Pass the hash is not a party game, nor is it a new attack if you aren't new in this field, you've
probably heard about it a lot about it.
It's ancient history, in fact, it dates back to 1997.
But it is still valid for Windows operating system.
Actually, it doesn't like a classic vulnerability that that I talked about earlier.
What do you want me to say it it just helps you authenticate a remote system with a hash.
So when you use this method, you don't need to crack or decrypt the hash.
I know what you're thinking at first, it doesn't make sense that you can use a Windows hasher authentication
remotely.
So let me clarify what I'm saying here with an example.
So let's assume that you've compromised a Windows machine by doing some fancy things and got an interpreter
shell with a system or administrative privileges, and naturally you're going to dump the same hashes
by using hash dump.
And I don't mean that you always gain access to a system through some exploits or by using interpretor.
In fact, you may extract hashes with other methods like AFG Dump, P.W. Dump or Kashdan shoulder,
sir.
Whatever way you accomplish it is fine.
I remember once I even detached the hard drive of a client's machine to get the hashes.
OK, so now you have the username and hash pairs.
So what is next?
If you're lucky, but especially if you have the time, you may know how to use rainbow tables to crack
the hash.
That doesn't seem unreasonable necessarily, but as I said before, and you'll hear me say it again
in a penetration test, time is a very important factor.
So at this point, let's talk about you and me, right, the human being.
Now, there are lots and lots of digital platforms out there.
And I don't know about you, there's all kinds of even articles published about it, but lots of people
use the exact same passwords for everything they have everything they belong to, every device they
own.
So.
Doesn't it make sense that they might share those credentials for their Windows authentication?
Therefore, you don't need to crack the hash.
And you will use it to check if the other targets on the network use the same hash and user pair.
Isn't there a tool for this?
Yes, there is a exact tool that's developed by Sess internals and this can check it for you so you
can use this tool to examine the network for which targets have the same user hash pair.
It uses the Windows File and print sharing service, which operates over the Protocol SMB to authenticate
to other target hosts in the network.
However, I think I even have a better solution.
MSF, your Swiss Army knife, if you will, of hacking, you can use the MSF Pesek module.
Now, one secret here that I want you to realize is this module, which is more stable than this is
internal stool also enables you to enter the password itself.
So if you are able to obtain and TLM password hash during your pen test, you can run the MSF exact
module.
So let's use it and see how it works.
So let's go back to the MSF council.
And let me choose the exact module.
Use XPoint.
Windows.
SMB.
He asked Zach.
Show me the options.
All right, so now you must set some variables, set our host to ten point ten to twelve for my Windows
seven machine.
Set our report to.
All right, our ports already said.
Set SMB user to vagrant.
SAT assembly passed to vagrant again.
OK, so you're allowed to use password hashes here, but you have cracked and got some clear text passwords
to write.
So then set payload to Windows Mature operator.
Reverse TCP.
Said Alehouse.
To your colleague IP address.
Said Airport two four four, four, five.
So let's check one more time, show the options.
Yeah, I think I've missed anything, so let's exploit.
So the module's quickly executed and this session is open, look at the who am I on the target and bring
the information about the target.
And sure enough, we are on the Windows seven machine.