Hi and welcome to the Hacker House Hands
on Windows practical module.
We'll now go through all the practical measures
necessary to breach a Windows Enterprise Server
existing in our Windows manual.
We'll run through all the steps that are necessary here.
So you should see on the screen we have a virtual box
installation and we've imported an appliance.
Remember you'll need to import the appliance the same way we
did with our Unix appliance.
Just import the appliance and then you
should have a Windows environment there.
And you'll need to remember to change the Mac address,
re-initialize the Mac address, and then
to go into your network setting make sure it's
set to host only networking.
And then also double-check your USB settings,
as if you don't have a virtual box extension pack installed,
you might only have support for USB one point one.
And if you install the extension pack
you'll be able to use these newer USB standards
in your virtual machines.
But if you are getting errors, if there's some problem
and it won't turn on, double-check that USB setting
if you haven't got the extension pack.
So once we've imported this system,
we have everything set up, we should
be able to click play and basically boot up the--
boot up that machine, start windows normally.
And we should then get a machine--
Your machine might not give you that error
as you're booting up.
I think I may have closed mine earlier.
So once you've got this booted up,
you should see a familiar Windows guy on the screen.
That's the login screen that you see when you're presented
with a Windows desktop session.
So that's the Windows guy on the screen
when you get that log in box.
So what we're going to do now is we'll see in that subnet,
see if we can actually ping sweep through that subnet,
see if we can find that host, and see if it's
alive in the network anywhere.
You can see here, we've got an IP address--
a probe responding on one 192.168.56.5,
so I'll do 192.66.5.
So just by using [? m ?] map minus sp,
we can see what IP addresses are valid in a range
and what IP ranges are actually alive.
And you'll find that if we do a ping you in fact
maybe have a different IP address than mine,
but I can see that this Windows Server is existing there
on 192.168.56.5.
And if I was to simply run a end map against that IP address
we will then see a number of common service ports
and we should see something that's similar to a Windows
server footprint.
So I'm just going to leave that end map running
and see what kind of ports we get back.
And here we can see the Windows desktop waiting for somebody
to log in.
So I'll minimize that Windows desktop
and we'll look at this from a network perspective
to begin with.
So I'm running end map against that host,
but I'm also going to do m map minus st minus pp
minus vv minus on win dot tax minus ox win dot xml minus s
capital c to run my default scripts.
So I'm going to run my full three way handshake, my 65 k
ports scan, b verbose, store it in normal output,
store it in xml output, run all of the default scripts,
be aggressive in my testing, and then do minus--
and then supply the IP address of the server
that we're targeting, which is 192.168.56.5.
Disable DNS so that I don't waste time doing DNS lookups,
and I'll disable ping because I know the server is alive.
And here we can see that we're getting back ports much more
quickly now.
And if I go back to my other screen,
we can see that my standard n map has come back.
And we have what is known as a common footprint that looks
like a Windows server to me.
So you can see here there are a number of services
which we would associate with Microsoft Windows services.
You remember the common internet file system and server message
block and NetBIOS technology or Microsoft style PC
services 1 3 5 1 3 9 4 4 5.
The sub web services on here, and a [? curbral ?] service
which we would associate.
And also a domain service which we could do our domain
DNS testing against.
And then a couple of other further-up services, we
can see.
There's a remote desktop service, some LDAP service.
And these LDAP services indicate to me
the presence of perhaps a directory server in a Windows
network, so that would potentially
be in a domain controller of some sort.
So things like 6 3 6 and 3 8 9.
And we can also see there I've got
a number of high ports associated with Microsoft's RPC
services as well and an even another RPC service as well.
So lots of RPC services, so lots of things to probe on.
And now we've got this more comprehensive scan running.
So I'm going to go back here and look at my port scan output.
And I'll start with the domain.
You see a domain I'll try and do just
like I did before, I'll do my DNS probes against that server.
So if I do that chaos version dot bind,
I request my chaos subclass, what you've noticed here
is, the response has come back and it's actually
returned an internet facing address,
it's not returned to chaos subclass.
So actually it's a Microsoft DNS server.
It's still responding to that.
It's emulating the behavior of the chaos net internal vine
setting.
But it's actually returned a different record subnet--
a different record class.
But you can see here the DNS version information
that's being returned in that DNS query.
So you've got a lot of information in there.
So we could then try and do things like a transfer,
see if we can do a transfer against any other domains.
Sorry just transfer like that needs to supply a domain.
Let's try maybe local domain as an example.
It says transfer failed.
So I might need to find a domain that it might be a member of
and see if I can find out what that domain is.
I'll try maybe transfer a hacker house, it says transfer failed.
But it's trying to allow me-- because it's a TCP service,
it's allowing me to try domain zone transfers.
So I could try and copy any of the zone
files that it has by doing a zone transfer for any domain
that it might be authoritave for.
So that's interesting there's some domain services on there.
There's also a web service, when we see a web service by now
we should get fairly familiar with the idea
of going to the web service.
We can see this is a default internet information system
service seven, and then we could do our ?
probes, do our usual utilities, do our standardized assessment
activities against these ports and services.
You see we got ask dot net, we've got version information,
we've got some very standard headers.
It's not found any CGI directories.
We could force it to check those with minus c all.
It's actually a very recommended flag to use,
so you now make sure you're checking
all the possible directories.
You can see this scan's now taking a little bit of time.
It might take some time to finish
running some of these scans, but there are a number
of scans that we could use.
And indeed, if we look now, we've
got this curbral service which we'll look at in a minute.
But we've now got these RPC and the common internet filing
stuff that we saw before.
So if I was to go through this system now
and we'll try and look at some of those services
just like we did in our file server module,
we'll look at their net biased table scan
look at the actual input that we got from that table
if I run that with minus v you can see here I've
got a number of services.
I think if we recall number 20 was perhaps
the common internet filing service.
