Pass-the-Hash Attacks.
All right, so we've obtained NTLM hashes.
What can we do with them apart from cracking them,
which we will cover in another course?
But for now, what can we do as a penetration test
with these hashes?
Well, what we can do is we can perform
what is known as a pass-the-hash attack.
So what is a pass-the-hash attack?
Well, pass-the-hash is an exploitation technique
that involves capturing or harvesting
NTLM hashes or clear-text passwords
and utilizing them to authenticate
with the target legitimately via SMB.
So in order to do this, we can utilize various tools,
and of course, I'm not going to be going over
a list of all the tools you can perform a pass-the-hash attack
with, but one of the great ones is the Metasploit PsExec
module as well as Crackmapexec.
So I'll be demonstrating how we can use our hashes
or the NTLM hashes that we extracted
from the previous video in order to authenticate with the target
legitimately via SMB.
All right, so it's going to be awesome.
So this technique will essentially
allow us to obtain access to the target
system via legitimate credentials
as opposed to obtaining access via service exploitation.
So, in this case, and in--
as you will see, during the actual practical demonstration,
having a hash can be just as useful
as having a clear-text password.
And of course, a clear-text password is much more useful.
But if you have a hash, you can still
utilize that particular hash to gain access to the target
system whenever you want.
So you might be asking yourself a question.
Well, why is this important?
If I've already obtained administrative access
on a target system on a Windows target,
why would I need to authenticate again and then
gain access to the same meterpreter session
or reverse shell with administrative access?
Well, the reason for that is fairly simple.
Well, let's say the actual vulnerable service
that you have exploited in order to gain access
to the target in the first place is patched,
or that service is completely disabled,
or a firewall rule has been enabled,
therefore preventing you from connecting
to that particular port or from exploiting that service.
Well, what do you do then?
Well, if you had got the actual administrator hash,
you can use that same hash to gain access
to the target system irregardless of
whether or not the actual vulnerable service has
been patched.
And this, again, is a form of persistence
that, again, will help you maintain access to a target
system even if the original vulnerable service has been
patched or has been disabled.
All right.
So now that we know what we're going to be doing
or what the pass-the-hash attack entails let's
continue from where we left off in the previous video.
So we're going to be using the same lab environment.
It should be attached to this video.
And we're going to start off by exploiting the BadBlue service.
And then, once we've gained access,
we'll dump the hashes again with Kiwi,
and we'll then take a look at how
to use the hashes to perform a pass-the-hash attack.
All right.
So let's switch over into the lab environment,
and I'll see you there.
All right.
So I'm back within the lab environment.
And of course, you'll be provided with the target IP,
which I'm just going to copy.
And of course, in your case, it's going to be different.
So given that we know what service we're exploiting,
we can automatically just open up MSF console.
So I'm just going to open up a terminal here,
and I'll zoom in.
So we'll say service postgresql start and msfconsole.
And we can then search for the BadBlue exploit module,
and we can essentially gain access to the target system
relatively easily.
So we'll give this a couple of seconds to start up.
There we are.
So I'll search for BadBlue.
There we go, and we'll use the--
this particular exploit module right over here
as we did in the previous video.
We'll leave the default payload as
windows/meterpreter/reverse_tcp, and we can then set up
the target IP.
So I'm going to say set RHOSTS to the target IP.
And of course, you can also configure your meterpreter
payload options.
In this case, they are automatically
configured in my case.
So I'm just going to hit Exploit,
and we should obtain a meterpreter session
on a target system.
All right.
So now that I've obtained a meterpreter session,
what I can do is I can search for the LSASS process again,
so pgrep lsass.
And I can migrate to the process ID.
So 780, so migrate 780, and we should have NT AUTHORITY SYSTEM
privileges, so we can say get user ID.
There we are.
Fantastic.
So I'll now load Kiwi again, so load kiwi.
And then, we can say lsa_dump_sam
to get the administrator NTLM credentials.
So there we are.
You can see that we get the administrator NTLM hash there.
So I'm just going to copy that, and I'm
going to put it into a text file.
So I'll create a new text file there,
and I'm just going to say admin, or administrator.
Let me make sure I've got that specified correctly.
