How to run powershell script on target computing due double hopping issues?

56 Views Asked by At

I'm using powershell PS-Session to connect from kali to target system which is server A, on the server A, there is module called PowerSploit installed, and I want to run Get-DomainSID, I'm able to get the SID when I run the command locally, the scripts talks to DC which is server B using ldap filter.

To overcome double-hoping issues I have tested following setups, but fails to provide me desired results.

Case#1

$cred = Get-Credential hacklab.local\administrator
[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {hostname}}               HACKLAB-DC                                                                                                                                                                                                                                
[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {Get-DomainSID}}
The term 'Get-DomainSID' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
    + CategoryInfo          : ObjectNotFound: (Get-DomainSID:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
    + PSComputerName        : attacker-win10

Case#2

[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName hacklab-dc -ScriptBlock { Register-PSSessionConfiguration -Name Demo -RunAsCredential 'hacklab.local\administrator' -Force }
[hacklab-dc] Connecting to remote server hacklab-dc failed with the following error message : A specified logon session does not exist. It may already have been terminated. For more information, see the about_Remote_Troubleshooting 
Help topic.
    + CategoryInfo          : OpenError: (hacklab-dc:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : 1312,PSSessionStateBroken

on case#2 I get the credentials prompt where I enter the password and it works as expected in both the above cases the commands are failing over PS-SESSION.

screenshot

UPDATE @Jdweng, thanks

┌──(asad㉿Yah-Aleemo)-[/home/asad]
└─PS> Invoke-Command -Session $offsecsession -ScriptBlock &{Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID} }                                                                   

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command
--     ----            -------------   -----         -----------     --------             -------
14     Job14           BackgroundJob   Running       True            localhost            Microsoft.PowerShell.Man…
Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID} 

I guess instead of @ you want to use & also, the command works but it has opened

└─PS> Invoke-Command -Session $offsecsession -ScriptBlock {Receive-job 14}                                             
Receive-Job: The command cannot find a job with the job ID 14. Verify the value of the Id parameter and then try the command again.  

I'm unable to retrieve the output of the job

0

There are 0 best solutions below