Passing NTLM
In the last section, we obtained an NTLM hash and cracked it.
Depending on the strength of the password this may be time-consuming or unfeasible.
In this section,
we’ll demonstrate how we can leverage an NTLM hash without cracking it.
In this demonstration, let’s assume that we’ve already gained access
to the FILES01 machine and obtained the password for the gunther user.
We want to extract the Administrator’s NTLM hash and use it to authenticate
to the FILES02 machine.
Our goal is to gain access to a restricted SMB share
and leverage pass-the-hash to obtain an interactive shell on FILES02.
We’ll assume that the local Administrator accounts on both machines,
FILES01 and FILES02, have the same password.
This is quite common and is often found in real-life assessments.
We’ll begin by connecting to FILES01 with RDP using the credentials of gunther.
We’ll then start Windows Explorer,
and enter the path of the SMB share in the navigation bar.
After entering the command,
we are prompted for credentials to connect to the share.
When we enter our credentials for the gunther user,
we are notified that Windows cannot access this share.
This means that the user account does not exist on FILES02
or it doesn’t have the necessary permissions to access the share.
Now, let’s obtain the NTLM hash of Administrator with Mimikatz,
as we did in the previous section.
Again, Mimikatz is located in tools on FILES01.
We’ll open a PowerShell window as Administrator and fire up Mimikatz.
Next, we’ll enter the commands privilege::debug,
token::elevate,
and lsadump::sam to retrieve the stored NTLM hash from the SAM.
The output displays the output of the NTLM hash extraction.
We’ll save the Administrator NTLM hash for later use.
To leverage pass-the-hash,
we need tools that support authentication with NTLM hashes.
Fortunately for us, we have many to choose from.
Let’s review a few examples for different use cases.
For SMB enumeration and management,
we can use smbclient or CrackMapExec.
We can also use NTLM hashes to not only connect to target systems with SMB,
but also via other protocols like RDP and _WinRM
For command execution, we can use the scripts from the impacket library
like psexec.py and wmiexec.py.
We can also use NTLM hashes to not only connect to target systems with SMB,
but also via other protocols like RDP and WinRM,
if the user has the required rights.
We can also use Mimikatz to conduct pass-the-hash as well.
Since the first goal of this demonstration is to gain access
to an SMB share by providing an NTLM hash,
we’ll use smbclient.
To use the command, we need to enter the path of the share
as the first argument by escaping the backslashes.
In this case, we will enter the FILES02 IP address and desired path.
We’ll use the -U option to set the user and --pw-nt-hash__ to indicate the hash.
After we successfully connect to the SMB share “secrets” with smbclient,
we can list all files in the SMB share with dir.
We can also use the get command to download files to our Kali machine.
We successfully connected to the SMB share
by providing the NTLM hash instead of a password.
The directory listing reveals a secrets.txt file.
After downloading the file we can view its contents.
In the first part of this demonstration
we used an NTLM hash to gain access to a SMB share.
In the second part, our goal is to obtain an interactive shell.
Again, we have a variety of different tools and scripts at our disposal
but here we’ll use the psexec.py script from the impacket library.
The script is very similar to the original Sysinternals PsExec command.
It searches for a writable share and uploads an executable file to it.
Then it registers the executable as a Windows service and starts it.
The desired result is often to obtain an interactive shell or code execution.
We can use the impacket-scripts package to execute psexec.py on Kali.
This package contains links to the example scripts
of the impacket library and provides a user- friendly way to use them.
To execute psexec, we can enter impacket-psexec with two arguments.
The first argument is -hashes,
which allows us to use NTLM hashes to authenticate to the target.
The format is “LMHash” colon “NTHash”,
in which we specify the Administrator NTLM hash after the colon.
Since we only use the NTLM hash,
we can fill the LMHash section with 32 0’s.
The second argument is the target definition in the format “username@ip”.
At the end of the command we could specify another argument,
which is used to determine which command psexec
should execute on the target system.
If we leave it empty, cmd.exe will be executed,
providing us with an interactive shell.
We successfully obtained an interactive shell on FILES02.
Due to the nature of psexec.py, we’ll always receive a shell as SYSTEM
instead of the user we used to authenticate.
We can also use one of the other impacket scripts like wmiexec.py
to obtain a shell as the user we used for authentication.
On Kali, we would use impacket-wmiexec
along with the arguments we used for impacket-psexec.
As the whoami output shows,
we obtained a shell as the Administrator user with wmiexec instead of SYSTEM.