And there are a couple of other services here as well
that are associated with this service.
So we can see it's called Windows 2008.
And we have something called hacker house as a group.
And it has two service options, 0, 0, and 1C.
So it's possible that this might be joined to a domain called
Hacker House.
And if I was to do ENORM for Linux, this ENORM for Linux
will take advantage of various techniques
such as ridge cycling that it can use from the Samba
functionality to basically enumerate information off
the remote computer that includes things
like user lists, machine lists, and various others.
So if I was to type ENORM for Linux,
supply the IP address of that window server,
and see what information I can enumerate.
And I'll just click Control and C
so I can just scroll up for a second.
So we can see here that the NetBIOS tables the information,
we can see that the service number, 1B, was actually
a domain master browser.
1C indicated that this is in fact a domain controller,
and it's a member of the domain controllers
group for a domain called Hacker House.
And it's 0, 0 is telling you that it
belongs to the domain or workgroup Hacker House.
So we were able to identify that this is a server in a Windows
domain called Hacker House, and it's a member of a domain
controllers group.
And it also has the common internet file service,
the ability for us to upload and download files from it.
So again, we can see we could leave
this enumeration happening where it
would connect to that service.
And you see it's got this SID, or these identifiers.
Windows often uses different identifiers
for different things.
And as part of that, it will also use identifiers for users.
And as you can see now we're on this users thing,
it's doing a RID cycle.
And you see these RIDS here relate to the identities
of the user on the system.
So it's connecting and enumerating using a SID,
so it's enumerating the users on the domain SID that
have this valid RID ID.
So for instance here, you're seeing RID 500 has the username
HH Admin.
And this is quite common in that the local admin has
been renamed on the domain.
So the domain administrator account
isn't called domain admin, it's called HH admin,
which we could get from RID cycling
by simply starting at 500, 501, 502, 503,
probing that server when it allows us
to do this RID cycling process.
And you can see here some of these steps
have failed because it doesn't have the right permission.
It says NC status, access denied, you know,
SMB client access denied.
So you need to enumerate this kind of information
from systems.
And maybe the domain controllers might be fixed against this,
but maybe some of the systems might not.
So if I was to leave ENORM for Linux to run for some time,
it would actually try to enumerate various users,
try and tell me some information that might be of value to me
as an attacker.
So the next thing I can see now, I can see my NMAP scan
is completed.
And we've got a lot of information
that's come back from there.
So I'm going to run XSLT Proc, I'm
going to then feed in my Windows XML file,
pump it into my HTML file.
I'm now going to open that HTML file, inspect its contents,
and look at the table that we saw,
and go through some of the findings.
OK.
So looking through these findings
we can see here we found the IIS,
it's done some of that G4 enumeration,
some of those steps that we just took for ourselves,
enumerate inversion numbers, we can now
begin profiling those software packages for weaknesses.
You can see that it's requested the time on the server
from the [? Kerberos ?] service.
It's also found a Lightweight Directory Access
Protocol that belongs to the domain Hacker House.
And we'll look at that in a moment.
But also these Windows Server services, and then further down
we've got a fingerprint here that tells us exactly
that this is a Windows Server 2008, R2
standard build with Service Pack 1.
It's actually in an evaluation build,
which you're free to install and use for up to 30 days
from Microsoft.
And we've just basically installed it for you,
and added one or two programs.
So you're free to use this for evaluation purposes
for up to 90 days.
But you would need to license it to continue
using it beyond that.
So we've got Microsoft Windows RPC over HTTP,
we've got Microsoft Windows Active Directory LDAP.
We can see here we've got terminal services.
We've also got .net messaging framing.
So we've got some other services here to explore, and then all
of these RPC Services, which are related to RPC services exposed
on this port here.
And again, something to explore for vulnerabilities
as those RPC services, or any kind of missing patches.
So how could we do that?
How can we check this server for missing patches?
Well, we could use NMAP.
We can actually just run our NMAP NSC discover tool,
and what we would find in our NSC discover tool,
if we were to browse down to server message block,
we would actually find that there
are a number of server message block probes
and queries that we could perhaps use
to check for vulnerabilities.
And in fact, it will check for some of those very common
exploits I discussed, MSO [? 6025070290806717010. ?]
It will actually check for some of these common
vulnerabilities, and it will check for the presence
of some malware.
And you can actually use some of these vulnerabilities
and checks to check for various things.
And we can even do things like brute force
users on the system.
I would not advise you to stop brute forcing systems
when you're dealing with Windows Enterprise environments.
If you were to start brute forcing users on Windows
Enterprise environments, you would
find account lockout policies are in place.
So if you were to just scan an organization,
find a load of usernames, and start
trying to guess passwords for it-- what you might find
is you'll start locking those users out
of their workstations, preventing them
from being able to do their job, and impacting performance
and productivity at the company.
And you will, therefore, not be a very popular guy
when you come to explain the problems in the network.
So exercising care and caution against those kinds of things,
the only exception to that is the HH admin user,
because the domain admin user should not
be subject to the account lockout policies.
So you should be able to smash that [? rid ?] user that
has the [? rid ?] of 500, because it should never
get locked out.
So you should be able to hammer on that for as long
as you want.
So SMB and GNOME sessions-- you got
all these various enumeration tools
that we could use-- all these various MMAP scripts that
are basically bundled in MMAP.
And what we'll do is we'll actually leverage one of those.
You can see we've got various information's come back
from [INAUDIBLE] for Linux.
Some of that includes a grouping.
We found maybe one or two users.
We can see there's an administrator user.
These are the local users.
Again, remember we talked about local context and domain
context.
It looks like some of those users
there were actually some local users perhaps.
Yeah, these ones here in particular
appear to be windows 2008 administrator.
These are different users to the ones that we saw previously.
These users here are associated with the SID,
and that SID is the network SID.
