- [Instructor] So we saw how Powershell Empire
can be used to exploit individual machines,
but once you exploit an individual machine
you wanna gain as much information about
the network as possible.
So you'd like to actually find out other
hosts on the machine that are good targets.
You wanna eventually gain sensitive
information on the domain.
So let's look at some tools that you can use
within Powershell Empire to actually gain
important information from the network.
So there is the get computer command,
which queries the domain for certain computer objects.
One great thing about this is that you
can set an operating system.
So you can say search for all Windows seven machines.
So you can see we're typing in set operating system
star seven star, and that's basically searching for
any Windows seven machine on the network.
You'll probably wanna search the network
for Windows XP, Windows 2000, 2003 server.
So here you can see here's the XP command
to search for XP machines.
So let's search for Windows seven machines on the network.
You type in execute.
It takes a second like all these commands.
It's running all in memory and in
Powershell so it takes a second.
And you can see it popped up,
here is a Windows seven machine on the network.
And individual would probably wanna use this
for finding outdated machines that are not
patched such as Windows 2000, XP and 2003 server.
Let's look at more commands that you can use.
So still within this Power View section
we can look at get user, and what does this do?
This queries information for a given user on a domain.
So you see we typed in set username incorrectly,
you actually have to have the correct capitalization.
So we're executing this command on the particular user,
this individual probably has some higher level access.
We wanna find out more information about this person.
And you can see that it pulled out that this
person is the display name, you can see they're
a member of the domain admins user group,
and enterprise admin so you know this is an
important person on the network.
So, that member of is really key in there.
Usually once you find the individual you probably
wanna find out what systems they're actually logged into.
And that's another neat thing about this tool.
It has Powershell commands that you can use to
actually find out where exactly this person is
logged into the network.
We're using the user hunter command.
Which actually searches the network
for that particular person.
Now that we know the person's a domain admin,
we wanna know what computer they're logged into.
If we can compromise that computer,
then we can hopefully pull his password from memory.
So it takes a second.
And we can see the person is logged
into this machine on the network.
So now we have a machine that we're gonna wanna target
in order to pull this individuals password from memory.
So we can also use a command domain controller to find
out where the domain controllers are.
And you can see, here is the domain
controller in the network.
So you can see we're looking for domain admins.
We're using this command, get group members.
And you can see that we found that J King individual
is a member of the domain admins group,
and you can also see the administrator user is a
member of the main admins group.
So, we saw previously that J King was a member of the
domain admins, but here's another way you can get
a list of all the domain admins by just looking at
get group membership so that you can also find this out
using the tool for Linux or pulling a null session,
but this is another great way to find out the domain
admins that are on a network.
You see J King in administrators.