[AUDIO LOGO]
Exploiting SMB with PsExec.
Now that we've taken a look at how
to exploit WebDAV running on a Microsoft IIS web server,
we can begin exploring the other frequently exploited services
that we had explored previously.
And the next one, in this case, is going to be SMB.
So to start off, we are going to be
taking a look at how we can exploit SMB
through the use of a utility called PsExec.
However, before we get started with the practical aspect
of this video, let's get an understanding
of what SMB is and how it works in terms of authentication
as well as what PsExec is and how we can use it
to gain access to a target system.
So starting off with SMB, SMB stands for the Server Message
Block, and it is a network file sharing protocol
that is used to facilitate the sharing of files
and peripherals like printers and serial ports
between computers on a local network also known as a LAN.
Now, SMB utilizes port 445 on TCP.
However, originally, SMB ran on top of NetBIOS using port 139.
So if you've ever worked within a Windows environment
or if you own a Windows system, you'll know what SMB is.
In the standard context, SMB is frequently
used to share printers or, in certain scenarios,
you set up a file share or a folder share
where other computers on that particular local area network
can access that share.
And in order to access it, you can disable authentication.
However, in most cases, authentication is enabled.
And if enabled, a user would typically
have to provide a username and password that
is on the SMB server in order to authenticate.
If it's a standard file share or just
a standard share with a restricted password,
then a user or a client would essentially
have to provide a password in order to gain access
to that particular share.
Now, there's one key thing that you
need to note and take or pay close attention to,
and that is SAMBA.
So when working within different environments,
you may come across another service or protocol running
on port 445, called SAMBA.
SAMBA is the open source Linux implementation of SMB
and is used to allow Windows systems to access Linux shares
and devices.
So again, it's very important to know
that SMB is the protocol on Windows
and SAMBA is the open source implementation
of SMB for Linux systems.
So that's something that you need to pay close attention to.
And of course, we'll be taking a look
at how we can exploit SAMBA in the Linux exploitation section.
For now, we are going to be dealing exclusively with SMB.
So now that we have an idea of what SMB is
and what it can be used for, let's
go back to SMB authentication.
So the SMB protocol utilizes two levels
of authentication, namely, user authentication and share
authentication.
In the case of user authentication,
users must provide a username and password
in order to authenticate with the SMB server in order
to access a share.
In the case of share authentication,
users must provide a password in order
to access a restricted share.
It's important to note that both of these authentication levels
or types utilize a challenge response authentication system.
And I'll explain this in a few seconds.
So if we take a look at this diagram here,
we can see that we have a client that's,
again, trying to connect to a Windows system that has SMB
set up.
And it does not necessarily have to be the case that they
want to access a share.
In the case of exploitation, any system
running SMB or any Windows system
running SMB for that matter can actually be authenticated with.
Now, in order to authenticate with an SMB server,
you need to provide the user account credentials, really,
any user account credentials that
are on that Windows system.
So again, that's something that you
need to be very cognizant of.
So if I want to connect to a Windows system that has SMB
set up, I would essentially send an authentication request
with the username that I want to authenticate as the server that
will essentially return a response telling the client
to encrypt a random string with the user's hash.
And they're referring to the actual user
that we want to authenticate with.
So the client will then encrypt the string with the user's hash
and will then send a response.
And the response is going to include the encrypted string.
The server will then check and see whether the actual--
whether the actual encrypted string value that they have,
that they obtained from the user's hash on that system
is correct or matches the encrypted string
that's been sent by the client.
If it does match, access granted.
If it doesn't match, then access is denied.
So that is, really at a very basic level, how--
or really the process of SMB authentication.
So again, we're not getting into the nitty gritty of how
the protocol works, but it's very important
that you understand how authentication is performed.
Now, what is PsExec?
PsExec is a lightweight telnet replacement
that was developed by Microsoft, and allows
you to execute processes on remote Windows systems using
any user's credentials.
