Welcome to the Windows Hash Cracking
section of this course.
In this section, we will be exploring
the process of how to dump and crack NTLM hashes on a Windows
target system that you have compromised.
All right, so as I said, these sections
are going to be relatively short.
We're just going to essentially cover everything in one video.
The reason for that will become very clear, primarily
because we've already explored the process of dumping
NTLM hashes in the system and host based attacks course.
We are primarily focusing on how to crack
NTLM hashes in this video.
With that being said, let's get an understanding
or let's revisit Windows password hashes before we
actually continue or move on.
All right, so the Windows operating system stores
hashed user account passwords locally in the SAM database.
SAM stands for the Security Accounts Manager.
All right, so this database file is
where you have all the hashed user account passwords stored
on Windows, because most modern versions of Windows
do not store clear text passwords, right?
So when you create a user account, the hashed--
whenever you specify your clear text password,
that password is hashed and stored in its hashed format.
So Windows really doesn't know what the clear text
equivalent is.
When you log on to the system and you provide the clear text
password, that is hashed and that
is compared to the one that's stored within the same database
to see whether they match.
If they match, you're authenticated successfully.
If they don't match, then you've entered the incorrect password,
right?
So what is hashing?
Hashing is the process of converting a piece of data
into another value.
A hashing function or algorithm is
used to generate the new value.
The result of the hashing algorithm
is known as a hash or hash value.
Now, on Windows authentication and verification
of user credentials is facilitated
by the local security authority also known as LSA.
Now, in terms of the different types
of hash formats on Windows, Windows versions up to Windows
Server 2003 utilize two different types of hashes.
So you have your LM hash and your NTLM hash.
All right, now, Windows disables or disabled LM hashing
and utilizes NTLM hashing by default
from Windows Vista onwards.
So everything from Windows Vista, so Windows 7, 8, 8.1,
Windows 10, Windows 11 now utilize NTLM hashing, right?
And, of course, there's various versions of NTLM.
In this video, we're primarily focused
on NTLM, so not NTLMv1, NTLMv2.
That's something we'll be exploring
in another certification.
So I briefly mentioned the SAM database, right?
So SAM, which stands for Security Account Manager,
is a database file that is responsible for managing
user accounts and passwords on Windows.
All user account passwords that are stored in the SAM database
or hashed as I've already mentioned.
Now, the SAM database, as you can already tell,
is quite similar to the /etc/shadow file on Linux.
Now, the interesting thing about SAM database file is that it
cannot be copied while the operating system is running,
because you may be thinking to yourself, well,
if I wanted to dump the user account hashes,
how would I do this?
Can I just copy the SAM database file?
Well, you actually cannot do that while the operating system
is running.
So from the perspective of a penetration test,
this is not really a viable technique.
However, there are situations or scenarios
where a copy of the SAM database file
has been made on the system for two primary reasons, one
of which is just taking a backup and the administrator did not
delete the backup file, therefore providing attackers
with essentially a copy of the SAM database
that they can download or transfer.
And secondly, when the Windows operating system encounters
an issue and you try and repair the operating system,
if you have ever used the Windows Repair utility,
then Windows will make a copy of the SAM database file.
And this copy usually needs to be deleted manually.
So again, there are scenarios where
you might find a copy of the SAM database file.
All right, so the Windows NT kernel,
which is just the Windows kernel itself,
keeps the SAM database file locked.
And as a result, attackers typically
utilize in-memory techniques to dump the SAM hashes
from the LSASS process cache.
All right, so we'll actually get into the LSASS process.
But LSASS stands for the Local Security Authority Subsystem.
And this process on Windows essentially
is used for authentication and verification of credentials,
right?
And for that reason, it interacts
with the SAM database.
Now, this process has a cache, right?
A cache is typically where a program
will store temporary data.
Now, attackers and pen testers will typically
utilize in-memory techniques to dump the SAM
hashes from the LSASS process cache,
because when the LSASS process is again,
being utilized to verify and/or for verification of credentials
and authentication, it will go and check the same database,
and it stores that information in its cache.
