Now that we have the admin credentials,
we can start to do some interesting things.
For example, we can dump the hashed passwords for all the users of the computer.
In this way,
we can try to get the password for other users in the
machine and move laterally in the environment.
You might be wondering, but wait Ricardo,
how can Meterpreter get the passwords from all the users?
Well, yeah, the reality is that all the user passwords are stored in disk.
So, for example, when you log into your computer,
the operational system can validate if you are who you say you are.
But the operational system does not save the passwords in plain text.
Otherwise it would be too easy.
The operational system saves the passwords in an encrypted or hashed format.
In this way, we cannot easily view the password,
but that's why we have Meterpreter.
With this tool,
we can find the stored hashed passwords and then
generate a file with those hashes.
Then later,
we can use some offline brute force tools to try to
get the plain text passwords.
Pretty cool, right?
So, enough of talking,
let's go to our lab environment and see how to gather
password hashes from a Windows machine.
In here, we'll use the hashdump feature to capture the hashes.
Then, we'll crack those hashed passwords using the John the Ripper tool.
So, if you're ready, let's go to our virtual machine.
All right, welcome back to our lab environment.
In this last demo, I want to show you how to get password hashes with
Meterpreter and then how to crack them to get the plain text passwords. I
already have here a Meterpreter session to my victim computer.
And this session is running as administrator, otherwise
the hashdump command might not work.
So, all we have to do here is type hashdump. And that's it, nothing else.
When I press Enter, the Meterpreter tool collects all the
hashes for all the users in the computer and then returns it
to me here. Really easy, right? Now,
all I have to do is copy those hashes and then paste
them into a file in my desktop.
Perfect.
I also have here in my desktop a dictionary file
containing several common passwords.
Now, we can use any cracking tool to crack those hashes. I
personally like to use the hashcat, and the syntax is
something like this, hashcat, then the files that contain the hashes,
then the file that contains your dictionary of words, then ‑m to
specify the hash type, and in here I know that Meterpreter generates
hashes on the format code 1000, and then ‑‑force,
which you will ignore any warnings and just crack the password.
Once I execute that, hashcat will compare the list of words in the
dictionary with the hashes that we extracted. And this process
might take a few minutes, but thanks to some video editing this
will look like seconds for you.
Done.
There you go.
We got some plain text passwords.
As we can see, we were able to get the passwords for two accounts.
And if we cat the original hash files,
we can compare the original hash with a hash of this
output here. And here, we can see that we got the password
for the administrator account.
Really cool, right?
With this password,
we cannot remote desktop into the server and use it as we were the admins.
Amazing.
I hope you enjoyed this privilege escalation section. In my opinion,
this is one of the most important skills for a penetration tester.
But, before we go,
let's take a couple minutes just to review what you
learned here. First, you learned what are the main ways of
achieving privilege escalation.
Then we had a really interesting demo showing how to exploit
internal vulnerabilities with the Meterpreter tool.
Also, we exploited some internal misconfigurations,
which got as an admin shell to the target computer. And last,
but also really interesting, we used Meterpreter to dump the
password hashes for all the users of that machine.
In that way, we were able to retrieve the plain text password for a few users.
A lot of stuff, right?
So again,
I do recommend you practicing all those skills in your own lab, so
that you can get fluent in privilege escalation.
Awesome.
Now that we have admin privileges, it's time to create persistence.
In the next module,
you'll learn how to create hidden users and hidden scheduled tasks so
you can access your victim computer at any time.
So, I hope you're excited.
I'll see you in the next module.