It's the domain SID.
So this SID here relates to the workstation,
and it's actually queried the workstation.
And these are the users in the workstation,
and these are the users in the domain it knows about.
So it knows about various groups.
It knows about various users.
And it's gone down to 1,050, and it didn't find anymore.
But we could keep that running.
I'm going to give it a bigger number.
I'm just going to give it a larger number
to do the RID cycling on.
So I'll run [? enum ?] for Linux to see if it'll give me
any more users as well just by giving it enumerate users,
find RID cycling.
And instead of my range, I will do a slightly larger range.
And we'll start from 1,050, and we'll go up to maybe 5,000.
And we'll just try it out instead,
just to increase the number of RIDs sets that we can do--
that RID cycling that we can do.
And the SIDs relate to the network or the machine,
so here we go with five.
And we could just leave this running
and try to enumerate as many users
as we could to see if any of them
are valid on our workstation or on our server in case users
have been added or deleted.
And bingo, there we go.
We can actually see now we're enumerating all of the users
off the network.
We can see, here, we've got a backup user, Jenny A, Peter
K, John F, Jimmy's help desk, service admin, Trident, Claire,
Craig F. So here, we've got various users, local users,
set up on the domain, that we could
try to do some brute force attacks against.
We could try some password guessing.
I would never try and brute force hundreds of accounts,
as I've said before, but I might try Peter K, Peter K, John F,
John F. You know, maybe try some of these manually
just to see whether they would be anything.
And in particular things like help desk,
service admin, backup--
these kinds of uses-- the users that
are used for these kinds of things,
and not an individual's account, might have a rubbish password,
because they might be helpdesk helpdesk just for simplicity
at the organization, or they might be the company
name, or something like that.
So these kinds of accounts are probably
interested in helpdesk, service admin, and backup.
So I'm going to add those to a file called users.txt.
All right.
So I've got service admin, backup, and--
one more user we saw there-- helpdesk--
a couple of users that are of interest to me on the network.
So I could try and brute force their accounts,
their passwords, and that would be kind of interesting.
So we'll try that in a moment.
So, username enumeration.
So we've done our footprints, and we've
done our reconnaissance.
We do our enumeration.
We're doing our information leaks.
Now we're exploiting RID cycling on the domain
by getting the domain SID and then doing this RID cycling
process through those Windows Server services
to identify users that are present on the system.
And we have a list of users that we can now
start trying different attacks against,
so that's kind of useful.
And we also know another user that we
want to add on there is the hh admin user.
So here we have a Windows Server.
We can see here we've got-- we're now
going want to test it for missing patches,
and we've got a list of users.
And I'm going to show you how to use Nmap.
So I'll do Nmap minus st minus p445 at 139,
and I will also add at minus a to be aggressive.
And I will also do minus minus script equals SMB hyphen vuln.
And I'll do a star, because what I'm going to do
is I want this Nmap scan to just simply run all of those SMB
vulnerability checks against that server to tell me
if any of these missing patches are applicable to that system.
So I'm going to go, OK, run all these SMB vuln
checks against that particular system with the port number.
Set it to aggressive mode vb, and disable pings.
Try and speed the process up a little bit.
So we found the two ports and services.
We're connecting to those two ports and services,
and now the service scan is taking place.
And then my scripts will run, and each of those scripts
will then eventually try to assess
whether, in particular, missing patches are
missing from that system.
So we can see here that these scripts have run,
and it's checked various missing patches.
And it says that there are no missing
patches for various patches.
However, it's come up, and it said
there is most likely an SMB vulnerability called
MS 17010, which is a remote code execution
vulnerability in Microsoft server message [? block ?]
version one, which we could perhaps leverage to gain access
to this server.
So this is in fact that same exploit that we discussed
from the WannaCry attack.
And it's the one patch which is meant
to address four separate sets of exploits
and numerous vulnerabilities-- multiple vulnerabilities.
So if I was to run MSF console, we
could actually try to use MS 17010 to gain
privileged administrative access to this system
by running an exploit.
So I will do a search for MS 17010,
and we're going to use the EternalBlue exploit
from the FuzzBunch framework that
has been ported to Metasploit.
And I would not recommend you use FuzzBunch directly,
because, you know, if the Nsa really is the originator
of some of those tools, then I would personally--
if they were my tools--
put things in there that might allow me to recover them
or find out where they were being used.
So I would be exceptionally cautious about using
full blown frameworks with anti espionage
capabilities against my clients, so I
would recommend that you use--
perhaps take the things that you want from those tools
and add them to all the frameworks,
or get that capability, and add it in some other way.
So you've got a search there.
Use this exploit.
We're going to use this MS 17010 ported
by some very clever chaps at-- zerosum, I believe his name is.
And it's got a very detailed show information writeup.
You can see here there's a very detailed writeup,
and there's even an improved version of this exploit
that makes use of psexec which is significantly more reliable,
I believe.
And it actually has some slight improvements to it.
So we've got here these Groom Allocations.
And indeed it's actually attributed
to the shadow brokers and equation
group which is meant to be the NSA's red team.
So we've got their, you know, Groom Allocations, Groom Delta,
we've got these exploit attempts.
So if we were to do here-- set our host,
set the computer we wish to target, show options--
we could do here, set SMB, pass set SMB.
User, we don't need.
Show target.
We can see it's got [INAUDIBLE] targets.
We can see it's got a single target x64 all service
packs and Windows 7 and 2008.
So if I was to then say, OK, show payloads,
we're now presented with a set of Windows payloads,
and this time we noticed that there was Meterpreter
in previous payloads.
Instead of just running a shell, we're going to use Meterpreter.
Meterpreter is a little bit more of an advanced payload.
Instead of just giving you an interactive command shell,
it does a lot of more advanced capabilities
that allows you to do things like access
the web camera and other things.
