Hello everyone. In this module. We're going to be taking a
look at password, cracking and dumping hashes. So
when we talk about Windows systems, as we've already
mentioned in the previous module, when we dealing
with post exploitation, a very important aspect
of this is actually dumping the password hashes
and then and then cracking them. Now, the reason you may want to
do this is to get the credentials for these,
various user accounts on the system, which again can then be
used for further attacks. So, for example,
If we want to start cracking the password for
specific user accounts, we can again
dump the hashes and then use a buzzard cracking duel, like
John, the Ripper to crack them and then we can access those
accounts, either physically or remotely, because now,
we actually have these credentials. The second point
is that these credentials may be reused on
the system. And again, for example, we
can use them to try out to try and
see if we can log into services like databases to.
Ginn via FTP. So on and so forth. So dumping hashes
and cracking. These hashes is extremely important.
Now, we talked about Windows hashes, Windows ashes,
by default, as, for Windows
versions later than Windows Server, 2008, and
Windows Vista, all use ntlm or
the NT. Hash, which again, is a fairly simple hash to
crack especially with tools like John the
Ripper. Now, I'm currently on the Windows
7 VM and I have a meterpreter session. We're going
to
Also be doing this on the Windows 10 VM.
So again, if I just say get user ID,
I currently do not have any administrative Privileges
and the way or the method through which I
got the meterpreter session was through the persistent session that
we had set up. So again, we need to escalate our
Privileges. And what I'm going to do is if I just say hash
dump, which is one of the the tools we'll
be taking a look at right now. Hash dump is really fantastic because it
actually dumps all the hashes from the Sam database.
Base. As you can see, proof, password against some hashes.
This is going to fail, if you do not have administrative privileges.
So in order to do it to
actually get this, what we're going to do is I'm just going to put this in the background so
we'll say it background and we'll search for the suggestor and
I'm just going to say use this particular module.
So we say use. And I'm going to paste that in there few
options and we'll leave that as
it is. And we'll just say sessions just to
give the session ID. So we set the session
Do Session 1. Right? And I had
and then we're just going to run and will perform our privilege escalation
after which you will be able to run the hash dump a command. Now,
in the next video, we'll talk about the windows credentials editor, which
will allow us to dump the hashes without using meterpreter.
So if you have a command shell on
your target, as opposed to a meterpreter session, this is
a great way of dumping the hashes that way. And then again, we will
end off this module by taking a look at cracking them
with John the Ripper, so, this is going
to
Select the local exploits in the meantime. I'll
just open up my Windows 7, ZM. You can see
that. I have essentially created some new user
accounts in addition to the other ones that currently exist. In
this case. You can see we have a Lexus which I just created.
We have IE user and the sshd service
account. We can create a few more nuanced soldiers called this one.
We'll just call this Mike and this is a standard
user create account and again for
my colleges create a password and we'll just give
it a
A password that a user might be expected to
is to use all this a mic password and
we say Mike password. And of course, this is just this
is just simply for for demonstration purposes.
Now, of course, I do not need to remember this password after
offset it because will be cracking them. So I'll just
enter a simple password, hint on all your say, you know, Mike
and we'll just hit create past create password. So now
we have a few user accounts that we can you know, start
that we can actually start cracking but
We are taking a look at firstly, dumping these hashes using
hash dump. So, again, I'll just elevate my privileges
using the bypass user account Event
Viewer module. So it's a use and will
say, show options. The default
payload is set to Windows meterpreter. Reverse TCP
will set the session to one set a
session 21 and ensure that your your
active session is not in conflict with
the, the second payload option, right? Of
the
Where the airport and All-Star set. So make sure you help Port
is not the same as the first session. So
again, if I list out my sessions you
can see for my for my first session that I currently was running
with. The IE user that is running
on Port. 1 2, 3 4. So this one is fine to run on Port
4444. So I'll say set session
and we'll say one and we'll just hit run, right?
And afterwards hit run is going to start the reverse
Handler and it's going to send the stage and we'll get a
S meterpreter session and of course, I explained this
in the previous module. We are taking a look at privilege, escalation. So
we'll give that a few seconds to open up. And what
we can do now is we can say p gripped and we're looking for win, log
on to migrate to the win, log on process orders,
search for that one more time. The process ID is 404. So
I'll say, migrate migrate to
four or four hit enter. It's going to migrate to that particular
process, that particular process is it
was started by the end of Authority or
Administrative account, so that will give us administrative privileges.
So get user ID and
you can see we are currently as anti-authority. So,
we can now run the hash dump command. And there we
are. We were successfully able to dump the hashes from
this system, right over here. So, this
is your typical ntlm, hash right over here and
the 500 de Notre, simply denotes that
this is the administrator account. So that's something you want to keep in mind, when
dealing with Windows, and of course, we are going to be
Out putting these hashes into a
file called, hashes dot txt. So I'll just create a
just create a new document on
my curly box here. So so I'll go to my desktop and
we'll just say a Vim will say, Hash Hash
has Windows 7. Dot txt.
All right, and I'll just hit enter and
I'll paste these hashes in here. You can use any other text editor that
you want. So now that we have the hashes there for
with the Windows 7 box, we can now move on to the
Stan box. So what I'll do is I'll start up the windows 10
VM and then we can get started with that there.
Alright, so I've just got the metabolites accession
set up on the Windows 10 cm and of also escalated
my privileges. So again all just confirm
that with you right now. So this info, you can see it's running
Windows 10 and we have a 64-bit meterpreter session.
And of course, if I say get user ID, we
are currently logged in as anti-authority. So, if we
say hash dump, we should be able to get the hashes and
there we are. Now. I also created a few more accounts on
the Windows 10 VM just to actually test this out.
And I use random password. So again, we have the administrator account. We
have the guest account. We also have a Martin.
I create an account called Martin and we have the windows 10
account right over here. So we'll just copy these
hashes like social, you say, copy selection. And
what I'll do is I'll just put this into
a file. So CD desktop and we
will put it in Vim, hashes winds,
wind 10, dot txt. Right?
And now we have all the hashes saved from the system.
Now in the next video, we'll take a look at the windows credentials editor
so that I can show you how to dump the
various password hashes. If you do not have a meterpreter session
on your target, instead, you might
be having a you might have a command, you
might have a command line interface, or you're
simply just using a command show. So
that's going to be it for this video and I'll be seeing you in
the next video.