Welcome to experience Tech.

My name is beneath in today's video.

I'll show you how to use process, execute script off PS, exact and Lennox.

Now, for those of you do not know PS exact is a very powerful remote Windows administration tool.

It was available for Windows as a part off PS, so sweet and developed by isis internals, it allows you to remotely manage other Windows machine.

But today, in this video will be using P s exact for Lennox.

And we'll see how to get a remote shell.

A remote command shell from a target from those machine B s exact for Lennox.

As developed by core lab security.

P s exactly the part off the impact package off tools it has.

Ah, many other very powerful Windows administration tools like W my exact double mike.

Ready and lot, many of us.

But today in this video, we're going to see howto use B s exact in Lennox and get a remote command shell from a hunger to windows machine.

All right, so with that said, let's begin today's video.

Not the first step is the installation off this package.

Now go to court lamps and darko security dot com The link off the science is, ah, available in the description of this video.

Once you go to this website, scroll down and look for the Jersey PD eyeball.

Now, here is the installation file.

Click on the link and downloaded into your machine.

I'm using Carly Lennox.

Um, but the installation process is same for any version off Lennox.

So once you download this particular file, open this file No.

For a complete guide on howto open Hey, park I file or town files, you can check out my previous video.

The link off the video will also be available in the description below.

Once you open that top ball, you'll find a setup.

Got by file inside that now, The next step is to run this particular command that despite on set up by space installed, run this command and that will install impact toolkit on your machine.

No, that was installation process.

No, let's quickly check out this intact off using P s Exactly.

No, the syntax goes like this.

You type in python.

Since it's a python script, give us space and type in peace exact dot by the next step that you need is you need to use the name for the remote windows machine.

Use the name as well as a password.

So type in the user name, give a colon and type in the password and the ad rates symbol and then type in the i p address off the remote of in those machines.

No, if you do not have to username and password and ah, the elementary hash will also work.

That is the different method off authentication that can be used with P s exact.

Um so these are the two options.

One bit of caution.

It does not work for intel inversion toe.

Now the next step is you type in the program that you want to run.

For example, if you want remote command shell, you can type in CMG dor t x c No, there are several options.

Dash part option by typing dash, but you need to give the part off the program on the remote computer.

For example, if the program that you're typing is command, the part will be Seve window C, colon slash slash windows and under windows you have system toe to toe directory and understood.

System 32 you find Commander T X C Right.

That is the actual part of Commander T X C file.

So that is the program path that you need to give.

No.

The other option is you can give dash file and then give the file name.

Uh, this is 40 for running off file from local computer to a remote computer.

For example, if you have created a matter better bag, go on.

You're the next machine, and you want to run that on the target machine, you can give dash file and then the file name that will run the MSF payload on the remote computer dash.

C option is usually used in windows.

After Nancy, you give the program name.

This will run the particular binary on the remote windows computer.

Now, for example, if I have cmd Dottie XY available on the Lenox machine, then you give dashi and type in command or e x E.

That will execute Commander T X C from my Lennox machine.

Do the windows machine.

All right.

The alternate very off authentication, as I've already told, is by providing a lemon tea hash, this index is instead off user name Colon Password.

A talented I P.

What you have to do is you type and using them at the rate target.

I'd be address.

Ah, and then type in dash hashes and then give you lm hash and auntie has separated by a colon.

Alright, that is the alternate authentication method that can be used with P s exact dot point.

All right, enough about detour off using P s exact.

Now let's do a live demo.

So I have all already installed the package into my machine.

So I'll go to the impact folder and under impact.

You have folders like example and impact No p s exact by deformities of a level under examples directory Select me Syrian, Two examples And here you can CPS exact or piety our python script.

Now, to use this new type in pi tone and give a space type in B s exact don't buy and I also have a windows machine.

Let me quickly log into my windows machine.

Let me show you the i P address off my windows machine.

The I P addresses 192.168 dot 0.101 all right.

Let us go back to over Colleen Lennox machine.

Now they use a name for that machine is V I n I t v need and give a colon and then type in the password.

That's demo.

1234 And then give the i P address off the windows machine.

Your target from those machine.

That's 192.168 0.0 dot 101 No, After that, I need to to get a command shell.

Um, I need to run.

See, MD dot e x e.

And the next is to provide the part off this particular command on the remote system.

So that would be under C windows system.

So to do.

All right, so let me press enter.

As you can see, we have got to remote command shell from over target windows machine.

So let me show you the i P address.

It is 101 and let me go to the root directory.

And as you can see, the files that are available here, I'll show you on the windows computer.

So, as you can see, we have all those files listed in the CIA Director.

No, As you can see, you can pretty much run every command that you ah can drain from a local windows machine on this lean next machine.

So if I want to create a text trail, I can and quickly, Creator, As you conceive indoor T X t is now available.

If I go here, you'll see wind or t x you text available here so you can see how powerful it can get.

You can create file.

You can list the text off the file onto yearly next machine.

So you can pretty much do everything from this command ship.

So this is the Syntax Noah idea that is to use dash season.

Dex, let me show you.

I have a cm do Dottie XY Ah windows.

Ah executable available in my examples rectory that I have copied from the Windows machine.

No, to execute cmd dirty except on my Lennox machine.

I need to take the dash c option so type in python ps exact your user name off remote windows Computer de boss sword The target I P address and then type in Dash C and CMG Don't e x e.

No one's impressed Endo.

No, As you can see we have Gandhi remote command shell on door.

The next machine the I P addresses ones don't No, They may be chances that for some off you this particular script may not work.

No, there could be two reasons.

Printer and file sharing is not enabled on the windows machine.

So kindly do that and allow it on the fire ball even after Eve enabling.

If it is not working, then you need to goto the registry editor by typing in Ridge Edit.

Go to the registry editor.

Goto this particular part each key local machine's software Microsoft Windows current version, policies and system.

Once you go there, you need to create a lot d would by right clicking new D word touched a bit and give the name, local account toe conflict a policy and then type in the value director as one in click.

Okay, Now, once you do that, I'm very sure that your species exist.

Script will start working.

All right, so that is it for today.

Thank you guys for watching this video.

If you like this video kindly.

President Like Britain.

If you have any comment insulation kindly type that in in the comment box.