center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
https://ctid.io/adversary-emulation
Apache License 2.0
1.6k stars 292 forks source link

PSExec from Bannik to Khabibulin Does not work #161

Open scottbrumley opened 1 month ago

scottbrumley commented 1 month ago

Maybe I'm just missing something here, but when I run the Turla Carbon attack. Once I get to the pash-the-hash the pxexec integrated into mimikatz does not work. I tried just psexec with the -c option and it hangs. If I use -i then it works on a batch file. I've looked at permissions and adalwolfa is an admin on the khabibulin machine. In the windows event I get the 4625 error. Any help would be appreciated. I need to get through the exfil part of the exercise for a project I'm working on.