In this last demo,
we'll cover how to use an open source tool to perform a Kerberoasting attack.
The idea here is exploiting a Windows vulnerability to get the
password hashes for some service accounts,
and for that we'll use an open source framework called PowerSploit.
This framework is implemented in PowerShell and has
several interesting attacks against domains.
In here, we'll cover just one of the features of this tool,
but if you're interested in PowerSploit,
we have here at Pluralsight some courses dedicated to this tool.
Once we have the password hashes for some service accounts,
we will then try to crack them to get plaintext passwords.
So, let's go to our lab environment and see how that's done.
Welcome back to our lab environment.
In here,
we'll use an open source tool to execute a Kerberoasting attack
and steal passwords from service accounts.
In this demo, I'll be using the PowerSploit framework,
which is a really well‑known PowerShell hacking tool.
So first let's download the source code of PowerSploit to our computer.
In here, I'm in the GitHub page of this project,
and to download the source code I just have to click on the button Code,
and then click on Download as a ZIP.
Oh, take a look,
Google Chrome knows that this is a hacking tool and is blocking the download.
And, again,
this is one of the problems of using out‑of‑the‑box tools, your
chances of being detected is really high, so we will have to figure
out a way to download to the machine.
In my case here, just to make things easier,
I will just disable the Google Chrome threat detection.
For that,
I'll go to the Settings menu, and then select the option Security and
Privacy, and then I will just disable the threat protection.
Perfect.
Now, let's download this again.
Okay, the download works, however,
now the Windows Defender is detecting this threat.
And, again, if we were trying to be stealthy in our red team engagement,
this would have ruined our plans.
In your case,
if you really decide to use out‑of‑the‑box tools in a target server,
you have to figure out a way of bypassing the antivirus,
and there are several ways of doing that.
For example, you could try to obfuscate the source code or encrypt the payload.
However, as this is out of the scope for this course,
I will simply disable the Windows Defender Antivirus
so we can proceed with the demo.
For that,
I'll go to the Windows Defender options and then disable the Real‑time analysis.
And this might require admin privileges,
so I will just type my credentials here.
And that's it, we should be able to do our attack now.
Let me quickly delete those files and re‑extract the PowerSploit here again.
Perfect, now we can start to use the tool.
For that, let me open PowerShell,
then go to my folder where my PowerSploit is located,
and then go to the folder Recon.
In here,
I will use the command Import‑Module to import the Recon module of PowerSploit.
Oh, take a look,
we are getting an error here because this file is not digitally signed and
our PowerShell policies only allow signed scripts to run.
And, again, because in here we're using a low‑level user,
we cannot simply change the execution policy. So what I have to do is
open a new PowerShell terminal as administrator,
then go to the Recon folder again, and then Set‑ExecutionPolicy as unrestricted.
Perfect, now we can try to import the Recon module again. Take a look,
we're still getting some warnings here, so I will just use the
option R to accept all the warning messages.
Then, we're finally ready to run our Kerberoasting attack. But
quick pause here, as you might have noticed,
we triggered a lot of alerts along the way, first the Google Chrome detection,
then the Windows Defender, then the PowerShell, and so on.
So remember, on a real red team engagement if you're trying to be stealthy,
I would suggest avoiding any kind of out‑of‑the‑box tools, and if you really
need to use those ready‑to‑use tools, you should not download them on your
target machine. And also, you can try to use some few defense evasion
techniques to try to avoid being detected.
Otherwise, those actions here will trigger tons of alerts.
Okay,
so let's run this Kerberoasting. To execute this attack, it's pretty
simple. We just have to type Invoke‑Kerberoast. And that's it, once I
press Enter, this script will do all the work for us.
You query for vulnerable accounts and send Kerberos request to get
hashed passwords of those accounts. As you can see here, we got the
hashes for a few accounts. Since we'll be using a tool called
hashcat to crack those hashes,
I will run the same command, but using the flag ‑OutputFormat and then
Hashcat. Also, to make it easier to digest this data,
I will select only the Hash field. Perfect, take a look. We have here a
table with three hashes that we can try to crack.
So now we have to save this into a file so then we
can try to crack them offline.
I will simply run the exact same command, but with the option
Export‑CSV, and I'll save this into a file called hashes.
Perfect, now let's take a look at the file that we just created.
As you can see here, we have three hashes, and since you'll be
using this as input for hashcat,
I will just clean up this file, like I will remove the headers and
also remove the double quotes from the hashes.
Okay, done, we're ready to crack this.
Now,
you can use any tool you want to crack this hash. In my case,
I generated this hash using the hashcat format, so I'll be
using the hashcat tool to crack it.
Since we'll be cracking those hashes offline, I'll copy those hashes
here to another machine so we can crack them there.
Take a look. To save us some time, I already put the hashes
into this file here in my Kali Linux machine. To crack the
passwords is really simple.
I will open the terminal and go to the Desktop folder.
It is in this folder that I have my hashes. And also, I have here a
file called dictionary, which is a file containing thousands of
common passwords that people usually use.
So, let's crack some Kerberos hashes. In here, I'll use
hashcat, then ‑m to indicate the hashtag that I'm using. In
our case, this is the type 13100, which is the Kerberos hashes.
And then I'll put the name of the files with the Kerberos
hashes and then the name of the file containing the
dictionary of passwords. And that's it.
That's all we need to crack those hashes.
Also, you don't have to memorize every single hash type number
in hashcat. This tool has a really good documentation, and you
can find that information in there.
So, since we have the command ready,
let's just run this. And this might take a few minutes, so to save us
some time I'll speed up this video. Take a look.
We were able to crack the passwords for two out of three accounts. Basically,
we got the passwords for the accounts MSSQL‑02 and MSSQL‑03.
Pretty cool, right? By using out‑of‑the‑box tools,
we quickly captured the hashes for a few accounts and we were able
to retrieve the passwords for those accounts.
And with that, we could even try to log into some servers with those accounts.
Amazing! We covered a lot of interesting stuff in this module,
but before we go,
let's quickly review what are you learned in here. First, we
discussed about the main techniques for Active Directory
enumeration and the types of information that can be
interesting during a red team engagement.
Then we had a few demos in which we enumerated domain information using
the Active Directory module and the ADSI interface.
And last, we had a really cool demo showing you how to get passwords
for service accounts using the Kerberoasting attack.