And PsExec authentication is performed via SMB.
So we can utilize the PsExec utility
to authenticate with the target system
legitimately and run arbitrary commands on the Windows system
or launch a remote command prompt,
which we'll be exploring.
And the key thing that you need to be aware of here
is that it's very similar to RDP,
however, instead of controlling the remote system
via graphical user interface, PsExec
essentially allows you to send commands via CMD
or send singular commands that are executed,
after which the output is then provided to us.
Or you can launch a CMD session and obtain a command prompt
on the target system remotely.
In order to utilize PsExec, you need
to provide legitimate credentials, as I've mentioned.
And before we actually start using PsExec,
we need to obtain this credential.
So in order to utilize PsExec to gain access to a Windows
target, we will need to identify legitimate user accounts
and their perspective--
their respective passwords or password hashes.
This can be done by leveraging various tools and techniques.
However, the most common technique
will involve performing an SMB login brute force attack.
So that's right.
You might be wondering to yourself,
could we ever brute force SMB?
Indeed, you can.
So if we are trying to perform user authentication with SMB,
we can utilize the protocol to perform a brute force attack.
And we can narrow down our brute force attack
to only include common Windows user accounts
like the administrator account.
And that's very important because a Windows account
can have multiple accounts configured
with different names.
But the only constant on a Windows system
is the administrator account because every Windows operating
system has an administrator account,
and this administrator grant is the first account
that is created.
So we can narrow down our brute force attack
to only target the administrator username, after which we
can perform a brute force with a password list,
and hopefully, identify credentials that we can then
use with PsExec.
So after we've obtained a legitimate user
account and password, we can use the credentials
to authenticate with the target system via PsExec,
and execute arbitrary system commands,
or obtain a reverse shell or an Meterpreter session
for that matter.
And of course, this is what we're
going to be exploring within the practical section.
So start up your lab environment,
as will I. And we can get started
with the practical demonstration.
And I'll see you within the lab environment.
All right, so I'm in the lab environment.
And you will be provided with the target IP address.
In your case, it's going to be different.
So I'm just going to copy this here.
And the first step in the exploitation process
will essentially involve identifying open ports
and services with Nmap.
So I'll just open up a terminal and I'll Zoom in here.
And we can perform an Nmap scan on the target
by saying Nmap sV so to perform service version detection.
We can also run the default Nmap scripts
through the use of the sC command.
And then we can paste in the target IP address here.
So I'm going to hit Enter.
And I'm going to give this a couple of seconds
to a couple of minutes.
All right, the Nmap scan is complete.
And as you can see here we have SMB running on port 445.
And again, as for the host script results,
we can see that it is running SMB version 2.
And message signing is enabled but not required.
So that means that we can authenticate
with this system via PsExec.
So the next step, of course will involve a performing the SMB
brute force.
And this can be automated through the use of a Metasploit
module, which I'm going to show you right now.
So to start up Metasploit, we're going to say service
postgresql start.
And we can then launch MSF console.
And the reason I'm starting postgresql
is because the Metasploit framework console
utilizes a database that is configured
to run with postgresql.
So we'll hit Enter.
That's going to start postgresql.
And it's then going to start up MSF console.
So we'll give this a couple of seconds to start up.
All right, so MSF console is started up,
and we can now search for the module that we're looking for.
So I'm going to say search.
And we are looking for SMB underscore login.
There we are, and that's the module there.
This is an auxiliary module, which
means it's pretty much used for information gathering
or for brute forcing.
So we'll copy that, and we can then
say use, paste that in there.
We can then show the options for this module.
And we have quite a few options.
The ones that we are going to be essentially
setting or configuring is going to be the RHOSTS option, which
is the target IP.
The RPORT option has been configured correctly,
which is port 445.
That is indeed the port that SMB is running on on the target.
You can also specify the SMB domain
if the target system is part of a domain.
So that's very important.
