A common step in the life-cycle of a red team engagement is to gather as much information is possible for the compromised environments and the domain network. This activity is often called situational awareness and there is no defined list of commands that a red teamer should execute. However all the gathered information in that stage will determine the next actions towards privilege escalation and lateral movement and will assist to map the domain.

Traditional penetration tests during internal recon use Windows built-in commands such as net view, net user etc. in order to obtain host and domain information. These commands are considered the stealthiest approach for red teams since it can be monitored by the blue team and will trigger alerts. Alternative methods can be utilized such as PowerShell and WMI to conduct situational awareness without being detected.

PowerView

PowerView is a PowerShell script which was developed by Will Schroeder and is part of PowerSploit framework and Empire. The script relies solely on PowerShell and WMI (Windows Management Instrumentation) queries. From an existing meterpreter session PowerView can be loaded and executed with the following commands to retrieve information about the domain:

load powershell
powershell_import /root/Desktop/PowerView.ps1
powershell_execute Get-NetDomain
PowerView - Retrieve Domain Name Information
PowerView – Retrieve Domain Name Information

PowerView has a variety of cmdlets which can discover local administrators.

PowerView - Enumerate Local Admins
PowerView – Enumerate Local Admins

The Invoke-UserHunter can assist to expand network access since it can identify systems which users are logged into and can verify if the current user has local administrator access to these hosts.

PowerView - User Hunter
PowerView – User Hunter

Retrieval of domain information is also possible as PowerView contains several cmdlets.

PowerView - Obtain Trusts for the Forest
PowerView – Forest Information

PowerView is also implemented inside Empire. The following image illustrates the domain policy of the network.

Empire - Domain Policy
Empire – Domain Policy

There are also modules which can perform host based enumeration.

Empire - Windows Enum
Empire – Windows Enum

Alternatively there is a Python implementation of PowerView which can be executed from a host that is not part of the domain if credentials are supplied.

Pywerview
PywerView

HostRecon

There is a also a PowerShell script which automates the task of situational awareness in a host. Beau Bullock developed HostRecon and can retrieve various information from a host using PowerShell and WMI queries to evade detection.

powershell_import /root/Desktop/HostRecon.ps1
powershell_execute Invoke-HostRecon
HostRecon Execution
HostRecon Execution

HostRecon can enumerate the local users and the local administrators of the host.

HostRecon - Local Users and Local Admins
HostRecon – Local Users and Local Admins

The script will perform a series of checks to determine the firewall status, the antivirus solution installed, if LAPS is used and the application whitelisting product. Since remain stealthy is a high priority in a red team assessment gaining that knowledge is essential for the evasion actions that will be used in this stage and later.

HostRecon - Checks for Security
HostRecon – Checks for Security

The script also tries to identify and some domain information like the domain password policy, the domain controllers and the domain administrators.

HostRecon - Domain Checks
HostRecon – Domain Checks

HostEnum

A similar script to HostRecon was developed by Andrew Chiles that provides detailed information when it is executed in a host. HostEnum can be executed either locally or from memory and can generate output in HTML format.

load powershell
powershell_import /root/Desktop/HostEnum.ps1
powershell_shell
Invoke-HostEnum -Local -Domain
HostEnum
HostEnum

The parameter -Domain will perform and some domain checks like retrieving the list of domain users and other domain information.

HostEnum - Domain Users
HostEnum – Domain Users

Domain Information: 

HostEnum - Domain Checks
HostEnum – Domain Checks

RemoteRecon

In the scenario where local administrator credentials have been obtained and these credentials are shared into a number of hosts it is possible to utilize WMI in order to perform situational awareness on remote hosts. RemoteRecon was developed by Chris Ross and its purpose is to allow the red teamers to conduct recon without deploying the original implant. The script can capture keystrokes and screenshots, execute commands and shellcode and also can load PowerShell scripts for additional tasks.

Prior to any operation the script needs to be installed first remotely into hosts by using local administrator credentials or if the current user is already local admin on the target host only the computer name is necessary.

Import-Module .\RemoteRecon.ps1
Install-RemoteRecon -ComputerName 'WIN-2NE38K15TGH'
RemoteRecon - Install
RemoteRecon – Install

Output of the commands that are executed via the script can be retrieved with the Results parameter.

Invoke-PowerShellCmd -ComputerName 'WIN-2NE38K15TGH' -Cmd "ps -name exp" -Verbose
Invoke-PowerShellCmd -ComputerName 'WIN-2NE38K15TGH' -Results
RemoteRecon - Usage
RemoteRecon – Usage

References

5 Comments

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s