In this demo,
we are going to leverage Cain to access system
credentials from our victim system.
We will do this by using our exploited system to gather
valuable password hash information and then perform a
cryptanalysis attack against the hash.
We will then use the credentials to move laterally
through the Globomantics network.
We are going to start on our Windows attack system,
which has Cain running on it, and we are connected to the Globomantics network.
Let's go ahead and open Cain.
For this attack, we will take advantage of both the Network and the Cracker tabs.
We will start with the Network tab,
and to use the credentials gathered during our man‑in‑the‑middle attack from
GLOBO‑PC‑01 to target additional systems on the network.
Expand out the Microsoft Network to navigate to GLOBO‑PC‑02.
Using the credentials from our man‑in‑the‑middle attack,
we will right‑click on the machine name and select the Connect As option.
We will enter the username of user1 and the password of password, and click OK.
Expand out the enumeration options and start to enumerate
the groups and users on the machine.
So far, so good.
Now let's deploy Abel to the system similar to how we targeted GLOBO‑PC‑01.
Select Services to start that process,
and we see that we receive an Access is denied error.
This is because while the credentials we captured during our
man‑in‑the‑middle attack was a local administrator on GLOBO‑PC‑01,
this is clearly not the case on the system we are targeting.
We see, in addition to the user1 account on GLOBO‑PC‑02,
there are 2 additional counts on the system,
itadmin and user2.
Let's move back to the Cracker tab to compare the
NTLMcredential hashes we gathered from GLOBO‑PC‑01.
Sure enough, we see that in addition to user1,
both systems have a itadmin account.
Let's see if we can crack the NTLM hash to take advantage of the
itadmin account on the GLOBO‑PC‑02 system.
Select itadmin and right‑click on it.
Similar to our dictionary attack against the WPA handshake,
we have a few options to try to crack the password for itadmin.
This time, let's choose Cryptanalysis Attack,
and then we will select NTLM Hashes, and select the RainbowCrack option.
Cain will now open the cryptanalysis window and allow us to select
a rainbow table to run against the NTLM hash.
Click Add Table,
and we'll select the rainbow table that I have
built using the RainbowCrack tool.
Click OK, and now we can start our cryptanalysis of the hash by clicking Start.
Cain will now run through the pre‑computed hashes in the
rainbow table to identify any matches.
Sure enough,
we have a match and now have gathered a password of it from the itadmin account.
Let's now take those credentials back over to the GLOBO‑PC‑02
system on the Network tab, and see if they allow us to further our
lateral movement through the network.
Click on the Network tab, and expand out the Microsoft Network
to navigate to GLOBO‑PC‑02. Right‑click on the machine name,
and select the Connect As option.
We will enter the username of itadmin and the password of it, and click OK.
Expand out the enumeration options and select Services This time we do not
receive a denial error. Right‑click on Services, and click Deploy Abel.
Success. The credentials work, and we can now leverage GLOBO‑PC‑02 to further
our attack similar to our use of GLOBO‑PC‑01. This will conclude our demo in
which we gathered additional credentials using a cryptanalysis attack to enable
movement across the network using Abel from the GLOBO‑PC‑01 system to the
GLOBO‑PC‑02 machine.