PSEXEC has been a staple for Windows post exploitation pivoting and system administration for a long while. The basic premise of how all “psexec” tools work is:
- (Optional) Upload a service executable (PSEXECSVC.EXE in the case of SysInternal’s tool) to the ADMIN$ share
- Connect to the service manager on the remote host, and create a service based on either a local (to the remote system) executable or the uploaded one.
- Run the service
- Stop and delete the service and uploaded file pulling down the resulting output if any from the execution.
Now, as you can guess, the uploading of a file, creating, starting, stopping, and deletion of services create quite the logs and forensic evidence.
As you might imagine, thats not the best thing for us on the offensive side of infosec. Luckily big brother Microsoft provides another option, WMI (Windows Management Interface). I demonstrated the use of this in the past: HERE and HERE
The downside to using the WMIC directly is that you need a valid token or a valid password for it to work. Passing the hash didn’t used to be an available option.
That has changed with the “wmis” package on Kali Linux that incorporates the “Pass-the-Hash for 15 years toolkit”
(There is a slight problem where you have to play with it a bit to get it working on 64 bit Kali)
The other solution is supplied as an example in the Impacket library“wmiexec.py”. In my experience there are a few features that make it the better option.
- Installing it on a random VPS is dead simple and doesn’t need the Kali repos to get right, nor Debian/Ubuntu.
- It defaults to an “semi-interactive shell” which writes and reads output from the ADMIN$ shell by default. Something I would normally have to do manually with a bunch of tools
- As with the WMIS package, it allows you to just create a process without the ADMIN$ write/read.
Enough crazy talk here is an example usage of each:
WMIS
Usage:
1234567891011 | |
Example:
12345 | |
wmiexec.py
Using a password, but with hashes you just tell it -hashes :
Usage:
123456789101112131415161718192021 | |
Example:
1234567891011121314151617181920 | |
Clik here to view.
Image may be NSFW.Clik here to view.
Image may be NSFW.Clik here to view.
Image may be NSFW.Clik here to view.
Clik here to view.