We normally wait a month before posting the video of our webcasts in an effort to encourage people to attend the live event. Considering the timely nature of the content of this particular attack and the numerous suggestions to release it early, here it is.

Permalink: [Article]-Video: Abusing Windows Remote Management (WinRM) with Metasploit (http://www.ethicalhacker.net/content/view/454/2/)

Quote

Entire Webcast Now Available!!

(http://www.ethicalhacker.net/images/stories/sponsors/rapid7/rapid7_logo.jpg) (http://www.rapid7.com/)

In this technical webinar for penetration testers originally delivered on Dec 4, 2012, David Maloney discussed how you can use Windows Remote Management and Windows Remote Shell to obtain a session on a host while avoiding detection through anti-virus solutions. Participants learned:

   • Capabilities of Windows Remote Management (WinRM) and Windows Remote Shell (WinRS)
   • Discovering hosts running these services
   • Brute forcing the services to obtain passwords
   • Running WMI Queries and running commands
   • Getting and migrating shells to a more persistent process

David Maloney, a Software Engineer on Rapid7’s Metasploit team, is responsible for development of core features for the commercial Metasploit editions. Before Rapid7 (http://www.rapid7.com), he worked as a Security Engineer and Penetration Tester at Time Warner Cable and as an Application Security Specialist for a global insurance company. David has been a long-time community contributor to the Metasploit Framework. He is one of the founders of Hackerspace Charlotte and is an avid locksport enthusiast.

Enjoy,
Don

EH-Net

EH-Net => Special Events => Topic started by: don on December 14, 2012, 11:56:34 AM