Gaining Shell Access
Introduction
When attacking Windows Domain, Shells are not necessarily needed in order to compromise a domain. But if you are stuck or if you want to gather more information/sensitive files, getting into a shell is beneficial.
Metasploit
The problem with Metasploit is that it produces a lot of noise in the network and will be most likely get picked up by security devices.
Run Metasploit
Use PsExec Module
Set Module Options
You would need to set the following module options for you to be able to connect to a host.
RHOST- IP Address of the target host.SMBDomain- Windows domain (contoso.local). Set this if you intend to use a Domain Account.SMBPass- Password for the specified username.SMBUser- Username to authenticate as.
Other configurable options:
Payload
Target
You can use the show options or options command to display the list of configurable options for the module.
You can set the Payload by running the command:
Syntax: set payload [payload]
Run Exploit
To run the exploit you just need to enter the run or exploit command.
PsExec using NTLM Hash
You can also use the SAM Hash for PsExec. This is useful if you are unable to crack the hash of a local account. When setting the SMBPass use the whole hash value of the account in the SAM file.
Syntax: set SMBPass [NTLM Hash]
Unset domain so that we can use local credentials. You can also use set SMBDomain.
PsExec.py
This is much quieter than Metasploit and will not get picked up as much. You can also use this tool with password or with hash.
Using Password
Syntax: psexec.py [domain]/username:['password']@[Target]
If the password is complex or you are having errors due to the characters in the password, you can use the command psexec.py domain/username:@[IP]. Once you run this command you will then be asked to enter the password.
Using Hash
Syntax: psexec.py [username]@[IP] -hashes [NTLM Hash]
Alternative Programs
Last updated