And if we can gain access to that cache,
then we can get the actual hashes
that are stored in that cache and consequently crack them.
All right, so in modern versions of Windows,
the SAM database is encrypted with a syskey.
And in order for you to dump--
to access and interact with the LSASS process
and consequently dump the actual hashes from the SAM database,
you need elevated or administrative privileges
on the target system, which is why I'm making
or we have actually covered this topic at the end
after performing privilege escalation, right?
So do keep that in mind.
Now, let's learn a little bit more about the NTLM hash,
also known as the NTHash, all right?
So NTLM is a collection of authentication protocols
that are utilized in Windows to facilitate authentication
between computers.
The authentication process involves
using a valid username and password
to authenticate successfully.
From Windows Vista onwards, Windows
disables LM hashing and utilizes NTLM hashing.
So when a user account is created,
it is encrypted using the MD4 hashing algorithm,
while the original password is disposed of.
NTLM improves upon LM in the following ways.
So firstly, NTLM does not split the hash into two chunks,
and allows passwords to be case sensitive,
and also allows the use of symbols and unicode characters.
So if you've gone through the system and host-based attacks
course, you should know the difference between an LM
hash and an NTLM hash and why NTLM
is much better from a security perspective.
But from a pen test perspective, it makes it a little bit
complicated, because the password is not
limited to a specific length.
Passwords can be case sensitive and passwords can also utilize
symbols and unicode characters.
So this is the NTLM hashing process
where when we're creating a user account,
we can specify the following password, which
is quite secure.
It contains symbols, uppercase, and lowercase letters
as well as the numbers and some special unicode characters
that is hashed using the MD4 hashing algorithm
and that produces the NTLM hash.
All right, so in terms of dumping and cracking
NTLM hashes, we can dump Windows password hashes
by leveraging various utilities like the inbuilt meterpreter
hash dump command, which is what we will be using.
If you want to learn more about how to dump hashes
with Mimikatz, you can check out the Metasploit Framework course
or the System and Host-based Attacks course
to learn more about how to use it as we have covered it quite
extensively by this point.
So after we have dumped the hashes,
we can crack them through the use of the following utilities.
One of them is John the Ripper and the other is Hashcat.
And we'll be focusing on how to use both of them
to crack NTLM hashes.
With that being said, this video has a lab environment
attached to it.
So all you need to do is just fire up the lab environment,
and we will be gaining access to the target system
firstly, after which we will check and see whether we
have elevated privileges.
After we've done that, we can then
go ahead and dump the hashes and then
take a look at how they can be cracked with John the Ripper
and of course Hashcat.
So with that out of the way, we can actually get started.
So I'll see you in the lab environment.
All right, so I'm back in the lab environment.
And you will be provided with the target IP address.
In your case, it's going to be different, but just
copy the value.
The next step, of course, is to perform an Nmap
scan on the target system to identify
the vulnerable service that is running that we
can exploit to gain access.
So I'll Nmap and we'll perform a quick service version
detection scan.
And in this case, I know that the vulnerable service
is running on port 80.
So I'll just limit the scan to port 80, and I'll hit Enter.
And I'll give this a couple of seconds to complete.
All right, the Nmap scan is complete.
And as you can see, we have the web server
open or port 80 open.
And we have a web application called
BadBlue or rather a web server called BadBlue version 2.7.
We already know that there is a vulnerability that
affects this particular version of BadBlue.
So we can actually confirm that by searching for BadBlue.
And I'll just type it in with the correct case.
There we are.
And you can see that we have the Metasploit Framework Exploit
module here for version 2.7.
So we'll open up msfconsole.
And we'll search for the Exploit Module.
All right, there we go.
The Metasploit Framework Console is starting up.
So I'll say, search and BadBlue, and I can then
say, use option 1 or use module 1.
And I'm using the identifier here.
So this is the module we want to use.
You can also copy the module name
and say, use and paste the module name there.
I'll just say, use 1.
The default payload is the 32-bit meterpreter payload,
which is perfectly fine, because we
don't know what the target operating system
architecture is yet, all right.
So we can show the options here, and we need
to set the payload options.
In my case, they're already set.
