[THEME TUNE PLAYING]
Dumping Hashes with Hashdump.
Now that we've explored the process of elevating
our privileges on a Linux system,
we can begin exploring the process of dumping Linux user
count hashes through the use of the hashdump module
within the Metasploit framework.
All right.
So what is Hashdump.
Well, hashdump is a post exploitation module
that, again, is utilized to dump the hashes of both Windows
and the Linux operating systems.
And typically, when you're utilizing a Meterpreter session
on a Windows target, the hashdump command
is built right in, as we've explored.
However, when we're utilizing a Meterpreter session on a Linux
target, we will need to utilize the hashdump
or we'll need to load up the hashdump post exploitation
module manually.
So this module essentially allows
us to dump the Linux user account hashes.
And again, in order to understand how this is done,
we need to understand where the Linux
user account hashes are stored.
So the Linux user account password hashes are
stored in the etc shadow file.
Right?
And this file can only be accessed by the root user
or a user with root privileges.
So again, in order to access the hashes of a Linux system
or the user account hashes on a Linux system,
you need to have root privileges or you
need to have an elevated session, which
is why we covered privilege escalation first.
All right.
Now the hashdump module can be used to dump the user account
hashes from the etc shadow file, and can consequently
be used to unshadow the files or unshadow
the hashes for password cracking with John the Ripper.
Now we are not going to be exploring password
cracking with John the Ripper.
But in essence, the only thing you can really
do with a Linux hash is either crack it or you essentially
just store it for later use.
And of course, I'll be explaining
how the hashes can be used for cracking in the video
once we've actually dumped the actual Linux user account
hashes.
All right.
So let's get started with dumping hashes with hashdump.
So just fire up the lab environment,
and we should be good to go.
So I'll see you within the lab environment.
All right.
So I'm back within the lab environment.
And of course, the first step involves
identifying the target IP address, which we
can do by typing in ifconfig.
And we want to head over to the interface Ethernet 1.
And you just want to copy this IP
and change the last digit to a 3.
So again, the target IP or the target server
is on the same subnet on the next IP.
So of course in your case, the subnet
is going to be different.
All you need to do is just copy the entire IP
and change the 2 to a 3.
All right.
So I'll copy that.
We can then start up the PostgreSQL database service,
as we will be requiring it to store all of the information
that we gather with the post exploitation module hashdump.
All right.
So I'm going to say service PostgreSQL Start,
and we can also start up MSF console while we're at it.
All right.
So we'll give that a couple of seconds.
All right.
So there we are.
We are back in MSF console.
And we can create a workspace here.
And I'm just going to call it hashdump.
All right.
There we go.
And we can then set up the global variable for the RHost
option, and we'll set that to the target IP.
In this case, we just need to change the 2 to a 3.
There we are.
And this, again, will eliminate or save us
from having to type in the target IP
whenever we load a module.
Right?
So now that that is done, we can actually
begin the process of exploiting the target system in order
to gain initial access, after which,
we can then dump the hashes.
So in order to do this, we're going
to utilize the DB Nmap command to perform an Nmap
scan from within MSF console.
And again, the DB Nmap command will also save the Nmap scan
results into the Metasploit framework database,
which is exactly what we want.
So we'll perform a service version detection scan,
and I'll paste in the target IP.
Remember to change the 2 to a 3.
And we'll hit Enter.
So I'm going to give this a few seconds to a couple of minutes
to complete.
All right.
So the Nmap scan is complete.
And as you can see, the target is running SMB.
It's a Linux target.
It's running Samba to be specific,
and the service version is anywhere between 3 and 4.
And of course, we've taken a look
at how to exploit Samba on the Linux system.
So what we can do is search for the Samba exploits.
And I'm going to say Search Samba, and the type is Exploit,
and we're going to be utilizing the Is Known pipe
name exploit module.
There we are.
So I'm going to say Copy and Use.
And we can then show the options here that we need to set up.
And in this case, the only options that we need to set up
are the target IP, which we have done already,
and the target port.
And then we can just type in Exploit,
and that should give us a Meterpreter session.
So we'll give this a couple of seconds.
All right.
So we get a command shell session,
but we can still upgrade this.
So again, if I type in PWD, you can
see that that works just fine.
I'll put this in the background, and I
will upgrade this session.
So I'll say Sessions.
Let me just type that in correctly.
Sessions.
And we can then say Sessions Upgrade 1 and hit Enter.
And that's going to give us a Meterpreter
session on the target system, which is required in this case.
All right.
So we'll open up Sessions 2 here.
And again, if I try and type in hashdump
similar to what we had done on Windows,
you can see that'll tell us unknown command hashdump.
So given that that is the case, we actually
need to load in the actual hashdump module
or we need to utilize the post exploitation
module called hashdump.
Right?
So again, the first thing we want to do
is perform some enumeration.
So we are running on Debian 8 system,
running the Linux kernel 5.4.0.
And if we enumerate our current permissions or the user
that we currently have access to,
you can see we have the user ID of 0, which means we are root.
And of course, we can confirm this
by saying Shell, and then saying, Who am I.
And as you can see, it says Root.
So that means we can, again, dump the actual Linux user
account hashes.
And what I'll do is I'll terminate this channel.
And then I'll put our Meterpreter session
in the background.
And for some reason, that actually dies.
So we are just going to terminate or exit
from this session.
And we're just going to upgrade our previous command shell
session again.
There we are.
And that should give us another Meterpreter session.
All right.
So now that we have the Meterpreter session established
again, we can search for the module.
It is called hashdump.
Right.
And I'll say hashdump.
There we are.
And we are looking for the Linux hashdump module.
