‫So we've now seen how to exploit a vulnerability.
‫Now I'd like to show you, how are you going to exploit a system, even though that target system has
‫no exploitable vulnerability?
‫You, you're scratching your head.
‫Pass the hash is a hacking technique that allows an attacker to authenticate a remote server or service
‫by using the underlying NT, TLM or LENDMAN hash of a user's password.
‫Instead of requiring the associated plaintext password, as is normally the case.
‫So this is how that mechanism works.
‫On systems or services using in TLM authentication, users passwords are never sent in clear text over
‫the wire.
‫Instead, they are provided to the requesting system like a domain controller as a hash.
‫Native Windows applications ask users for the clear text password, then call APIs like LSA log on user
‫that convert that password to one or two hash values.
‫The Elm and or anti hashes and then sends that to the remote server during NT TLM authentication.
‫Analysis of this mechanism has shown that the clear text password is not required to complete network
‫authentication successfully.
‫Only the hashes are needed.
‫So if an attacker has the hashes of a user's password, they do not need to brute force the clear text
‫password.
‫They could simply use the hash of an arbitrary user account that they have harvested to authenticate
‫against a remote system and impersonate that user.
‫In other words, from an attacker's perspective, hashes are functionally equivalent to the original
‫passwords that they were generated from.
‫The P.S. exact module is often used by penetration testers to obtain access to a given system that you
‫already know the credentials for.
‫It was written by wind tunnels and has been integrated within the framework.
‫Wind tunnels were established in 1996 and acquired by Microsoft in 2006, and the name became SIS internals.
‫Now, because we're able to use hash values instead of passwords, Metasploit piece exact module is
‫used to perform past the hash attacks.
‫Now, what do we need to use Metasploit piece ExAC the following.
‫Target IP, it's also possible to use more than one IP address or an IP address, block and pro version.
‫The username of a valid user on the target system.
‫A password or the password hash of the user.
‫A share on the target system.
‫Administrative shares on a private network such as a network of a company are always enabled because
‫the system administrators understandably don't want to visit a computer to manage, and the output of
‫the Metasploit piece exec will be the interpreter session.
‫Well, the output will be the payload we use.
‫But if we have a chance to have him interpreter session, it's better to take the interpreter session.
‫So check out this scenario, you exploited a system in the scan network and succeeded to activate a
‫mature operator session.
‫Not necessarily, but just, you know, work with me here.
‫So you obtained a valid username and user password hash values.
‫Computer users are prone to use the same password in different platforms.
‫I mean, what do you do?
‫You have different passwords for each of your credentials Facebook, laptop, Gmail, Instagram, etc.,
‫etc..
‫Well, I mean, I can't blame you because there are a lot of platforms asking for our passwords.
‫But what if there are other computers which are logged in with the same password?
‫Remember, we don't need to crack the passwords if elm or anti-Islam authentication is used on the network.