After gathering different kinds of information passive and active information.
Now let's start to gain access to the system.
So the first attack that you can explain will be the password attack.
This section will be focusing on different type of password attack.
And I will try with the demonstration and then I'm going to explain how to enhance your tool and your
capability to be able to compromise the password.
So let's take a small scenario first with a small tool and let's see how it works.
Before starting I just want to let you know that we're going to cover the online password attack and
offline password and online is.
Actually it's a hard one but we'll be covering both of them so let's take a small online password attack
scenario.
So I have a client machine so the server and I need to scan the server as we explained on the previous
lecture.
So I'm going to type and map minus small as capital as and I'm going to put the IP just to check the
services and support running on this machine.
So the IP of the server is two fifty five
Miss road map.
So here you go and map and it's scanned and it showed me different services and I'm going to start checking
the different service that I can utilize.
So we notice for instance the
here 3 3 8 9 3 3 8 9.
It's actually a port for remote desktop Microsoft remote desktop services.
And according to that so this computer and most not most but many server will allow this remote desktop
protocol to be able to access the server remotely and solve the problem and manage the server.
And actually this is very common.
So that means the 1 9 2 1 6 8 1 6 3 2 4 250 has a specific service that allow for remote connection
which is the Microsoft remote desktop protocol.
So let's try to connect it.
So I'm going to type our desktop.
You can connect to remote desktop from Linux not just from windows.
So our desktop Uh minus you and let's put means traitor
now my minus you stand for user name and let's put the IP which is 1 9 2 1 6 8 1 6 3 2 5 0.
And if you remember from the previous section we explained that it would be very useful if you are able
to get a valid user name.
So and we saw some tools for doing this enumeration and get some user name.
So as you can see I was able to connect except I don't know the password I'm getting the user name but
I don't know the password.
So what are we gonna do right now is we're going to try to crack so password and to see if it's easy
to crack online or not before starting crack and I'm gonna use a very good tool called End crack.
I just need to create create a word list.
So I already created or list a small one
by the name of test.
60
and they wrote some password.
Now we're going to have a big discussion about creating a proper road list or download from the Internet.
Some effective August.
You know I mean this is a very simple one just a proof of concept but it's very important to get the
right toward this and you're gonna have a couple of lectures about it.
We are just now proving the concept so the list file is called.
Take a test to text you then what are going to do.
We can use this comment
which is incorrect now incorrect.
It's a very powerful tools that allow you to crack online passwords for different services.
So in my case the service that I'm using is remote desktop.
So we're gonna type and crack minus V which you mean verbose.
I mean it should it will show you what what the program is doing.
Minus F minus minus user and you have to put a valid user name.
Now what if you don't have a valid user name.
You can create a file that have the different common use an Administrator ADMIN wrote backup and so
on and then let me remove this plus or to be more clear for you.
Minus capital P and the word lists that have different password that you want to test on this remote
desktop so he should have user name or a list of user and you should have it text for files that include
different password the word list and then you put the protocol RTP and you put the IP then C and minus
one set equal on mean one time
or a try part time.
So this is the right center for using and correct.
Let's see what we'd be getting.
It may take time depend on the ordered list size so you know one of the orders that I'm going to recommend.
It's a very very popular one got around 14 million ordered lists.
And if you tries that for different users so it will take time but eventually it would get you the password.
So as you can see he checked and he told me that for RTP we have administrator and we have password
as a password so let's see if this really gonna work or not so I can do it from here.
Let me clear the screen
and let's use our desktop and it's open.
Let me try this password
she's the complex password.
And as you can see it went through so it's a very effective way except the trick here is to get a proper
ordered list.
I mean effectively you need to have ordered lists that include different combinations of four.
And this is not hard to prepare.
But if you've got like small or small list was like ten or twelve passwords maybe this will not work
in real scenarios.
So we're going to see how to create the proper orders.
Now let's get back to the comments that we just created.
And let's see what we can change.
I mean we did try on Windows Server 2003.
Can that work in 2008.
Yes it can.
Can I use this site the same tool to crack an etch TTP password.
Yes but you need to change here instead of RTP to be etch TTP.
So and crack is one of the common tool.
It's moved mainly or mostly used for remote desktop it's very very effective when it comes to remote
desktop.
So I want you to set up a machine and try this tool and then let's take another example.