Let's imagine the following (not uncommon) scenario:
- I'm doing a pentest from the outside
- I have a meterpreter session from a company PC that´s within their infrastructure (Let´s say w/ reverse HTTPS)
- Let`s say I know the domain admin pwd [just for the sake of brevity!]
- I want to get into the DC
- The DC can't connect to the internet
How would you go about this?
First challenge is to get meterpreter on the DC without getting caught. My instinct would be to create an executable, sign it, and then be really oldschool: do a "net use \DC\c$ ..." on the machine in the middle and copy it over. Then remotely schedule a task with "at". Is there a more metasploity way to do that? Do the psexec_* modules even work through a windows meterpreter?
Second challenge is: How would the meterpreter on the DC connect back? I could not get the named pipe feature of meterpreter to work reliably. MSF acknowledges receiving a session, then the meterpreter process on the machine in the middle crashes. Ooops. [Edit: It only crashes when the middle machine is using reverse_HTTPS. It works with reverse_tcp, with the odd hang that leaves the process lingering. I filed a bug report. Currently not convinced this is ready for production]
Port forwarding? Middle machine port forwards out and the DC connects through the middle machine to me? HTTPS? Is opening new ports on computers ok in 2018?
What's the way for this scenario that both works and doesn't totally trigger all alarms?