[MUSIC PLAYING]
Pass-The-Hash with PsExec-- in this video,
we will be taking a look at how to utilize the NTLM
hashes that we were able to identify in the previous video
and utilize them with the PsExec Metasploit module
to authenticate legitimately with the target system.
So the reason this technique is so important
is primarily because once you've obtained the credentials
or hashes from a target system, you
can utilize those credentials to authenticate with the target
or to essentially establish a meterpreter
decision on the target through the use of these credentials.
So you can utilize them to authenticate legitimately
with the target system, consequently negating
or eliminating the need to actually go
through the exploitation process again in order to gain access.
In the next video, we'll take a look
at how to establish persistence, which
will ensure that we always get a session
irregardless of whether the system is shut down
or whether certain aspects of the system
have been changed or misconfigured.
So when we're talking about a pass-the-hash attack,
a pass-the-hash attack is essentially
an exploitation technique that involves
capturing or harvesting NTLM hashes or clear text passwords
and then utilizing these credentials or hashes
to authenticate with the target legitimately.
So we can utilize the PsExec exact module
to legitimately authenticate with the target system via SMB.
This technique will allow us to obtain access
to the target system via legitimate credentials
as opposed to obtaining access via service exploitation.
So once you get the actual NTLM hashes on a system,
you pretty much do not need to exploit the system
or exploit a vulnerable service on the target to gain access.
You can utilize the credentials that you've been able to dump,
and you don't need to go through the exploitation process again.
All right, so we are going to be utilizing the lab environment
we used in the previous video.
So we'll sort of be continuing from where we left off
and taking a look at how to utilize
the dumped hashes to essentially authenticate legitimately
with the target system by leveraging
the PsExec exact module.
All right, so I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And as we explored within the previous video,
you have the ability to access the target system here.
And again, that can be very helpful
if you want to restart the actual vulnerable service
that's running on the target.
In this case, we're just going to copy the target IP address
and start up msfconsole.
However, before we do that, we, of course,
want to start up the PostgreSQL database service.
And we can then also launch msfconsole while we're at it.
All right, so we'll just wait for that to start up.
All right, I'm going to create a workspace.
And we will just call it psexec, right?
And we will set up the global variable for the RHOSTS option.
And that will be the target IP.
That will save us from having to type in the target IP
whenever we load a module.
What we can do now is because we already
know what service is vulnerable on the target system,
we can directly search for the actual exploit module.
And in this case, we're looking for the badblue exploit module
right over here.
That's the buffer overflow exploit module.
So we're going to say use.
Paste it in there.
And we can then show the options here.
And we have pretty much all the options set apart
from the actual target.
So I'm going to set the target.
As we are going to say, this is badblue Enterprise Edition 2.7
universal and then hit Exploit.
There we are.
We get a meterpreter session on the target system.
Fantastic-- OK, so if we get our current privileges here,
you can see that we have administrator access.
And if we list out the sysinfo, or System Information,
we can see that we have a 32-bit meterpreter payload.
So we can locate the LSASS process or lsass.exe.
So we say pgrep and then LSASS.
And we can migrate into that particular process.
So we are going to say Migrate 788.
All right, we can now get our privileges or list
out the current access that we have.
And we have a NT AUTHORITY/SYSTEM privileges.
So what we can do now is use the hashdump command
or utilize the Mimikatz or Kiwi module.
In this case, I'll just use the hashdump command as it actually
prints it out rather quickly.
So we have all of these hashes here.
So what I'm going to do is I'm just
going to copy these hashes.
And we are going to save them within a file.
So let me open up this text editor here.
And I'm going to paste them in there because we'll
need them in a second.
And let me just make sure that that's formatted correctly.
There we are.
OK, so we can pretty much obtain a meterpreter session
on the target through the use of these hashes alone.
So we actually do not need to exploit any service.
So I'll give you an example of this.
So let's say we exit from our meterpreter session.
And as you can see, we don't have any more meterpreter
sessions.
What we can do is search for a module called PsExec.
And this is an exploit module.
This is the one here.
So exploit/Windows/SMB/psexec, this is the Microsoft Windows
authenticated user code execution.
So it actually requires authentication.
So we can utilize the hashes that we have.
So I'm going to say use.
Paste that in there.
It's going to set the default payload to Windows
32-bit meterpreter payload.
So we'll change that to Windows x64 meterpreter reverse TCP,
right?
And the reason we are doing that is primarily
because the target system is a 64-bit operating system.
So we're going to say payload instead.
There we are.
So that's set correctly now.
So we can say show options.
And we have the RHOSTS value specified for us.
And authentication via PsExec is done through TCP port
445, which is SMB, right?
So it's going to ask us for the SMB user and the SMB password.
So we can specify the hashes here.
And we can also specify the SMB domain
if the actual system is connected to a domain.
So that's something that you want to keep in mind.
We'll leave the LHOSTS and LPORT options
as they are because we terminated
our previous meterpreter session.
So if we wanted to get a meterpreter
session as the administrator user, we would copy the hash.
And the hash ends right over here.
So you want to make sure you don't copy the colons.
So I'm just going to copy that there.
And we're going to set the SMB user value to administrator,
or the user that you want to authenticate as, so
administrator.
There we are.
And we're then going to set SMB password to the actual hash
here.
And of course, if you also obtain clear text credentials,
then you can also just paste the clear text credential in here.
So I'll hit Enter.
And we can then hit Exploit.
Give that a few seconds.
So first of all, it'll say connecting to server,
authenticating to the target as the user administrator,
selecting the partial target, executing the payload,
and we get a meterpreter session.
So is I say sysinfo, you can see it's a 64-bit meterpreter
session.
Get user ID, NT/AUTHORITY SYSTEM, right?
So let me put this in the background.
There we are.
And let's list out our sessions.
You can see this is NT AUTHORITY SYSTEM.
So because we authenticated with the administrator user,
we get the NT AUTHORITY SYSTEM privileges.
We can also authenticate as the student account.
So we also got the student hash here.
So let me just copy the actual student hash.
And I'll show you that does, indeed, work.
So I'll set the SMB user to student.
Let me just make sure I get the actual syntax correctly.
There we are.
So the user is student.
And then set the SMB password to the actual student password
hash.
And then we can simply type in exploit.
And in this case, it tells us that is failed,
primarily because I think we need
to specify the actual LPORT option,
because port 4444 is currently being used.
So I'll say 4433 and then exploit.
And in this case again, it tells us that we have an error.
The server is pointed to the next unexpected status code.
Access denied.
So for some reason, it looks like we
aren't able to authenticate as the student.
And I copied the actual hash there.
But again, in this case, it looks like we cannot
authenticate as the student.
So that's perfectly fine as long as we have access
with or through the administrator credentials.
Then we pretty much have administrative access
on the target.
And of course, we can do this as many times as we want.
So we head over into sessions 2, you
can see I still have access to the session.
And if I then exit and if I use the previous command
where we had set the actual SMB password to the administrator
hash and we set the SMB user to administrator,
we'll be able to get another session.
So I'll say exploit.
There we are.
And we get another session, right?
So it looks like, for some reason,
only the administrator account works.
And we can't log in as the student
account for whatever reason.
But that's one of the great things about gathering
hashes or credentials is that you can use them
to authenticate legitimately or to essentially perform
authenticated code execution, and in this case,
obtain a meterpreter session.
So that is how to perform the pass-the-hash attack
with PsExec or with the PsExec module.
And that is going to conclude the practical side
of this video.
In the next video, we will be exploring
the process of establishing persistence on Windows systems.
So I'll see you there.