In this demo,
we're going to leverage Abel to move laterally through the network
to access and control a target system remotely,
including sending commands to the system.
Abel will be used to gather credentials stored on the remote
system and run commands on the remote system and expand our
foothold across the targeted network.
We are going to start in our Windows attack system,
which has Cain running on it, and we're connected to the Globomantics network.
Let's go ahead and open Cain.
For this attack, we'll take advantage of both the Network and the Cracker tabs.
We will start with the Network tab,
which we'll leverage to deploy Abel to a remote system.
Expand out the Microsoft Windows Network and navigate to GLOBO‑PC‑01.
Use the credentials from our man‑in‑the‑middle attack,
and we will right‑click on the machine name and select Connect As option.
We will enter the username of user1 and the password of password and click OK.
Expand out the enumeration options and select Services.
Right‑click on Services and click on Install Abel.
Cain will now deploy the Abel executable to the GLOBO‑PC‑01 machine.
This is made possible because we're using the user1 account,
which is an administrator on the remote system.
After installation,
we will see that Abel has successfully deployed and is now a service running on
the remote system as you can see in our Cain Services list.
To start using Abel, minimize GLOBO‑PC‑01 from the Network list,
and then re‑expand GLOBO‑PC‑01.
We now see Abel has been added to the list of
options to use against the machine.
Let's explore some of the capabilities that we can take advantage of using Abel.
Expand out Abel,
and we'll see a number of options we can use to control our victim machine.
Let's use the console first.
The console will allow us to run commands remotely on the system as if we
were running them locally from the machine's command prompt.
Let's go ahead and create a new user account on GLOBO‑PC‑01 that we
can use to connect to the system in the future without raising
suspicion. We'll enter net user /add newuser password to create a new
user account named newuser, and then add the account to the local
administrator group on the system by entering net localgroup
administrators newuser /add.
We have now successfully create a user account we can use to
exploit our victim machine in the future.
Next, let's look at the hashes on the victim system.
We click on Hashes under the Abel options, which will allow us to view all
the password hashes for user accounts on the system.
This will allow us to eventually harvest user credentials from the victim.
We will click Yes to the prompt to include password history hashes. Here
we'll see a list of all the user accounts and their associated LanMan and
NTLM hashes for each password on the victim's machine.
This even includes the new user account we created called
newuser. This itadmin account looks interesting.
We right‑click on it and select Send to Cracker. Actually,
let's take full advantage of the tool and select Send All to Cracker so we
have the option to harvest all the credentials found on the machine. To
validate we have collected the hashes, we'll head to the Cracker tab.
Looking under the LM and NTLM hashes, we can see that all of the hashes are
now stored in Cain and available to crack and use to continue our attack in
the Globomantics network.
This will conclude our demo where we learned how to deploy Abel
remotely to a system and harvest credentials,
as well as control the system remotely from the console.