If they are not, you can type in the ifconfig command
and get your Kali Linux IP address
and set the Lhost option or set the value for the Lhost option
yourself.
The default port or the default value for the Lport option
is 4444, which is perfectly fine in this case.
So I'll set the target IP by saying, set Rhosts, and then
I specify the target IP that I copied.
And I'll type in Exploit.
All right, so that's going to send the stage,
and we should receive a meterpreter session, fantastic.
So let's perform some basic local enumeration, sysinfo.
You can see that the target operating system is Windows
Server 2012 R2, build 9,600.
It is a 64-bit operating system, and we have
a 32-bit meterpreter session.
And we currently have access to the target system
as the administrator user, which is fantastic.
And we can confirm that by typing in getprivs.
So I'll just type in the command here.
And you can see we have the permissions
that you typically associate with the administrator user.
So that means that we do not need to elevate our privileges
and can consequently move on to the next phase, which
is dumping the NTLM hashes.
However, before we do this, given the fact that we're
going to be targeting the LSASS process or the LSASS process
cache, it would be a good idea to migrate or to identify
the LSASS process ID by saying pgrep LSASS
and then migrating into it.
This will essentially solve two issues.
Firstly, it will upgrade our meterpreter session
to a 64-bit meterpreter session.
And secondly, it'll essentially make our meterpreter session
much more stable in the context of accessing the LSASS process
cache.
So I'll say, migrate, and if successful it should say,
migration completed successfully.
I can now utilize the hash dump utility.
You can also load the kiwi module, which is essentially
a module or the module implementation of Mimikatz
for meterpreter.
But in this case, we'll just use the simple command hash dump.
There we go.
And this will display a list of--
essentially dump a list of user accounts and their hashes.
And these are the NTLM hashes right over here.
And the ones that we're interested in
are going to be the administrator user and the user
Bob or the user account Bob.
We're not really interested in the guest account
because that's really not useful.
And in most cases, the administrator
or rather the guest account is disabled by default.
All right, what we can also do is
confirm what other user accounts on the system,
and you can see in this case, we have got all the hashes
for all the user accounts on the system, which is great.
All right, so I'll terminate this channel.
And what you want to do now is copy these hashes.
So I'll just copy them as they are.
I'm going to exclude the user account Guest, right,
and I'm going to open up a new tab here.
And I'll head over to my desktop on the Kali Linux system,
and I'll create a new file called hashes.txt.
And I'll open it up with Vim, the Vim text editor.
You can also use the standard GUI text editor or the Nano
text editor, whatever works for you.
And I'll paste those hashes in here.
There we are.
So they are pasted incorrectly.
You don't need to modify the hashes in any way.
And I'll write in Quit to save that.
So let me just cut out the content of hashes.txt.
You can see we invented them correctly.
So let's start off by exploring how we can crack NTLM
hashes with John the Ripper.
All right, so in order to crack NTLM hashes,
we can utilize the John utility.
So if I type in John, you can get an idea
as how to utilize John the Ripper.
In this case, we are primarily focusing
on how to crack an NTLM hash, and it really is very simple.
What we need to provide firstly is the format of the hashes
that we want to crack.
And that can be denoted or specified
through the use of the format option right over here.
So we say, format is equal to NT.
Now, if we wanted to list the available formats,
we can say, list equal formats as it says there.
And we'll give this a couple of seconds.
And these are all the formats that you
can crack with John the Ripper.
And, of course, in our case, we're looking for NTLM,
so we can say, grep NTLM and I'll hit Enter.
And in this case, NTLM is referred to as a NT.
There we are.
So we have net NTLM, we have net Sha1, nk, and NT.
So this is the format we're going to be using.
All right, so now that we have that specified,
you can also specify the word list
that you'd like to use to perform a brute force attack.
If you don't specify the word list,
then John the Ripper will use its default word list.
So for now, what we can do is say, John format equals NT,
and then we specify the file that contains the hashes.
Now, if we wanted to use a word list,
we can specify that by saying, word list, and then we can say,
word list is equal to user share and we
can specify whatever word list we want to use.
