Remote Deployment via PSExec

Introduction

The tool PsExec is a component of Microsoft's Sysinternals tool suite. It is freely downloadable and provides several administrative tools for diagnostics and operations, making it very practical in a Windows environment. 

Without installation, you can download the executables either all at once in a complete archive or individually for specific desired products.

PsExec allows us to use administrative access on a Windows PC to request command execution on a remote machine. 

Below is an example where, from the Domain Controller, we instruct a machine named 'AdminVenteW11' to execute the command ipconfig /all.

As you can see, we get the execution result from that machine.

Prerequisites

Using PsExec requires an administrative account with rights on the target machines. Theoretically, the command can be run from any authenticated machine with a domain account. However, this requires authorization settings that aren't necessarily enabled (and for good reason) on client infrastructures.

The recommendation is to execute this command directly from the Domain Controller (no need to specify admin credentials).

Consequently, you need to prepare:

• An Active Directory domain controller
• A domain administrator account
• Physical or TSE (Terminal Services) access
• Downloaded the SysInternals suite or just PSexec64.

Procedure

• In the Nucleon console, retrieve the installation command
  • Endpoint
  • New Endpoint
  • Copy the command

• Copy and paste the command into Notepad (for convenience)
• Launch PowerShell
• Navigate to the directory containing the PsExec executable
• Enter the full command
• .\PsExec64.exe \\TARGET msiexec /i https://cloud.nucleon-security.com/endpoints/[INSTANCEID]/[KEYID]/latest/x64/Windows SERVERS=cloud.nucleon-security.com:443 SSLCHECK=1 KEY=[KEYID] /norestart

• Verify in the console that the endpoint has successfully connected

Nucleon has been successfully installed.