Gray Hat Hacking The Ethical Hacker's Handbook, Fifth Edition, 5th Edition

CHAPTER 10

Getting Shells Without Exploits

One of the key tenets in penetration testing is stealth. The sooner we are seen on the network, the faster the responders can stop us from progressing. As a result, using tools that seem natural on the network and using utilities that do not generate any noticeable impact for users is one of the ways we can stay under the radar. In this chapter we are going to look at some ways to gain access and move laterally through an environment while using tools that are native on the target systems.

In this chapter, we discuss the following topics:

•   Capturing password hashes

•   Using Winexe

•   Using WMI

•   Taking advantage of WinRM

Capturing Password Hashes

When we look at ways to gain access to systems ...