In this video, you will learn how to perform password
hash extraction from Windows V system.
Additionally, you'll also learn how to
crack these password hashes and retrieve the
plain text password.
So let's dive on in.
To get started with this exercise. Please ensure you
booted your metasploitable tree Windows Virtual Machine
uninsure your booted your Kali
Linux virtual machine annual logged into it.
Great to get started. Let's click
on the terminal and we can perform in network
scan to determine the IP address of our Target
system, which is the windows metasploitable tree
virtual machine to do this. We can submit type
and map space - s and followed by
the network ID.
Slash 24 gonna hit enter
and this can should take us a few seconds simply
because it's a pink scan.
Currently we have detected to IPS, which
is the 38 and Dot
41. Let's perform an IP
address.
Command like so to determine the ipo4 Kali
machine.
Currently we can see my Kali machine is
41 so therefore.
Dot 38 is our Target system. I'm simply
going to copy this IP address and let's
break into our metasploitable tree
virtual machine.
In the previous section, we have learned how to find
various security weaknesses on exploit them.
So we'll be using the channel blue exploit to
break into our Target system by using
metasploitable. So we'll type
msf console like so to start
the metasploitable framework.
Great.
Now we can use the switch feature like so let's search
for ms-17 -010 and
hit enter.
This will show us all the modules that contain that keyword
within the switch itself.
for our exploit we are going to see use
exploit /
windows
/
SMB
slash
MS
17
on the score 0 1 0
Eternal blue like so great.
Next we are going to set our remote hose
IP address, so we'll see reset.
arrows
followed by the IP address of our Target system
next we'll set our local IP address, so we'll set.
Lhost like so and you can specify the
IP of all Kali lungs virtual machine.
If you remember it is 41.
Great.
Lastly we can simply type options to
verify that all our configurations are set
properly for this exploit and be load.
We can see that our hose which is a target IP set.
The airport is set.
and most importantly
the IP address of Kali lancs is also set.
When you're ready simply type exploit and hit enter.
Great to extract the password hashes from the
Windows machine. We can simply use the harsh
dump command like so
what this command will do it will simply look for the security
account manager file better known as a some file
within the windows folder on the target
system. Once it finds out folder. It will extract
the usernames the security identifier the
landmassahashes or better
than also lmashes and the ntlers
So let's press enter to extract these password
hashes together with the usernames.
Great, and after a second to two we
have gotten all the information from the
sound file. For example, we have the
username.
in this instance administrator
We have this Sid or the security identifier,
which helps us the two men. What are
the account is administrator account or perhaps a
standard user account?
We have also extracted the LM hash.
Which is a land margin hash.
And we have also extracted anti-lm harsh
which is this value here.
So great. Now that you have extracted this harsh, what
could we do with it? There's a couple of
things we can do we can simply use a more advanced
technique which is called pasta hash to Simply
use these Ashes to log on to any other system that
uses the same credentials.
Furthermore we can perform or flying
password attacks to determine the actual plaintext
passwords from these fast food hashes.
So now that we have these password ashes. Let's see
if the entire thing.
To see these passwords. Let's copy the entire thing
like so
on on all windows system. We can simply
open a text editor such as new
part.
Going to piece all of these inside here.
And great. So we have all the information
from the sound file. Let's click
on file.
let's click on see if
and I'm going to save this on my
desktop
I'm going to call this.
Password hashes like so the txt
and click on, Save Creek.
The next thing is let's head over to our
web browser.
And we can download a tool known as hash cut hashcot
simply allows us to leverage a power
of a GPU to perform or flying
password cracking.
To download hashcat on the operating system. You need
to insure that harsh guard has direct access to your
GPU. In other words. It dedicated graphics card.
So to perform this password cracking, I will
perform this on my host system simply because I
have a dedicated GPU on my
host computer.
to download this simply click on download here and you
will get a zip file like so
also file is downloaded. You will get this
particular zip file, which says hash cut 6.2.6.7z. You
will need to extract this holder when
you extract this holder.
You will have all of these files located within
this directory.
Therefore what we need to do is we'll need
to put our extracted hashes inside
of the solar together with a
password list. If you remember within
Kali Lenox, there's a rock you passwordless you
can simply copy the rock you passwordless
and place it within this harsh cut fold as well. As you
can see. I have the rock you passwordless here.
So now all I need to do is get my
password hashes
fire latest I'll copy this or cut
it and I'll paste it right inside
here.
like so
great.
I'll copy this directory listing ISO.
Then I will open the command prompt.
like so
and hit enter
I'll type CD to change directory to
where my harsh card
files has an extracted like so great.
To perform password cracking on the password hashes
at txc file and also use a rock you passwordless we
can use a command like Soo, we'll type
harsh cut.
speed - M
then we'll specify 1000 to inform hash
guard. This is an ntlm hash.
followed by
password hashes at txc. If you remember
password hash is a txc contains a list
of usernames and password hashes.
Then we'll specify Dash e.
0 and then we'll specify our
password lists, which is Rock You the txc like
so
simply it enter and this will take a
few seconds to perhaps a few minutes to complete.
Great, it has completed. Let's screw up
just a little bit like so.
And here we can see it was able to retrieve two
passwords for two particular hashes.
So the harsh had ended with
B 5 0 B the password
is vagrant and then there's the pass
hush that ended with 9 7
e which ended with protocol like so
furthermore we can simply press the up
button on all keyboard and press -
shoe like so
we can compare these hashes with the
ones from the harsh dump.
for instance comparing the harsh values
from harsh cut here together with
a harsh values from the hush jump. We can
see the password for the administrator count as
vagrant.
Also, if we look at other hashes that
end with seven EE
Which is the username see
underscore 3 on the scope Pio the password
is protocol.
So great. If you have a little how to extract the
passwords and perform all flying base password
attacks using harsh cut.
During the course of this video you have learned how to extract Parts
with ashes on your balloon how to craft password hashes
used in hash cut.
In the next video, we'll take a look at performing password harsh
extraction from loudspeed systems and
also cracking these fossils for various user accounts.
I hope this video has been informative for you
and thank you for viewing.