And it's important for Windows systems,
because by default they don't actually get bundled with a way
to do transferring the files.
And in fact, when people use to hack them in the beginning,
you used to have to use TFTP, Trivial File Transfer Protocol.
You had to be really good at the command line with Windows.
It was a little bit of a complicated thing to do.
And again, pioneered by Polish researchers
at the last stage of delirium-- they
created a tool called WaSiM.
And WaSiM was an advanced payload management system
that allowed you to do much more advanced things on systems,
and Meterpreter is an evolution of that same thing.
It allows you to transfer files.
It allows you to do more advanced capabilities.
So if we were to do here, set payload Windows slash x 64,
slash reverse shell--
we'll do Meterpreter, sorry.
We're going to do Meterpreter reverse TCP.
Meterpreter reverse underscore TCP.
And we'll do show options, and I'll do set lhost.
Specify the listening host for which my interpreter session
is to set on.
Set lhost.
I'll set my old port to something
that won't look suspicious on the Network Monitor.
Do show options.
And then I'm ready to proceed with this exploit,
and we'll simply type run.
And what we should see now is this exploit
will try to set up various memory allocations at groom,
the heap allocation, and then cause
a use of some of that data to effectively jump
into an egg, where it will then track down.
And as we can see here, it's actually successfully
overwritten the EternalBlue exploit.
It was successfully completed, and then it
was able to use this use after free
and create a command shell, which then
says session has been opened.
And the researchers even mimicked the Ascii output
to say when just like it did in the original exploit.
So we now have a Meterpreter session,
and you can see the Meterpreter session
by typing question mark.
It gives us more access to that system.
It allows us to run some additional commands.
If I want to just get a shell on that system,
I can simply type shell, and I'm now
on the Windows command line.
And if I type who am I, you can see that that's
running as nc authority system.
So that's how a vulnerability like MS 17010
can be exploited to give you command execution to give you
the ability to run commands on a Window server
with full administrative rights.
So if I was to now set Control and C, terminate channel one--
no, I actually want to see if I can just background channel
one, so I'll do a background channel one.
And then I can also do help.
So I've got my shell there, and I've got various options.
And things I can do now include things
like capture the web camera--
enable things like start logging keystrokes,
start capturing key recordings, turn on the web camera--
do things like record the microphone of the computer,
listen in on the room, maybe start a chat session.
And some of these commands that you've got here
include things like hash dump.
When you see things like hash dump, what that means is-- it's
commonly known as dumping the SAM under Windows environments,
but it will actually use Meterpreter
to dump that SAM file.
Instead of me having to upload tools onto this box,
I should just be able to run hash dump
and get the hashes back from that domain.
And we can see here it done hash dump,
and we've actually been able to dump back all of the hashes
from the domain.
So we could then use these in a password-cracking utility,
so that's an example of using Meterpreter doing a hash dump.
And Meterpreter also allows us to load in other extensions.
It allows us to load in other tools,
so you can actually do something like load Mimikatz.
And you could get access to the Mimikatz commands here.
And Mimikatz allows us to do things
like get back plaintext passwords from different areas
of the Windows system, so we could do things
like SSP, for instance, ts package,
and actually see what some of the clear text
passwords of users--
who might have logged onto that system recently-- could be--
because they would be lingering around in memory
in an insecure way, and this tool is able to recover them.
And doing things like WDigest, and others,
would allow us to explore that.
Mimikatz has a whole load of additional capabilities,
and there's some reference guides--
commands on our reference guide for different options
of how to use it.
And indeed you can use it to generate
golden tickets and backdoor domain,
and we've given some examples of that there.
So we've got a command shell on the system.
Exploit it through a missing patch,
and we've been able to dump the SAM.
It doesn't always quite go as easily as that,
so I want to show you some of the processes and steps
that you might get.
It's very rare that you would just suddenly find
a domain controller vulnerable to MS 17010
pop that domain controller b system and get all the hashes.
Although, that wasn't the case until April when
that vulnerability was patched, but instead--
previous April-- but, you know, it was the case for somebody.
Somebody at the NSA would have been
able to run that tool, whenever they
liked, to access any windows system whenever they wanted.
So indeed, very powerful set of tools that they lost there.
We've got here the LDAP service.
We got various RPC services.
And I'll just show you a brute force attack, because I
want you to see how to do it.
But I want you to remember to exercise care and caution,
and not to trigger account lock out policies.
So I would try something like same user, same password,
or one password against the accounts.
I would never try more than one password
against multiple accounts.
So I will come out of this Meterpreter session
here, and just quit that for the moment,
because we can come back to that in a few moments.
I should have actually just backgrounded that.
We've got there the Windows Server service.
I'm not sure if I can just simply rerun that
exploit [INAUDIBLE] run again.
And you may find that, if this exploit fails,
sometimes it's a little unstable.
It can cause the box to become unresponsive,
and actually the second time it's
functioned just as effectively as well.
So I'm just going to background that session,
because I'll come back to it later.
So that's an example EternalBlue being used.
If you were to search MS 17010, you
would actually notice that the Show Info on this.
The ranking is average, and because the ranking is average,
that means that there's likely to be
some issues with the exploit.
It's not quite reliable.
It doesn't cause no problems.
There may be problems with it.
So having a look at it, we can see here
that it actually warns us it can cause system instability,
crash, and force reboots.
So you've got to be aware that-- when
you're using these kinds of attacks,
and you do this kind of things to systems and servers--
you might cause the server to reboot.
That would cause a lot of complications for the system
owner itself, so you need to ensure that you
exercise care and caution.
And when you're targeting something
like a domain controller, extra special care
should be applied, because you're not sure which
roles that it might have.
As a general rule of thumb, I've been
advised not to target primary domain controllers.
So locating the primary domain controller,
then target the secondary domain controllers.
However, it seems that might not be quite accurate
due to role delegation.