So administrator, paste in the hash there.
And we can also take in the student NTLM hash
because I'll show you that this works
irregardless of what the user NTLM hashes
you're trying to use.
So we can say student, and we can then paste that in there.
All right, and of course, you can get the same NTLM hashes
if you had used the Mimikatz executable.
So let's take a look at the first technique, which
is how to essentially perform a pass-the-hash attack
with the PsExec Metasploit module.
Now, in order to use this module,
you will require the LM hash in addition
to the NTLM or the NT hash.
And a quick way of getting that is just typing in hashdump.
So if I type in hashdump, you can
see that you'll get the actual hash specified here,
so administrator user, then the SID.
And this is the LM hash, and it's the same for every user,
as you can see here.
And then the NTLM hash or the NT hash
is going to mirror the same one here.
So you can see e3c61.
So we want to copy this particular hash here
as that particular module, or the Metasploit PsExec module
requires you to specify the LM hash in addition
to the NT hash itself.
So I'll also just copy and paste that in there,
and I'll put this meterpreter session in the background using
Control-NZ.
There we are.
And we can search for the module,
so we can just say psexec.
And the module we're looking for is this one right over here,
so exploit/windows/smb/psexec.
This is Microsoft Windows authenticated user code
execution.
Remember, that's the keyword there, "authenticated,"
in that you will need credentials
to use this particular module.
So I'll say Copy, and I'll say, use, paste that in there.
And I'll leave the default payload
as windows/meterpreter/reverse_tcp.
You can change that to the 64-bit meterpreter module
if you want.
Then I'm going to copy the target IP as I need it again.
So I'll just clear out the options here,
and I'll say show options.
And we can specify the payload options.
This is very important because our current session
is utilizing port 4.4.4.4, so we need to change the LPORT option
here.
So I'm going to say set LPORT to maybe 4.4.2.2, something
different because this is going to provide us
with another meterpreter session.
And then, of course, you can specify the target IP.
So I'll say set RHOSTS target IP right over there.
And now, you can see this particular module allows
you to set up the SMBDomain if the target
system is part of a domain.
In this case, the target system is not part of a domain.
You then have the SMBUser, which, in this case,
we will specify as administrator,
and then the SMBPass.
Here, you can specify clear-text credentials or the actual hash.
So I'll say-- we'll start off by saying set SMBUser,
and that is administrator.
And then, we can set the SMBPass as the password hash.
Of course, that is going to be both the LM and NTLM hash.
And again, this is just for this particular module
as it is quite problematic or might give you errors
if you only paste in the NT or the NTLM hash or the NT hash,
if you will.
So I'll hit Enter.
And if everything goes OK, we can hit Exploit,
and we should get a meterpreter session.
All right.
So I'll hit Enter.
All right.
So you can see right over here, it
tells us connecting to the server,
authenticating to the target as administrator,
and authentication is successful.
Is then going to say selecting the PowerShell target,
executing the payload, service start timed out, OK, et cetera.
And the reason we didn't get a meterpreter session,
as you can see here, is because we
need to configure the target.
So I'm going to say set target, and we can specify a target
based on our own requirement.
So we can also utilize a command shell if we want.
So we can say set target command and then hit Exploit again.
All right, and in this case, we still
don't get any session here.
So let's just show the options one more time.
And let's see what we can configure
to ensure that we get a meterpreter session.
So we don't need to specify anything additional here.
However, I think we need to configure the target because it
looks like using a command shell is not working.
So we can also try the native upload functionality
to upload the actual meterpreter payload.
So I'll set that, and we can hit Exploit.
All right.
So that looks like it works, as you can see right over here.
As I said, this particular module
needs a little bit of tweaking and testing.
So we authenticate as the administrator,
and you can see that it uploads the payload,
and it'll then execute it.
And we then see it says sending stage.
Service started successfully meterpreter session.
Sysinfo get user ID NT AUTHORITY SYSTEM.
And that is essentially how to perform a pass-the-hack attack.
And as you have seen, we have done this
all through the use of a hash that we
were able to extract relatively easily.
Now, you might be saying to yourself, well,
I really, really don't see the sense in this.