In this case, let's try and use the default John the Ripper
word list, and I'll hit Enter.
This is going to take a couple of seconds.
There we are.
And it looks like it's completed the cracking.
So you can see that it will proceed with the default word
list, so that is user/shared/John/password.list
and the rules are word list.
All right, and you can learn more about
how John the Ripper works by taking a look at the output.
All right, so you can see that if you successfully
pasted in the hashes correctly, then it will say,
loaded two password hashes with no different salts.
And it correctly identifies that this is an NTLM hash as it
was encrypted with MD4, right?
No OpenMP support for this hash type proceeding
with the single rules.
And it'll then process the remaining buffer candidate
password if any.
And right over here it tells us the passwords, the clear text
passwords for the administrator account
as well as the user Bob.
All right, so in the case of this lab environment,
simple passwords were used to demonstrate
how you can perform the password or the hash
cracking process with John the Ripper firstly,
and then of course with Hashcat.
So I recommend saving these credentials
as we have now been able to identify the hashes or other
the clear text passwords by cracking the NTLM hashes, which
is fantastic.
So from a penetration testers perspective,
this information is extremely useful,
because it means that we can now legitimately authenticate
with the target system either through RDP
or through another protocol like SSH
if SSH has been installed on the target system.
However, in the event that we were not
able to crack the actual hashes, we
could have still utilized the hashes
to authenticate with the target system via SMB,
utilizing the PS exec utility as we've already
explored, all right?
But we've been able to do it with John the Ripper.
As I said, you can also specify the word list if you want.
So if I type in John here, and let's
see if I can identify the word list option, there we are.
So word list equals and then you can specify the word list
that you'd like to use.
Now, by default, on Kali Linux, there
is a really helpful word list that
comes pre-packaged with it.
And it is stored under the user Share word list directory.
And by default, it is compressed with the gzip compression
algorithm.
So we can decompress it by saying,
gzip-d/user/shar e/wordlists/rockyou.txt.
We hit Enter.
That is going to decompress it, and we
can go through the cracking process again.
So we can all say we want to use a different word list,
and we can say word list equals user/share/wordlists/rockyou.txt
in hit Enter.
And that is going to utilize the rock you word list instead
of the default one.
In this case, you can see that John pretty much
knows that we have already cracked these hashes.
So it'll tell you right over here
that no password hashes are left to crack,
and that's because we've already done it.
However, as a penetration tester,
feel free to utilize any word list that you have created
or that you feel would be a good fit.
All right, so with that being said,
we can now move on to cracking these hashes with Hashcat.
All right, so let me open up the Hashcat utility.
And I'll type in Hashcat, there we are.
And I'll open up the Help menu, because Hashcat is
a really, really powerful tool.
And we'll not be exploring all the options.
Remember, we're primarily focused
on cracking NTLM hashes.
All right, so I'll just scroll to the top of the documentation
because I need to explain a few things.
So at the top of the documentation,
you can see that--
let's see if I can actually identify that here.
It's not going to be formatted correctly, but there we are.
Right, so at the top it'll tell you the version of Hashcat
that's running.
So it'll tell you the usage instructions right over here.
So Hashcat options, the hash or the hash file, the dictionary
mask or directory.
Now, whenever you are cracking NTLM hashes or any hash,
there are really two key things that you need to be specifying,
one of which is the hash type.
And you can do that by using the M option.
So this is the equivalent of specifying the format option
with John the Ripper.
So you say, M, but you don't say M equals to NT or NTLM.
For the hash type you need to specify the hash ID
or the hash type ID.
The hash type ID can be found right over here.
So if you just crawl and you can see these are the hash modes.
So we are looking for NTLM, right?
And let's see if I can identify NTLM here.
And you then need to identify the consequent ID
of that particular hash mode.
Let's see if I can find it.
It should be before the rest of them here.
So we have for the first ones MD4 and MD5.
We should have the NT format or NTLM,
for lack of a better word.
All right, so one of them is LM.
We're not cracking LM hashes.
We're looking for NTLM, so that is 1,000.
All right, so we specify the hash mode, right?