You could still cause complications
on the domain when the domain does propagation, and spreads
out, et cetera.
So you need to be cautious when you're
targeting domain controllers, as you
can disrupt the operation of not just that system,
but the entire network that depends upon it.
So it's important to remember that.
So, you know, usually you want to target a secondary server,
exploit the secondary server, exploit some other system.
Copy the usernames and passwords from it
like you did with hash dump, and then
use those usernames and passwords
to access the computer.
So let's show you how we can do that.
Let's access the computer with one
of those usernames and passwords.
So I'll run hashdump here.
And I want to be the admin user, so let's take
that NTLM challenge there.
And let's see if I can just log that in.
I'll copy that line from here, and I'll
background that session.
I'll do search ps exec.
So in here, we can see we've got ps exec,
so I'll do use exploit slash windows slash
SMB slash ps exec.
Show options.
Set rhost.
Set the remote hostname.
Set the SMB password.
I believe we should just set the NTLM hash in here.
And then I'll try SMB user to see if I can
add the username hacker house.
Show payloads.
And what I'm going to do is do Windows Meterpreter.
And you might find, sometimes, that payloads that you select
don't run, because antivirus has nailed them.
Antivirus can sometimes detect these kinds of attacks
and stop the payload from running on a remote system,
so we're going to try a Meterpreter reverse shell.
Reverse TCP.
Show options.
All right, Windows Meterpreter, reverse TCP.
And I'm going to connect it to me,
and I'll try this exploit here.
It says exploit failed.
Let me just try and see if it's because I shortened the hash.
So we can't actually seem to pass the hash of that user,
so what I'm going to do is I'm going
to try and pass the hash of another user from that list.
So I'll do my sessions minus i.
We can see here we've got sessions minus two hash
dump there.
So I'll try it for the next user in the list.
I'll try the backup user instead.
So I'll just copy that user's hash.
I don't know the user's password,
but if I was to simply copy that hash--
background this session now--
I'll do set SMB pass, specify that pass as the hash
that we've just supplied, SMB user of backup.
And now if I was to show my options,
double check that everything is set correctly,
and if I was to run that-- you can see now that we've actually
been able to authenticate that remote computer,
start a Meterpreter session, connect
back to the computer system without knowing
what that user's password was.
So that's an example of lateral movement.
Hack one computer, gain access to the hashes,
replay those hashes to another computer,
and hopefully gain some access.
Likewise, you could use tools like Mimikatz
to be able to try and do things, like, dump plaintext passwords,
and again stealing access tokens, and various others.
So we can see here that we are a user on the system.
Who am I?
I'm the NT authority system, because the backup user
seems to be powerful enough for me to get system shell rights
on that remote system, as well.
So we can have a look through here.
We can see we've got some other services, LDAP services.
LDAP search could be used to bind to an LDAP service,
allowing you to do things like query information
from the Lightweight Directory store.
Similar to what we saw in our VPN module,
this would be where that VPN was authenticating
against some kind of directory service, some kind of LDAP
system, that we might be able to abuse.
And here, we can see we've got terminal services.
So if I was to connect to terminal services,
I would use a tool like remmina, and we'll run remmina.
And we'll try to connect into this remote server
by supplying the IP address, simply typing connect.
Now you should hopefully then get
a login screen, similar to this, that
will allow you to interact with that workstation,
and here you've got an area where you could
try some brute force attacks.
Sadly, you can't pass the hash in the [INAUDIBLE] screen
and authenticate to the system, so it
would be awesome if you could.
But if you were to able to try and log in there as a backup,
for instance, you might be able to guess what
the password is for that user.
And I'm just going back here.
So lateral movement, stealing hashes,
and we've demonstrated missing patches, how
to enumerate information, do some RID cycling,
learn the presence of a domain.
We're now going to think a little bit more about Windows
directly.
I want to connect onto a system and show you some domain tools
for interrogating domains and doing things
like awareness of the network--
what systems are alive and well?
So yeah, we're on this domain here,
so I'm going to use some domain interrogation tools.
So I'll do NLTEST WAC domain, and I'll do a colon.
So that's a forward slash domain.
And then I would also allow it to do hacker.house to query
the hacker house domain.
So NL test slash DC list supplied the domain.
You see there we've got get list of domain controllers,
so I'll do dc list hacker house.
And what you can see here is it's
queried the network from this window server that's
joined to the domain.
And it says, giving me a list of domain controllers
for the hacker house domain.
And you can see here, this one has
been labeled as the primary domain controller,
because it's been indicated by a PBC.
Knocking down the primary domain controller
would be a bit of a bad thing to do.
So just generally-- although it's supposed to be able
to handle things like that--
I would still not recommend it.
You've got here, as well, various other tools
that you can use.
There are things like net users that you
can use to query users in the local workstation,
and also if you're on a joined domain computer
you could also do net users slash domain to query,
you know, whether there were users on that domain.
You could also do net group to query users
who exist in a group.
If you are on the system as well,
you could do [? dot ?] net group domain admins.
So if you're on a Windows computer joined to a domain,
you could actually do net group domain admins
and then add a forward slash and then a domain,
so you can actually query the domain itself to try and work
out what the admin users are.
And we can see they're both backup
and hh admin are in fact domain admin users,
so we could use that domain admin user and that backup
hash to authenticate to any computer joined to that domain.
And that's the concept of lateral movement--
to steal a token, or a resource, or a piece of information,
and use it to access another computer-- from one computer
to the next, just gathering breadcrumbs around a network
until you get the sufficient levels of rights.
And there are some advanced tools now
that can help you in that process.
I'd really recommend looking at a tool called BloodHound,
as I've used that quite extensively to find these kinds
of paths through a network.
But this is a very high level example.
We could do an entire course on Windows Enterprise.
This is just to give you an overview of some of the steps
that you would take.