Well, let's try this again.
So I'm just going to exit from this session.
And if I list out my sessions, you
can see I have my initial session where I performed
the actual hash dumping from.
So I'll just kill that just to show you
that this does indeed work.
So I'll say sessions kill.
So now, I have no access on the target system.
And the only thing I have or the only information I have
is the account username, which in this case,
is the administrator account and the actual NTLM hash.
So again, I'll just hit Exploit, and you'll
see that it will work irregardless of whether or not
I had previous access, and there you go.
So this is an extremely powerful technique.
And as I said, it's a-- it really is powerful
because it provides you with an alternate method of vector
of accessing the system that doesn't rely
on a vulnerable service or the exploitation
of a vulnerable service.
All right.
So you can see that we have gained access again,
and that is how to utilize the Metasploit PsExec
module to perform a pass-the-hash attack.
Now, you can also utilize other tools like PsExec or the PsExec
Python script, or Crackmapexec.
And in this particular lab, I've had
a few issues with Crack Map, but again, it still
works just fine.
And all we need to do, again, I'll just open up a new tab,
and we can say crackmapexec.
We say we are working with smb.
We then specify the target IP address.
There we are, and that is specified.
We then specify-- sorry, let me just type that in again.
So crackmapexec smb.
And I'll just copy the target IP correctly
because the space automatically creates a new line there.
So I'll paste that in there, and we can then
specify the username, which in this case is administrator,
and the password, which, in this case,
is just going to be the hash, the NTLM hash alone.
We don't need to specify the LM hash.
We can put this in double-quotes,
and I'll just go back to my text file.
And I'll just copy the administrator NTLM hash there.
There we go.
Paste that in there, and I'll actually
close the quotation marks, and we can then hit Enter.
And yeah, so that isn't working.
And the reason that isn't working
is because I specified the password option instead
of the hash option, which is done by saying
or by specifying hyphen capital H. I can hit Enter again.
And as you can see right over here,
it authenticates with the target.
And you can see it tells us right over that system
is Pwn3d.
So we can try and execute a few commands on it.
So I'll just say -x as we did previously.
And within the quotation marks, I
can say something like "ipconfig."
Now, as I said, in this particular lab,
the Crackmapexec script has a few issues
with some Python dependencies.
So it will give me a few errors, but I'll hit Enter.
All right, so don't worry about these Python errors.
All you need to do is take a look
at the output for the command that we specified.
So you can see executed the command,
and it provides us with the output pertinent to the command
that we specified.
And in this case, we wanted to know more
about the actual network interfaces.
So you can see we get the ethernet adapter,
the IPv4 address, the subnet mask, et cetera.
And of course, you can also run other types of commands.
So I'll just terminate that again.
And I can also say, who am I?
And of course, we'll get the errors again.
There we are-- attack defense administrator.
All right, and of course, I'll just run one more command just
to show you that, indeed it does work.
So if I wanted to change the password of a particular user,
maybe I wanted to change the password.
I can say net user administrator,
and then I can specify the new password.
So I can see a password123.
That will also work, but let's try and list
out the list of users on the system.
And it says right over here it looks
like we have a system error.
So the RPC server is too busy to complete this option.
So I'll just wait for a few seconds, but you get the idea.
You can utilize various tools to perform a pass-the-hash attack.
And as I said, we are not-- we don't even have the user
accounts password.
We're just using the hash.
And as I said, the reason why I wanted to cover this
is because this is a vulnerability within Windows.
It's a vulnerability that attackers take advantage
of quite often, and you really don't
need to move to the password or hash cracking stages.
You can pretty much utilize the hash
to authenticate with the target and maintain access
to the target system.
All right.
So that is going to conclude the practical demonstration
side of this video.
All right.
So that concludes the final Windows section
of this course, where we were exploring
the process of dumping hashes and finding passwords
in configuration files.
We will now be moving on to the first Linux section,
where we will be getting an overview of Linux
vulnerabilities and frequently exploited Linux services.
And then, we'll begin taking a look
at how to exploit inherent vulnerabilities within Linux
and also take a look at privilege escalation
and dumping Linux user account password hashes.
So I'll see you in the next section.