All right, we're back to our lab environment.
Before we go,
I want to quickly show you a really cool feature from
Impacket that can help you to build persistence.
The idea in this demo is trying to get passwords from several accounts.
So later, if you need to access the server,
you have multiple credentials to try to log in.
The Impacket framework has a really neat script called secretsdump.
To use it, I will just execute python3 secretsdump.py and then the domain,
username, and IP of the target.
Remember, this Kenny account is an admin account on the target server,
and we are assuming here that you already compromised the machine
and that you're trying to create persistence.
Once I run this, it'll ask me the password for the counter that I'm using.
So let me type it, and that's it.
This script will run several different techniques to extract
password hashes from the target machine.
For example, it will try to extract passwords from the same files.
It will also try to do some Kerberoasting attacks and a
few other hash‑harvesting techniques.
Once the script has completed,
we are left with tons of accounts and their hashes.
All you have to do now is try to brute force those hashes
using Hashcat or any other hash‑cracking tool.
In this way, you might get the plaintext passwords for a few accounts.
So even if this Kenny account is disabled,
we'll still have a few other credentials to log into the domain.
Pretty cool, right? And the best part, this password dumping
tool was not detected by the antivirus. So we don't have to
worry about being detected.