We then need to specify the attack type.
So if we scroll to the bottom of the documentation,
you can see that you have in addition to the mode,
you also have the attack modes, right?
So in this case, we are going to be performing a brute force
attack.
And we can then specify the word list that we would like to use.
And in this case, we can use the rock you word list.
So you can see we specify the word list.
So this is an example here.
We can specify because we are performing a brute force,
we can say, Hashcat a 3m 1,000 hashes.txt
and then the word list that we would like to use.
All right, so what we can do is I will just type in Enter
there, and I'll clear that out.
So I'll say, Hashcat, we're using the--
we are going to be utilizing the attack type 3.
So I'll say, a3, and then we're using the hash mode 1,000,
so that's NTLM.
We then say hashes.txt, and then I can specify the word list.
So word list is user share.
And in this case, what I'll do is we can actually try and--
I'm just going to specify it here user/share/wordl
ists/rockyou.txt.
We hit Enter.
And this is now going to take a couple of seconds.
So it's going to initialize Hashcat,
and it's then going to identify, firstly,
let me see if I can show you that here.
So it'll tell me what device is being used for the cracking.
So it'll give you a list of your system resources.
So you can see in this case, the lab environment
provides you with a 32 core processor and 94 gigabytes
of RAM or thereabout.
And you can see that it accurately
identifies the hash type, and it's
going to begin initialized in the backend runtime
for the device.
So I'll give this a couple of seconds, after which it
is going to begin the cracking process, which you just
missed shortly.
It just took a couple of seconds.
And you can see that it actually cracked the password
for the user Bob right over here.
And if you take a look at the recovered digest,
you can see that it recovered two passwords, right,
or two digests, if you will.
And that makes a lot of sense.
So you can see the candidates are password 1.
So we already know that that's for the user Bob.
And if we take a look right at the top here,
these are all the attempts that it performed.
And this is a typical brute force attack, right?
And the reason we're using an already existing word list
and we're not generating our own word list
is primarily because this video is focused on the technique
as opposed to the actual process of cracking complex passwords,
which in that case, you need to generate your own word
list based on a few parameters that are quite important.
So Hashcat is done, and it provides us
with the actual clear text password for that hash.
So we have successfully been able to crack
the actual hash or the hashes for both the administrator
user as well as the user account Bob.
So we can now utilize these passwords or the hashes
themselves to authenticate with the target system legitimately.
And I've covered how to do this either
through the PsExec utility or the PsExec Python script
or through the PsExec Metasploit Framework module.
If RDP is enabled on the target system,
you can also log in that way.
All right, so just to demonstrate
how this would work, I've performed an Nmap scan
on the target system in order to identify whether RDP
is currently running.
And you can see that the port 3389 is currently open, which
means that RDP is enabled.
So what we can do now is we can essentially
authenticate with the target system using
the passwords we were able to identify
from the hash cracking process.
And we can utilize the xfree RDP utility.
So we specify the user as administrator
and the password is password, and we then
specify the target IP.
And if I hit Enter, I'm going to trust the certificate.
And we'll give this a couple of seconds, and there we are.
I'm logged on to the target system without any issues.
And the great thing with this is I've done this legitimately
without essentially utilizing an exploit.
And after you've gained the clear text passwords for user
accounts on a Windows system, it's pretty much game over,
because you now have unrestricted access
to that target system, and you can essentially authenticate
to it whenever you want.
So this is really another good form of persistence
or another form of maintaining access on the Windows system
that you have compromised.
With that being said, that is going
to conclude the practical demonstration
side of this video.
All right, so that is how to dump and crack NTLM hashes
on a Windows system that you have just
compromised through the use of John the Ripper and the Hashcat
utility.
So by the end of this section, which is this video,
you should have an understanding as to how you can dump hashes.
In addition to that, you should also
know how to utilize the two popular or extremely powerful
tools that can be used to crack these hashes.
One of them is John the Ripper and the other is Hashcat.
We're now going to move on to the Linux password
hash or the Linux hash cracking section of this course, where
we'll be exploring the same process but for Linux systems.
So I'll be seeing you in the next video.