Going beyond impacket-psexec: the AV bypass

Aurelien Chalot has recently written this awesome blog on this new tool he wrote; PsExecSvc.py (github link). There was only one part missing; an actual demonstration of where the tool works over impacket-psexec. As of releasing this blog, the tool is just 3 days old.

The point of the tool is to offer the same (and more) functionality as the impacket-psexec tool, but it also bypasses the Windows Defender (and basically any other antivirus), by making use of Microsoft signed binaries.

The impacket-psexec tool is a variation of the SysInternals psexec tool, which is used for remote administration. It allows anyone to run commands over a smb-enabled machine with administrator privileges, even if SSH, winRM, and DCOM are disabled, as it communicates with the Service Control manager instead. The problem is that the impacket deploys the open-source RemCom service on the remote system, which is flagged by Defender. PsExecSvc.py instead deploys the official PsExecSvc.exe binary, which is a part of Sysinternals and signed by Microsoft.

Setting up the lab

Important: this is a VERY VULNERABLE lab setup, do not try this on any important systems.

Initialization

First, download a Tiny10 VM.

After this has finished, open Oracle Virtualbox go through the regular Windows setup process.

The networking

On the Virtualbox end:

First, we create a new NAT network by going to "Network" -> "NAT Networks" -> "Create".

Then, we will add it as the second IP to our virtual machines:

Configuring connectivity

On the Windows end:

In the Control Panel, we go to Network and Internet -> Network and Sharing Center -> click on Ethernet 2 -> Properties.

Then, click "Internet Protocol Version 4" -> Properties -> Set a static IP address (in our example, 192.168.56.20) -> OK.

On the Linux end:

sudo ip addr add 192.168.56.10/24 dev eth1
sudo ip link set eth1 up

The commands

First, we enable the Administrator user:

net user Administrator /active:yes 
net user Administrator Password123

Then, we disable the firewall:

netsh advfirewall set allprofiles state off

In a real scenario, the firewall will not be fully off, but it makes it easier to debug in our lab.

Enabling remote management / SMB:

sc config LanmanServer start= auto
sc start LanmanServer
sc config RemoteRegistry start= auto
sc start RemoteRegistry
sc start RpcSs

That should be all. Now onto our testing:

Testing

pinging:

If the pinging doesn't work, make sure the firewall of the Windows machine is disabled, and the IP address of the Windows machine is routed to the eth1 device. The Windows VM may need a reboot.

SMB connection:

The exploitation

On to the fun part :)

When we attempt to use impacket-psexec, it gets caught by the antivirus, and will not run any commands:

But running psexecsvc.py works flawlessly!