So being able to interrogate the domain,
being able to query the information on the network--
what users exist there.
You can also do things like verify the trusts to verify
the users that are in place.
But we're now going to look at perhaps some privilege
escalations and some other elements of Windows testing.
So I'm going to actually log into the desktop now,
so I'm going to send Control, Alt, Delete.
And I'm going to make my life a little easier to show you this,
and I'm going to log in as backup.
And if you haven't guessed the backup password yet,
it was in fact backup.
It was intended to stimulate that gray matter of yours
and ensure that you were getting into the habit of trying
the same user, the same password.
Do it all the time because it works.
So here we can see.
You know, we've logged onto that system.
It says there was some kind of faults,
and we can now manage that system
through its familiar-looking desktop environment.
And you could then go down here to the PowerShell interface,
and actually, you know, run this PowerShell interface
as an administrator.
And if I was to do net user backup, for instance--
we have a look at the backup user.
And what I'll do is-- if I was to do net user--
net user WAC domain like that--
net user slash domain.
You've got backup Claire, Craig F, guest, help desk, hh admin,
Jenny A. So we can see here we can query all the users user
accounts for the server, and we can
see my user that's in there.
And what I want to do now is I want
to look for privilege escalation processes.
So although I'm an admin user, we're
just doing this from an admin user's perspective.
You could actually try and do it from a lower privileged cell
without giving it UAC rights and see
if you can get admin rights for this user.
So the user is in the admin groups as a domain admin user,
but we want to find a vulnerability on this host that
could be used to get admin rights that
isn't a missing patch.
So you could then run a tool like some PowerShell tools
to try and find some things.
And what I'm looking at here is if you look at the Services
tab, we can see there's a number of processes that will
run with elevated privileges.
So if you were to simply type services.mse or net
start, for instance, you would get a list of all the services
that are running on a system, and you
can have a look through these services
and see if any of those have any kind of vulnerabilities.
So here we can see we've got log on as a particular set of user,
and if we were to look in these listings
here we can see that there's a VNC server
setting that has been enabled for the backup user.
And it actually has some stored credentials, so that server--
that VNC service-- actually has a stored secret
for the backup user.
And we could try and dump the LSA cache
from a tool like Materpreter and [INAUDIBLE]
to see if we could find that password in memory somewhere.
So that's kind of useful to know.
So we would maybe search for that.
But we're already logged in as a backup user.
And if we scroll down, we see most
of these other systems running as local services,
learning as network services.
And then there's some here that are running as network system.
So if I was to, say, right click on one of these,
let's just say it's Active Directory,
and click properties, you can see here
that this will run this binary automatically on the computer.
And it will use the local system account to do it.
So what I would want to do is I want
to go through all of these services,
find all of the binaries that are being run
as the local system user, and see whether or not
I have any permissions to interact or change with them
in any way, shape, or form.
And obviously, that could be a very tedious process, right,
to manually go through all of these things
and try and find out whether they are vulnerabilities.
And before PowerShell, that's what we used to do.
We might write some scripts or write some executables,
but there was a lot of graphical reviews, a lot
of manual clicking around.
So PowerShell's really come along now.
If you're not familiar with PowerShell,
I'll give you a brief introduction to it.
Here you can see I've got the PowerShell prompts.
This basically is an object-orientated scripts
and language.
And commands are referred to as scriptlets.
So if you were to simply type something like, get help.
Get help, like this.
Get help, get child item, as an example.
Get child, get hyphen child item.
So get hyphen child item will actually
list out sub directories as a way of allowing
you to do kind of recursive queries and various others.
It's a scriptlet command that's been
added to the PowerShell engine so you can run that command.
And it's just basically various objects.
And all of these things here are referred to as objects.
So each of these things you can access and look
at different things of.
If you were to type get help, get hyphen child item,
you'd actually see here, just like the Unix main pages,
you can now actually look at these different commands,
see all the arguments, get a description,
and see what it does.
So it's bringing a Unix-like feel to Microsoft Windows
through the use of PowerShell and Headless technology.
And it's a big push for that organization
to be able to make use of PowerShell.
So if you've got PowerShell on your system,
the first thing you're going to want to do
is maybe load your own scripts in there.
So if I just go to the temp directory
on this computer, or the CD backslash root,
I'll go into the test directory, type dir in here.
You can see we've got PowerSploit.
PowerSploit is an excellent framework
that contains numerous persistence, exfiltration,
antivirus, bypassing, a useful number of PowerShell scripts,
including one we're going to look at in a moment.
And what we'll do is we'll do import module PowerSploit
dot PSM 1.
I try to import that PowerShell, and it says it cannot be loaded
because execution of scripts is disabled.
So we need to change the execution policy.
So we'll do set execution policy.
And we can see now that we can change the execution policy.
So I'll try to--
something like unrestricted.
And it now says the execution policy might expose you
to security risks.
Do you want to change it?
Yes, I do.
And it says here I cannot do it, because access is denied.
And the reason is because I can't change it system-wide
because I'm not a sufficiently privileged user.
But I could do execution policy, set execution policy
on restricted scope, assign that to my local process
so that I can now input files into my local process
despite the--
despite the PowerShell policy for not
trying to allow me to do that.
So I can now import that module.
I can import that PowerShell, that PowerSploit module,
and that will actually add more commands to PowerShell that
allows me to do things like invoke ACL scanner,
invoke all checks, invoke check local admin access,
invoke command invoke DLL injection.
There are various commands now that I
can use on the system to interact with it,
interrogate it further.
And I'm going to use invoke all checks,
because it's going to automatically check
through various privilege escalation opportunities,
including looking at all the service binaries
and finding any that might be of use to me.
So here we can see it's running various things.
It says this user's in the admin group.
We already know he's in the admin group.
But here, indeed, we've seen something
like a service permission.
And we can see here it says checking service executable
and argument permissions.