In this case, the target system is not part of any domain.
And then you can specify the SMB password or the SMB user
in order to verify authentication.
But in this, case because we are performing a brute force
attack, we need to specify the user file, which
is a file that contains a list of usernames
that we want to brute force or perform the brute force with.
And we also need to provide the password file right
over here which contains a list of passwords
that we want to perform the brute force with.
So again, as I said, we can narrow down
the actual brute force by specifying the username.
So for example, we can specify the actual username alone
and say that we only want to brute force
the passwords for one user account.
However, in this case, I want to show you something interesting.
So the first option we'll set is the user file option.
So user file.
And the word list that we'll be using
is on the user share Metasploit framework.
And we are going to be utilizing the word lists on the data,
so data word lists.
And we are looking for common underscore users dot txt.
So I'll hit Enter.
We then want to set up the password file, which again,
contains the passes that we want to perform
the brute force with.
And that is on the user share Metasploit framework data word
lists.
And in this case, we will use Unix underscore passwords.
Now, as I said, this is for the purpose of demonstration.
In your case, you may want to utilize
another word list or another collection of word lists.
And of course, you have the ability
to create your own word lists based
on some of the individuals working on these computers
or identifying common usernames that you can
perform the brute force with.
However, the success of this attack
will depend on the password list that you
choose to use because the password list that you choose
to use will essentially determine
your chances of success.
So we'll enter.
And now that is set, we can then set up
the target IP, which is done by saying set our hosts.
And I'll just copy the target IP here.
There we go, copy.
And we'll paste it in here.
And we can then hit Run.
However, there are a few options that we can also configure here
to limit the output of this particular module.
And in this case, the option that we are going to change--
and if I can just Zoom out a little bit here--
there we go, we should get that data displayed correctly.
The option that we can change here is the verbose option.
The verbose option will essentially
determine whether or not to print out the output for all
attempts.
In our case, we want to only display
the successful authentication attempts.
Therefore, display the actual credentials
that have successfully been able to authenticate
with SMB on the target system.
So we will set the verbose option to false,
and we can then hit Run.
So what I'm going to do is I'm just
going to Zoom in a little bit here and I'm going to hit Run.
And we'll give this a couple of seconds to a couple of minutes.
And of course, already, we have been
able to identify an account called sysadmin on the target,
and the password is samantha.
So again, I'm just going to wait for this to complete.
All right, so the brute force is complete.
That took a few minutes, so don't worry
if it takes time on yours.
And you can see we've identified about four user accounts
with their passwords.
And the one that we're interested in particular
here is the administrator account.
So on our first try, we've been able to identify
the administrator password, which in this case
is qwertyuiop, which is a very simple password.
But again, this was set up for the purpose
of demonstrating this attack.
So we can utilize these credentials
in order to authenticate with the target system via PsExec.
So let's open up a new tab here.
And again, the PsExec utility is a Windows utility
or a portable executable.
However, we can't execute executables on a Linux system.
Of course, we can do this through the use of Wine.
However, there is a really nifty tool or Python script rather
called exactly psexec.py.
And if I can just find it here-- there we are.
So psexec.py, that is essentially
a Python implementation of the PsExec exec utility,
and essentially allows us to authenticate with a target
system, and it's really very simple.
So what we can do is, we can say psexec.py administrator.
So we provide the username.
We then need to provide the target IP.
So I'm just going to copy that there.
And we're going to say administrator@ the target IP.
We can then provide the actual executable
or command that we would like to execute.
In this case, we want to obtain a command
prompt or a command shell session on the target system.
So we will say cmd.exe.
So we're essentially executing cmd.exe.
I'm going to hit Enter.
It's then going to ask you for the password for that user.
In this case, we know what the password is.
So we'll say qwertyuiop.
And I'll hit Enter.
And you can see that it tells us status logon
failure, the attempted log on is invalid.
Let's see if I have everything set up correctly.
So we have psexec.py.
