we actually need to download this
onto our Kali Linux system.
So I'm going to hit Control and C to terminate this channel
to head back over into our Meterpreter session,
after which, if I say LS, you can see we have JAWS-enum.txt.
So I'm going to say download JAWS-enum enum.txt.
There we are.
And this should download it to the root of the Kali Linux file
system.
So I open up my File Manager here, you
can see there's the downloaded file.
So we can open this up in our text editor, and there you are.
So this is all of the output produced by JAWS.
So you can see that it will automate information
like the actual system information.
So in this case, it actually is quite
inaccurate in regards to the version of Windows Server,
but it could actually be accurate in the fact
that this is running on a data center.
You can see the architecture is 64-bit.
The host name is server.
Current user is, of course, antiauthority system.
It will also get the current date and time.
It then enumerates all user accounts.
So you can see you have the administrator,
you have another username called auditor, a user called demo,
the guest user account, and another user account
called sysadmin.
It will then automate or enumerate
the network information that we were
able to perform within the actual network information
enumeration video.
So you can see that it automates everything for you so that you
don't need to do it manually--
just with one check.
So there's all the network information.
There's the netstat command that we ran,
and then, of course, the firewall status.
You can see Windows Firewall is disabled.
And this is something that, again, is really cool.
It will also enumerate a list of firewall rules.
So these are all of the firewall rules right over here.
And then, it'll also enumerate the contents of the host file
to show you any specific hosts and their FQDN--
or Fully-Qualified Domain Names.
And then, of course, it'll enumerate the processes here
as we were able to do as well manually.
And then, of course, schedule tasks,
which is quite a lot of information as we
saw during these services or rather the processes
and services video.
So there we are.
These are all these scheduled tasks.
And we can scroll right to when this is done
enumerating the schedule tasks.
It'll also enumerate services.
So you can see how helpful this script is.
So this is a list of all the services and it
shows you the ones that are running,
as well as the ones that are stopped.
And you can go through that.
It'll also enumerate the installed programs--
which we did-- install patches, program folders.
So this will tell you where the programs are
installed for both program files and program files 86 or x86.
And then display files with full control and modify access.
So this is very useful during privilege escalation.
So it'll essentially tell you what
folders and files you can modify or that you actually
have the permissions to modify.
And it makes sense that the only directories we can modify
belong to the administrator user as well as a few others.
It also lists the mapped drives.
Then, from this point onwards, all of these checks
are really useful during privilege escalation.
So you can go through all of them here.
And right over here, it is actually done.
So you can see, it'll also check the final check
for auto admin log on.
And it will essentially check whether auto admin log on
is configured.
And if it is configured, it'll provide you with the password.
But in this case, it looks like it wasn't
able to get the password.
So this is the advantage of utilizing automated enumeration
scripts like JAWS.
As I said, there's quite a few out there that we will also
be exploring as we progress.
But JAWS is one that has helped me previously
and is extremely useful to, essentially,
automate the local enumeration process on Windows.
And furthermore, I really like the output
that it actually provides me with because all of the output
here can actually be stored or can
be pasted within my personal documentation or my notes.
And it's done or it's actually output or formatted in a way
that I can understand.
So that is how to automate the local enumeration
process on Windows, and that is going
to conclude the practical demonstration
side of this video.
All right, so now that we've explored
the process of performing local enumeration on Windows,
we can now turn our attention to Linux.
So in the next section, which is going to be the next video,
we're going to get started with how
to perform local enumeration on a Linux system.
So the next section will essentially
follow the same structure that we had within the Windows
local enumeration section.
And at the end of that section, we
will also be exploring the process
of how to automate Linux local enumeration.
With that being said, I'll be seeing you in the next video.