There is a VPN agent that says it has insecure permissions.
And I might be able to make misuse of that service.
So let's have a look at that.
Let's have a look at how that looks.
So if I was to go into this program files directory,
x86 Cisco, here we can see is a Cisco Any Connect secure
mobility client and a file called VPAagent.exe.
So if we were to look at that VPNAgent.exe,
we can't really see why this is a problem.
But if I was to do check ACLs against VPNAgent.exe,
what we can see here is we've got all users on this
computer..
Built-in users have full control over this binary.
Anti-authority has full control, administrators
have full control, and users have read-only access.
But they also have full control.
So anyone on the computer system can edit this file.
If we now look at the services binaries and go to the Cisco
Any Connect service and right click on properties,
we can see here that the path to the executable
is set to the same binary that we can change.
And it logs on and runs as the system account.
So that application runs with high privileges on the system,
and we have the ability to overwrite it, change it, do
things with it.
So we could now exploit that service
to get privilege escalation, to get admin rights on the system
using that automated tool.
And in fact, there's even a way of-- it even gives you there,
it says invoke service abuse.
You can actually just type minus name
and use this tool to then add a user to the computer.
So you see now it says it's created a user called John
with the password of 123!
which was added-- I've now added an admin user
to that system using that privilege escalation attack.
So that's an example of file permissions, insecure services
allowing for privilege escalation instead
of a missing patch.
A common way in which you might be
able to elevate privileges in a Windows domain or Windows
environment.
And I usually find most organizations
install something, a service or an antivirus or products
or a backup solution, that does something like that,
has some kind of weak service or a weak setting.
In fact, I found many a bug like that in my time.
So as an example now, we're back in as that admin user.
We're able to do administrative rights to the system.
So if we had a low-privileged user
and we found that VPN client again,
it's a VPN client source of privilege escalations,
good privilege escalation opportunity.
Always check through things like those.
So you would ignore kind of standard services
and try to look for new ones.
There's also a number of, like, out-of-date packages on here.
You could try a few other things out.
And I'm just going to show you one last thing, which
is MSF Venom.
So you can actually generate a standalone executable
as your payload to basically just generate
using a tool called MSF Venom You select the payload,
specify the arguments, just like you would from MSF
Console from your framework.
And you can actually export some of these files here.
And it says f format, so I'm going to do minus f.
And the format, the executable formats,
are different ASK, ELF, XE, PS, PowerShell VBA, different ways
in which you can generate these payloads for standalone use.
So if you were to try like this, and I'll just feed that
into a file called MSF.exe, you can see now I've tried to--
I've told it to generate an executable
with that payload in, and basically
spat that payload out to disk.
And we should now see, if I go back into here,
I can't close this file down here.
I should have an XE file created.
And we can see here we've now got this executable file, which
allows us to try to run these tools, that tool,
that Materpreter tool, by itself.
So one of the things we could do now
is we could perhaps do some file transfer.
So if we have a look at the file transfer,
we can see we've got things like get desktop, webcams,
et cetera.
So if I was to look for standard file system commands,
I could actually try to upload that file to the disk
somewhere.
So where am I currently, I'll type
personal working directory, which will probably not work.
So I will also then do CD--
let me see, this is a PWD command.
Current working directory shell.
Maybe if I do PWD.
It should print the working directory.
Doesn't seem to.
So CV backslash, maybe.
Again, doesn't seem to--
hmm, so if I tried to put, for instance, or upload,
it should allow me to upload a file from my local computer.
So I'll upload from HackerHouse/MSF.xe,
and then just see if it'll actually upload that file
for me.
You can see I'm having some trouble getting files
to upload through Materpreter.
And this was kind of a common problem.
But because I know it supports the common internet file
service, what I'll do is I'll just
mount a share on that system.
And the way I would do that is just like we
did in our file server module.
SMB client, minus l, list out is there anything on that server.
And I can't actually list anything
without a username or password.
So I'll now need to supply a username and password as well.
So I'm going to supply the username of backup.
And when it prompts me, I'll give it the backup password.
And we can see here that I can actually mount
a number of different files.
And indeed, one of them says I could mount the admin shares
or various others.
So if I do amount minus t sifts, then supply that UNC path
to the server, allow us to mount the c$,
perhaps and then I might need to escape that.
And I'll try amount/data minus 0 user equals backup.
Version equals 1.0.
I'm telling it to use server message block 1.0.
And here we can see that that server supports
server message block 1.0.
I've now got my data maps.
And I can actually upload and download files to disk.
So I'm going to copy from my root
folder, HackerHouse.MSF.xe.
I'm going to upload Materpreter to that system.
And if I type LS here, I can see I've got MSF.xe
on the root of that system.
And I'm going to do control and background for this.
And I'm now going to use exploit multi slash handler, show info.
And this is a standard handler that
allows you to manage payloads that you might want
to run manually by yourself.
If I then do show options, I could do sets, l sets,
payload, specify the payload that I've set,
which is the same one in Venom.
So Windows Materpreter, reverse_TCP, and this
is my client for making use of that binary.
So I could then do show options, set l host, specify an l host.
And then I am ready and good to go.
So if I just have a quick look at my MSF Venom output,
make sure I get the ports right, make sure
I use the same ports as I've used in my payload.
You can see I used port 443.
So I want to make sure that l port is 443.
And now if I type run on this, or exploit on this,
you can see that there's already bind handler running on 443.
So I'm going to kill that one.
And then run it again.
And still we've got a bind handler issue.
Sessions minus l.
And this is because my port is still listening.
I've still got something listening on port 443.
May well be that it's MetaSploit itself.
So maybe if I just exit with the active sessions,
tell it to kill all the active sessions,
it could well up in a job.
Did you see there were two jobs in the background there?
And one of them seems to still be running
and had an open port on open service port 443.