So I'm just going to type in the password again.
So qwertyuiop.
There we are.
And you can see it's going to request shares.
It's going to find a writable share admin.
It's then going to upload an exe file, open the service manager,
and create a new service.
And we are now working within that service.
So we get a command prompt session on the target system.
So I can say who am I, like so.
Nt authority system, so we have the highest privileges.
So again, in most cases, you will always
want to target the administrator account because that gives you
the most access.
Now of course, we were able to identify other user accounts
like auditor, demo, and sysadmin, which again, will all
give you a certain level of access.
However, that access will be unprivileged.
And in this case, we've been able to gain access
to the administrator account.
So this is great.
And we can utilize this particular command prompt
session to do anything we want.
And the great thing about this technique
is, we're not launching any exploit on the target system.
We're utilizing Windows tools, and utilities, and protocols,
in order to perform legitimate authentication
because we are authenticating with the actual credentials.
And that means that we're not running any exploits
or uploading any malicious files to the target system that
could be detected.
So this is a very, very effective exploitation
technique.
And of course, if we want to extend this attack
to essentially provide us with a Meterpreter session,
we can utilize a Metasploit module right over here.
I'm just going to open up that tab,
and we can search for it here.
So I'm just going to say search PsExec.
And this is a PsExec module that works essentially on SMB,
or utilizes SMB.
And what this module will do is it will essentially
authenticate to the target system via SMB through PsExec.
It will then upload a Meterpreter payload
and execute it, and then provide us with a Meterpreter session.
So again, you want to be cognizant of the fact
that this is indeed running a malicious file on the target.
And you have to be cognizant of antivirus solutions installed
on the target that could detect this.
So be very careful with what modules you use.
As I said, if you're utilizing PsExec,
then it's perfectly fine because you're
utilizing the credentials, and we haven't uploaded anything
yet.
So I can say use.
I'll just copy the module name and say use.
There we go.
And it's going to set the default payload to Windows
Meterpreter reverse tcp.
So this is a 32-bit payload, which in this case, is fine.
And we can then say show options.
And there are a few options that we
need to configure like the target IP.
The target port is set up correctly.
So I'm just going to copy the target IP here.
I'm going to say set RHOSTS to the target IP.
And we then need to set up the SMB password
and username that we, of course, obtained.
So we can say set SMB user.
And this is administrator.
And we can then say set SMB pass to qwertyuiop.
And we can then hit Exploit and Run.
However, before we do that, you also
have the ability to configure the payload options here.
So I would recommend setting up the LHOST option, which
is your Kali Linux IP.
So that's already set for me, and the LPORT option,
which in this case, the default is 4444.
So we'll use the default options here.
And then we can it Exploit.
It's going to hit Enter.
I'm just going to Enter.
And you can see it's going to connect to the server.
It's then going to authenticate to the server as administrator.
It will then select it the partial target
and execute the payload.
And as you can see, we get a Meterpreter session right
over here.
And of course, this particular attack or exploitation
technique is utilizing legitimate credentials.
So the only malicious aspect of this particular model
is the fact that it uploads a malicious payload.
So we can say sysinfo.
And you can see this-- the target is
running Windows Server 2016 and it is a 64-bit operating
system.
And then, of course, we can say who am I,
and/or rather get user ID because we're
working within Meterpreter.
And you can see these our privilege--
these are our privileges nt authority system, which
is the highest privilege level available on a Windows system.
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of exploiting an inherent vulnerability
within SMB.
Some of you may have heard of it.
It's called the EternalBlue exploit.
This is a remote code execution vulnerability
or exploit that we can use to exploit SMB
running on a Windows system.
And of course, this particular attack
will not involve the use of legitimate credentials.
Instead, as I said, it--
we can essentially perform the exploit or attack
through Metasploit.
And we can also explore the various scripts
or exploit code that can be used to exploit this vulnerability.
So I'll see you in the next video.