I'm using powershell PS-Session to connect from kali to target system which is server A, on the server A, there is module called PowerSploit installed, and I want to run Get-DomainSID, I'm able to get the SID when I run the command locally, the scripts talks to DC which is server B using ldap filter.
To overcome double-hoping issues I have tested following setups, but fails to provide me desired results.
Case#1
$cred = Get-Credential hacklab.local\administrator
[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {hostname}} HACKLAB-DC
[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName attacker-win10 -Credential $cred -ScriptBlock { Invoke-Command -ComputerName hacklab-dc -Credential $Using:cred -ScriptBlock {Get-DomainSID}}
The term 'Get-DomainSID' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
+ CategoryInfo : ObjectNotFound: (Get-DomainSID:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
+ PSComputerName : attacker-win10
Case#2
[192.168.0.102]: PS C:\Users\administrator\Documents> Invoke-Command -ComputerName hacklab-dc -ScriptBlock { Register-PSSessionConfiguration -Name Demo -RunAsCredential 'hacklab.local\administrator' -Force }
[hacklab-dc] Connecting to remote server hacklab-dc failed with the following error message : A specified logon session does not exist. It may already have been terminated. For more information, see the about_Remote_Troubleshooting
Help topic.
+ CategoryInfo : OpenError: (hacklab-dc:String) [], PSRemotingTransportException
+ FullyQualifiedErrorId : 1312,PSSessionStateBroken
on case#2 I get the credentials prompt where I enter the password and it works as expected in both the above cases the commands are failing over PS-SESSION.
UPDATE @Jdweng, thanks
┌──(asad㉿Yah-Aleemo)-[/home/asad]
└─PS> Invoke-Command -Session $offsecsession -ScriptBlock &{Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID} }
Id Name PSJobTypeName State HasMoreData Location Command
-- ---- ------------- ----- ----------- -------- -------
14 Job14 BackgroundJob Running True localhost Microsoft.PowerShell.Man…
Invoke-Command -ComputerName hacklab-dc -Credential hacklab.local\administrator -ScriptBlock &{Get-DomainSID}
I guess instead of @ you want to use & also, the command works but it has opened
└─PS> Invoke-Command -Session $offsecsession -ScriptBlock {Receive-job 14}
Receive-Job: The command cannot find a job with the job ID 14. Verify the value of the Id parameter and then try the command again.
I'm unable to retrieve the output of the job
