Relay My Hash
In the previous section,
we forced the SQL service account to connect to our SMB share
and capture the Net-NTLM hash.
We were lucky that the service account used a weak password,
which allowed us to crack it.
Now we are going to discuss a technique that will yield code execution
on the operating system of the SQL server
without requiring us to crack the hash.
If we have captured the NTLM hash of a domain user
that is a local administrator on a remote machine,
we can perform a pass-the-hash attack
and gain remote code execution.
However, the Net-NTLM hash cannot be used in a pass-the-hash attack,
but we can relay it to a different computer.
If the user is a local administrator on the target,
we can obtain code execution.
It is important to note that Net-NTLM relaying against SMB
is only possible if SMB signing is not enabled.
SMB signing is only enabled by default on domain controllers.
In our enumeration exercise, we found that the service account
used with the SQL server is used on both dc01
and appsrv01 and that it’s a local administrator on both systems.
This means we can relay the Net-NTLM hash from dc01 to appsrv01.
We'll use the Impacket ntlmrelayx tool for this attack.
This tool forces the same type of NTLM authentication as Responder,
but relays the authentication to a different host
and allows us to execute arbitrary commands against it.
We will use the python3-impacket package in Kali
to install Impacket.
We are going to use our previously-developed PowerShell runner
to execute a Meterpreter staged payload.
We’ll generate a payload that connects back on TCP port 443.
Next, we’ll embed the payload in our shellcode runner.
We'll host runner with Apache on TCP port 80.
When we invoke ntlmrelayx,
we must supply the PowerShell download cradle on the command line.
Because of the syntax, it is a good idea to base64 encode it.
Let's install PowerShell on Kali.
Next, we'll start PowerShell with the pwsh command,
and base64 encode the download cradle.
We must also start a Metasploit multi/handler
to catch the reverse Meterpreter shell on our Kali machine.
Once all of these pieces have been prepared, we can initiate the attack.
We launch impacket-ntlmrelayx
and prevent it from setting up an HTTP web server
with the –nohttp-server flag.
ntlmrelayx uses SMB version 1 by default,
which is disabled on Windows Server 2019,
so we must specify the -smb2support flag
to force authentication as SMB version 2.
Next, we supply the IP address of appsrv01 with the -t option,
and the command to execute with -c.
Finally, we re-execute the C# console application
on the Windows 10 client machine
to force the SMB request from the SQL server.
This results in NTLM authentication against our Kali machine
and relaying of the Net-NTLM hash.
From the output, we notice that ntlmrelayx succeeded.
If we switch to Metasploit,
we notice that our listener has caught a reverse Meterpreter shell from appsrv01.
We have managed to get a shell on appsrv01
in the context of the SQL server service account
without cracking the password.
We were able to accomplish this
despite of our low privileged access to the database.
Excellent!
In this section, we have covered an attack
that takes advantage of shared accounts
and allows us to compromise a number of servers
on an internal network.
In the next section,
we'll escalate privileges within the SQL server application.