So post to Linux gather hashdump.
That's the module there.
And let me just hit Enter.
And as you can see, this will gather and dump
the password hashes for Linux systems.
So I'll copy that.
And we'll say Use.
Paste that in there.
Show the Options.
The only option that we need to specify is the session ID.
So we'll set session to 3, because that's our Meterpreter
session.
And we can then Run.
And as you can see, it's going to tell us
the unshadowed password file is going
to be stored under the following directory,
and it will then provide us with the actual path
to the file as well as the file name.
And of course, you can access this information
by typing in Loot.
And as you can see it's going to display the actual Linux
password file which is used to store the Linux user account
details, like their username, the actual home
directory, the shell that they have actually been configured
to use, et cetera, et cetera.
And then you have the shadow file, which
we mentioned in the slides.
This is where you'll actually find the encrypted passwords.
So we can try and access all of these files.
So let's open up the password file first.
I'm just going to copy that and say cat.
Paste that in there.
And as you can see, this will list out
all of the user accounts on the system.
So we only have the root user and a few other service
accounts.
If we list out the actual shadow file or the contents
of the shadow file that was dumped,
we can see that it lists out the user accounts.
However, in the place of the password, which is directly
after the username is specified, you
can see that there's an asterisk.
Which means, in this case, the target system
does not have a password specified
for any of the user accounts.
And that makes sense in some scenarios,
especially in the case of the service accounts.
However, just to show you that this indeed
does work, what I'll do is I'll open up Sessions 3.
And I will open up a shell session.
And I'll say bin/bash I. And I will
change the password of the root user,
or rather, I will provide the root user with the password.
So I'll say Password Root.
And I'll say something like password123.
Password123.
There we are.
So we've changed the password for the root user.
And then we can add a few users.
So I'm going to say User Add.
And we can specify that we want to create a home directory.
And the name of the user will probably
be something like Alexis.
And then I can specify the actual shell
I want the user to use.
So I'll say the shell is bin/bash.
And then I can specify the password for the user Alexis.
So I'll say a password321.
Password321.
Of course, this is not the--
I'm not really following any password security guidelines
here, but I'm just doing this to demonstrate
that this does indeed work.
I'll terminate the session or that channel.
And again, we'll need to upgrade our Meterpreter session.
So I'm just going to do that right now using
the Sessions Upgrade 1.
There we are.
And that will open up the Meterpreter session
on Sessios 4.
For some reason, it keeps dying.
But what we've done is we have created a new user,
set the password, and change the password for the root user.
So let's see or let's take a look
at what happens when we run hashdump now.
So I'll Show the Options again here.
And we'll set session to 4, because the Meterpreter session
is now changed.
And I'll then hit Run.
As you can see, now it's going to actually display
the actual hashes that it was able to identify.
So you can see it got the root user hash.
And this is the hash right over here.
There we go.
And then after the hash, the user ID as well as the group ID
specified, and then the actual home directory and the shell
specified for that user.
So the same thing goes for the user Alexis.
You can see that we have the hash here.
And then you have the user ID as well as the group ID.
And then the actual home directory as well as
the shell that has been specified for that user.
And then it'll tell you that the unshadowed file
or the unshadowed password file has been stored here.
So again, we can open that up by saying Loot.
And we can say we are looking for the actual Linux
unshadowed password file.
And we know that this ends in 851.
So this is the file here.
So we can cat that.
So I'll copy that.
And we'll say cat.
And for some reason, it doesn't actually
copy, so let me just specify that again.
So I'll say Copy.
And I'll say cat.
There we are.
And for some reason, it doesn't look like it's opening that.
But what we can do is just specify the actual--
we can actually just specify the path to the file,
and that will essentially display
the contents of the unshadowed password file.
And in the case of the unshadowed file, what it really
does is it just prepares the user accounts and the hashes
for password cracking.
So it will get rid of the other information
like the actual user ID as well as the group
ID, and the home directory as well as the shell session.
And what you'll be left with is really
just going to be the actual username and then
the hash here.
All right.
Now when we talk about this little encapsulated value
that's been encapsulated in the dollar signs,
that is referring to the hashing algorithm or the encryption
algorithm that was used to essentially encrypt or hash
these passwords.
So the higher the number, the stronger the hashing algorithm
used.
So if you're working on an older Linux system,
then you'll find that that may be encapsulated
or the value may be 1, instead of 6.
And if it is 1, it means that that password has been hashed
with the MD5 hashing algorithm.
If it's 2, it means it's been hashed with Blowfish.
If it's 3 or 5, that means that it's been hashed or encrypted
with the SHA-256 algorithm.
And if it's 6, it's utilizing the strongest
hashing algorithm, which is SHA-512.
So again, given that that is the case, if the passwords have
been set or if the passwords are created following
or in accordance with password security guidelines,
then, again, it may be very difficult to actually crack
those passwords or those hashes for that matter.
And if they are simple, then, again, there is a chance
that you could crack them.
But again, when it comes down to Linux and hashes,
and again, the functionality of hashes
in regards to post exploitation, there's
very little that can be done.
Unlike Windows, where we actually
took a look at how to utilize the hashes
for legitimate authentication or authenticated
command execution.
With Linux, we really can't do that.
But that's primarily because once you
have root access on a Linux system,
you can pretty much do whatever you want.
So you can create another user, specify a password,
and of course, enable SSH so that you
can maintain access via SSH.
And of course, we'll be exploring
that in the persistence video.
So that's going to be it in regards
to the practical demonstration side of this video.
In the next video, we will be exploring
the process of establishing persistence on a Linux system.
So I'll see you there.