So I want to show you one more way of extracting password hashes from
an Active Directory. In here, we will use a technique called AS‑REP
Roasting, which usually works on retrieving hashes for legacy accounts
with some misconfigurations. And, again, Rubeus makes this type of
attack really simple.
All we have to do is use Rubeus.exe, then asreproast,
and the same options we used before,
which is the format being hashcat and the output file for my hashes.
Pretty simple, right? Once we run this, Rubeus will try to find misconfigured
accounts that do not require Kerberos preauthentication, and then we'll
retrieve those hash passwords for those accounts. And just like magic, take a
look, we got the hashes for two accounts,
the MSSQL‑03, which we already found before, and this ORACLE‑01 account,
which is actually a new account for us.
Really cool, right? And this attack worked because those
accounts had an insecure configuration enabled.
Take a look,
I'm here on the domain controller for Globomantics. If we take
a look at the properties for this account,
you note that they have this option enabled here called Do not require
Kerberos preauthentication. This misconfiguration is really common in legacy
accounts, and because of this flag, that allowed us to be able to extract the
hashes using the AS‑REP Roasting technique.
Anyways, let's go back to the victim machine.
The important thing is that now we have the hash passwords for those accounts.
All we have to do now is crack those hashes, and you can do that in any way
you want. Personally, I like to use the Kali Linux for that, so let me show
you how that works. I have here a Kali Linux machine. In this machine, I
already have the hashes from both attacks that we performed. To crack the
passwords is really simple.
I'll open the terminal and go to the Desktop folder.
It is in this folder that I have my hashes, and also I have here a
file called dictionary, which is a file containing thousands of
common passwords that people usually use.
So, okay, to crack this password I'll use this famous tool called
hashcat. And if you never heard about it before,
I definitely recommend you learning about it.
It is your best friend for cracking hashes.
So let's crack some Kerberos hashes. In here, I'll use hashcat, then
‑m to indicate the hashtag that I'm using. In our case, this is the
type 13100, which is the Kerberos hashes.
And then I'll put the name of the files with the Kerberos
hashes and then the name of the file containing the
dictionary of passwords. And that's it.
That's all we need to crack those hashes.
Also, you don't have to memorize every single hash type number in hashcat.
This too has a really good documentation, and you can
find that information in there.
So, since we have the comment ready,
let's just run this. And this might take a few minutes, so to
save us some time I'll speed up this video.
Take a look.
We were able to crack the passwords for two out of three accounts.
Basically, we got the passwords for the accounts MSSQL‑02 and MSSQL‑03.
So, let's just take notes of those passwords and let's try to crack the
other hashes, the ones from the AS‑REP roasting attack. In here, I'll
basically use the same command, but now I'll use the hash mode 18200,
which is for the AS‑REP format, and the file name is the one for the
AS‑REP roasting hashes.
And again, this might take a few minutes, so I'll speed up this video.
Perfect, take a look.
We were able to crack two accounts here, the MSSQL‑03,
which we already had the password for, and this ORACLE‑01,
which is a new account for us.
Pretty cool, right? So basically I have here all the accounts that we
were able to crack. As you can see, Globomantics doesn't use the
strongest passwords out there, so let's see if any of those accounts is
an admin account. For that, I'll go back to my Windows victim machine.
And now let's use the comment net user to test if any of those accounts
is an admin user.
First, the MSSQL‑02 account.
No, take a look, this is a regular user.
Let's try the next one, which is the MSSQL‑03 account.
Perfect, take a look, this is an administrator account.
We got it! Just to check, let's see if the ORACLE‑01 is also an admin account.
Perfect, this one is also an admin account.
This is really good for us.
This means that we have the username and password for
two admin accounts in the domain.
We can do whatever we want with that.
For example,
I can log into this server again using Remote Desktop, but now
instead of using my low‑level credentials,
I can use one of the admin credentials. And take a look, we're in, and
we are logged as ORACLE‑01 which is an administrator.
Really cool, right?.
And that's how I escalate privileges with Rubeus.