So if I was to go back to the c drive local disk,
you can actually see that that file's disappeared.
It was there, but it's no longer there.
And the reason why it might have disappeared
could be because of antivirus.
If I was to have a look again, just make sure is it there,
can I just not see it.
No, it has actually been deleted.
So you can see that that file has been deleted
from the remote computer.
And the reason is because it's detected it as a virus.
It's detected it as a malicious piece of software,
because it's running Microsoft Windows Defender.
You can see that it's picked up someone
is trying to run some kind of malicious software, perhaps.
There should be an alert in here.
It seems like there's got some sort of alert.
We could have a look.
We can see there, in fact, it's triggered this alert.
It says, Christ, you've got some viruses.
It's a Trojan.
It's a Trojan horse of some kind.
And that's kind of what Materpreter is.
It's kind of an advanced implant, or a advanced payload.
It's not really an advanced implant,
but a payload that gives you additional control
over a computer.
So we can't just run it on this computer.
We can get it on there by way of an exploit.
We need to get around that problem somehow.
So I'm going to do that by copying
a file off that computer, and infecting it with Materpreter,
and then sending that file back over.
So I'm going to do copy, Windows, system 32.
And I'm going to use calc.exe.
Even though we had a campaign, it's
a free calc of its evil virtues.
I've since found out that calc does evil things to children.
So we need to punish it some more.
So I'm going to copy that to the desktop.
And I'm going to use Shelter.
I'm going to type Shelter, which is a tool for injecting
and bypassing antivirus by merging
in Materpreter and payloads into another binary.
So here it says, OK, Shelter.
I'm going to say automatic.
I'm going to specify my p target as calc.exe.
It's now going to back up that file.
And what it's going to do is it's
going to say selected p is not a 32-bit image.
And it in fact only supports native two-bit images.
So I need a 32-bit binary to inject into.
OK, that's not a problem.
I'll go and get one from the web,
because I think this is a 64-bit system.
So I'm going to go undo.
Putty.exe, and I'm going to backdoor Putty
with my Materpreter.
So I'm just going to download the alternative binary.
I'm going to take a 32-bit Putty binary.
I'm going to download that to here.
And I'm now going to run Shelter on Putty instead.
So I'll go for automatic.
I'll give Putty.xe this time.
And you can see now it's worked out
that it can possibly use this binary for me,
and it's giving me some options.
It's done some disassembly, and it's
now trying to reverse-engineer some of that binary,
inject some hooks, and add in some malicious code that
will create a unique signature and should
bypass some inferior antivirus products.
It doesn't work particularly well
against products by Kaspersky and also sometimes by Symantec,
I believe.
Sometimes those with [? Heuristics ?] engines
or machine learning are much able to detect
some of this threat, whereas those
that do not have machine learning generally
do not spot it.
It's sufficient enough to get past a lot
of signature-based antivirus.
So we'll leave Shelter running.
It's going to run for a little bit of time.
It's going to disassemble this file.
And it should, hopefully, at the end of its execution,
after a few moments, then try to inject our Materpreter payload
into it.
So here we get first-stage filtering.
It now says, enable stealth mode.
I'll say, yeah, OK.
And I want to do OK, Materpreter reversed TCP stager, so I'll
say, OK, what does it say?
Use a listed payload.
Listed payload.
Select payload index.
I would do Materpreter reverse https normally.
But for our example, we'll use TCP.
Set my listening host-- well, set my listening host to 104.
Set my listening port.
Well, I'll make sure that that's one that's actually valid
this time.
So we'll do use exploit multi-handler.
Set payload windows slash Materpreter slash reverse
underscore TCP.
Set L host.
Set my listening host on this computer.
Set my listening port, 443.
Type run.
And you can see now that I've got jobs minus L. We've
actually got a job listening in the background that we can see
is actually a multi-handler waiting
for a payload connection from Materpreter.
So I'm running Shelter now.
We can see we've got this L port.
OK, I'll hit Return on there.
So we've now set up our putty executable.
It's done the injection, and it's now
created a verified injection.
And I now hit Return.
And in here, we can now see I've got
putty.exe, which should in fact contain my malicious code.
So I'm going to now copy that to the server.
And I find the John user on the system now.
I'm going to go back to the system.
Go back to that computer's disk drive.
And we can see that that putty executable is on there,
and the antivirus hasn't got rid of it
this time, because it's bypassed the antivirus.
And if I was to simply run that executable, what should happen
is I should receive a connection back on my Materpreter session,
and actually opens a new session, which I can then
interact with on that computer.
So I now have the ability to interact
with various things on the system, and I can do things
like webcam list, for instance.
And we'll see if John has a web camera on.
John appears to have a web camera on.
Let's see if we can take a picture of John
and see what John looks like.
So we'll try webcam snap.
And it didn't allow us to take a picture.
We weren't actually able to do it.
But you could use things like that.
Maybe we could turn John's microphone on and have a listen
to what's going on with John.
So that's an example of how you can use Materpreter, generate
it as a standalone payload, use it to bypass antivirus.
And then if you've got a way to pass the hash on the computer
to run a command, you could send your Materpreter command
to get more access to that computer
and use your [? hash dump ?] ping or the tasks on there
and do your post-exploitation lateral movement phases.
But again, you could do an entire course just
on Windows Enterprise Architecture.
So those are some of the basic steps--
enumeration, identification, querying the network.
And in our reference guide, we've
included numerous tools and tasks
that will be helpful to you when you're
breaching these kinds of systems and networks.
Things that you might want to run
or commands that you will want to try.
So that concludes the practical demonstrations
from this module.
One thing that is worthy of note as well
is that we're now going to do a password module.
You might want to keep some of the password
data from [? hash dump ?] from this module as part
of your next exercise.
So thank you very much for listening,
and I'll look forward to seeing you in the passwords module.
[MUSIC PLAYING]