Getting Shells Without Exploits

In this chapter, we cover the following topics:

•   Capturing password hashes

•   Using Winexe

•   Using WMI

•   Taking advantage of WinRM

One of the key tenets in penetration testing is stealth. The sooner we are seen on the network, the faster the responders can stop us from progressing. As a result, using tools that seem natural on the network and using utilities that do not generate any noticeable impact for users is one of the ways we can stay under the radar. In this chapter we are going to look at some ways to gain access and move laterally through an environment while using tools that are native on the target systems.

Capturing Password Hashes

When we look at ways to gain access to systems ...

Get Gray Hat Hacking: The Ethical Hacker's Handbook, Sixth Edition, 6th Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.