Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens) « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Hacker newbies have an inordinate fixation onpassword cracking. They believe that cracking the password is the only way to gain access to the target account and its privileges. If what we really want is access to a system or other resources, sometimes we can get it without a password. Good examples of this are replay attacks andMitM attacks. Neither requires us to have passwords to have access to the user's resources.Another way to gain access to a user's account, resources, and privileges is through capturing or impersonating the user's tokens.An important concept I want to emphasize here is that of tokens. In Windows, a token is an object that contains the identity and privileges of the user. When a user logs in, their identity is verified by checking their password against the stored, hashed password list and, if it matches, they are allowed in. The system then issues a token to the user that contains their privileges. Whenever the user wants to access a resource or process, the token is presented to determine whether they are permitted access. Obviously, if we can grab or impersonate that token, we can access all of their accounts and resources without having to crack their password!In this tutorial, we will useMetasploitand theMeterpreterto grab an authenticated user's token. There is a script in Metasploit named "Incognito" that is capable of grabbing tokens and impersonating them. This script was first developed by security researchers independent of Metasploit, but was then integrated into our beloved Metasploit Framework and is available to anyone using this powerful tool.Step 1: Fire Up Kali and MetasploitTo start, fire upKaliand start Metasploit by typing:kali > msfconsoleYou will be greeted by a screen like that above. Please note that I have changed the default background in Kali to a less ominous looking image. Yours may look different.Step 2: Exploit the System & Get MeterpreterNext, exploit the system and get the meterpreter. In this case, I have exploited an unpatched 2003 Server (there are millions of them still around and support has just ended, so they will no longer be receiving patches). Rather than me repeat here how to exploit a system, please check out mypast Metasploit tutorials.As you can see in the screenshot below, I have gained a Meterpreter prompt on the target system.Step 3: Load the Incognito ModuleIncognito is not loaded into the Meterpreter by default, so we need to load it into the Meterpreter before we can use it.meterpreter > load incognitoStep 4: List Available TokensNext, we need to view what tokens are available on the system by listing them.meterpreter > list_tokens -uAs you can see, I (OTW) have a token on the target system named 23KTARGET\OTW. Let's see if we can impersonate that token and gain the privileges of OTW.Step 5: Impersonate the TokenAs you might expect, the command to impersonate a token is:meterpreter > impersonate_token 2K3TARGET\\OTWIt's important to note that in the above command, I used the "\\" before OTW. The first "\" escapes the second "\" so that the system sees the "\" as a literal and not a special character. If you write this command with a single backslash, it will tell you that the token was "not found."If Incognito can impersonate the token, it responds as in the screenshot above: "Successfully impersonated user 2K3TARGET\OTW." Now that we have the token of OTW, we can access and use any resources that OTW has privileges to without cracking their password!Keep coming back, my tenderfoot hackers, as we continue along our path to your becoming a professional hacker!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:The Hacker MethodologyHow To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:The Five Phases of HackingHack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)How to Hack Windows 7:Sending Vulnerable Shortcut FilesHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerMac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)How To:Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL AttackHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)News:What to Expect from Null Byte in 2015Goodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker Training