How to run powershell script on target computing due double hopping issues?

Question

I'm using powershell PS-Session to connect from kali (debian) to target system which is server A, on the server A, there is module called PowerSploit installed, and I want to run Get-DomainSID, I'm able to get the SID when I run the command locally, the scripts talks to DC which is server B (domain controller) using ldap filter.

To overcome double-hoping issues I have tested following setups, but fails to provide me desired results.

Case#1

$cred = Get-Credential hacklab.local\administrator [192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {hostname}}               HACKLAB-DC[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {Get-DomainSID}} The term 'Get-DomainSID' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. + CategoryInfo          : ObjectNotFound: (Get-DomainSID:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException + PSComputerName        : attacker-win10

Case#2

[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName hacklab-dc -ScriptBlock { Register-PSSessionConfiguration -Name Demo -RunAsCredential 'hacklab.local\administrator' -Force }
[hacklab-dc] Connecting to remote server hacklab-dc failed with the following error message : A specified logon session does not exist. It may already have been terminated. For more information, see the about_Remote_Troubleshooting 
Help topic.
    + CategoryInfo          : OpenError: (hacklab-dc:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : 1312,PSSessionStateBroken

on case#2 I get the credentials prompt where I enter the password and it works as expected in both the above cases the commands are failing over PS-SESSION.

──(asad㉿Yah-Aleemo)-[/home/asad]
└─PS> Invoke-Command -Session $offsecsession -ScriptBlock &{Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID} }                                                                   

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command
--     ----            -------------   -----         -----------     --------             -------
14     Job14           BackgroundJob   Running       True            localhost            Microsoft.PowerShell.Man…
Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID} 

PS> Invoke-Command -Session $offsecsession -ScriptBlock {Receive-job 14}
Receive-Job: The command cannot find a job with the job ID 14. Verify the value of the Id parameter and then try the command again.

Answer 1

Get-DomainSID is a function in the module PowerView. Have you installed that module on your target machine (hacklab-dc)?

Answer 2

Hi,

I'd be happy to help you out with your question. Sorry for the inconvenience caused.

In your first attempt, you tried to use nested Invoke-Command calls to connect to the target computer and then execute the script. However, it looks like the script was not recognized, as it returned an error saying "The term 'Get-DomainSID' is not recognized as the name of a cmdlet, function, script file, or operable program." This may be because the PowerSploit module is not properly installed on the target computer or it is not in the module path.

In your second attempt, you tried to register a PSSessionConfiguration with the RunAsCredential parameter to use the administrator credentials for authentication. However, this resulted in an error saying "A specified logon session does not exist. It may already have been terminated." This may be because the administrator account does not have the necessary permissions to register a session configuration or there may be issues with the remote server.

I would recommend trying a different approach to resolve the double-hopping issue. One possible solution is to use the CredSSP (Credential Security Support Provider) authentication protocol. This allows you to forward your credentials from the first hop to the second hop, enabling you to authenticate to the target computer.

You can enable CredSSP authentication by running the following command on the first hop computer:

Enable-WSManCredSSP -Role Client -DelegateComputer target_computer_name

Then, on the target computer, you need to run the following command:

Enable-WSManCredSSP -Role Server

After enabling CredSSP authentication, you can use the following command to run the script on the target computer:

Invoke-Command -ComputerName target_computer_name -Authentication Credssp -Credential $cred -ScriptBlock {Get-DomainSID}

If you have any other questions or need assistance with anything, please don't hesitate to let me know. I'm here to help.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.