Hey everyone, and thank you for joining me on Pluralsight to
learn more about lateral movement through the tool called
CrackMapExec. CrackMapExec is an open source project released
under the BSD‑2‑Clause license.
The creator of this tool is Marcello Salvati, who is going by the
handle Byt3Bl33d3r. Currently the tool is maintained by MPGN. Above
all, I want to thank them for their contribution to the community, and
I hope this course can showcase their work in such a way that others
can appreciate it as well.
In words of the creator,
CrackMapExec is a post‑exploitation tool that helps automate assessing the
security of large Active Directory networks. Built with stealth in mind,
CrackMapExec follows the concepts of living off the land, abusing built‑in
Active Directory features and protocols to achieve its functionality, and
allowing it to evade most endpoint protection, IDS, and IPS solutions.
CrackMapExec is a versatile tool written in and updated to work with
Python 3. It is useful for both red teamers and the defenders alike,
either to perform attacks on the network or simulate attack scenarios.
It is available through the package manager on Kali Linux or by
downloading it from the project's GitHub page here.
Operation instructions can also be found on the wiki
included on the GitHub project page.
Once you have retrieved the package,
all the independent packages will be downloaded and installed
during the installation process of this tool.
If you wish not to install from the source or directly onto your system,
you can also download a compiled binary or run it from a Docker image.
As a matter of fact,
the maintainer recommends to use the compiled version over the source. For
this demonstration, I will use the installation through the package manager,
as this is my preferred installation option.
All the other installation methods are equally smooth.
If you haven't picked up on this already,
CrackMapExec, henceforth referred to as CME, is a
post‑exploitation tool which allows you to map AD domains for
information regarding its structure, settings,
files, and users by using programs and protocols which are readily
available in the environment, gathering credentials for cracking and
executing tools on the compromised hosts.
One could almost say it's an AD networking, pen‑testing, Swiss Army knife.
At the end of this course,
you will know how to install the tool, map an AD network and its
shares, extract user credentials, and use the information gathered to
further your presence within the network.
Now, let's take a look at where CME stands on the cyber kill chain.
CME is mainly used to gather information in the Active Directory domain,
and with it, further your presence within the network.
With that, it would place CME firmly on the lateral movement category.
As the focus of CME is to allow extraction of information to gain
more credential access across the Windows AD domain, it would fall
within the Credential Access and Lateral Movement categories in
the MITRE ATT&CK framework.
One of the features that sets CME apart is that it is able to
spider the domain shares and its contents, allowing you to not
only look for accessible shares,
but also specific keywords within files available in those shares.
Once information has been gathered and more credentials have been collected,
you can leverage several techniques like WinRM or SMBExec to
execute commands on the target system.
With this, you can download and execute your bailouts or non‑binaries
on the system that can help you further your goals.
CME is also able to manipulate several security measures, allowing you
to execute Kerberoasting attacks, for example. In this course we will
look at the AS‑REP Roasting technique.
These are just a small part of what CME has to offer.
We will look through some of the other functions
during the demonstration, however,
these are the techniques we will be using on our target network.
I want to quickly go over how the tool came to be and how it
is used within the target infrastructure.
After that, we will dive into the demo and see in action what we have discussed.
CrackMapExec was inspired by three different tools of which Byt3Bl33d3r
thought were sub optimal at the time, so he took part of each tool and
created the initial version of what we have today.
The tools which led to the creation were CredCrack by
gojohnny, which allows for stealthy credential harvesting
over the AD network; SMBMap by Shawn D.
Evans, which leverages the SMB protocol to investigate resources
available; and SMBExec by Pentest Geek, which makes it possible to
execute files through the SMB protocol.
Since the creation of CME,
a lot of functionality has been added to aid in getting
the most out of the SMB protocol,
but also WinRM, MSSQL, and a little SSH, as Linux servers are
getting more common within company domains.
Now that we know the tool's inception and lifted the veil a little
on how it operates, let's quickly look at how the functions operate
within a Windows target environment.
CME allows a red teamer to abuse protocols available in the Windows
operating system to gather information on components in the domain
network like domain‑connected computers,
users, groups, and password hashes, in some cases,
even in clear text; file shares with access rights, and several
other things throughout a Windows AD domain.
In this scenario, we have obtained the credentials of a user from Finance.
With these credentials, CME allows us to escalate our privileges
through cracking password hashes or passing tickets,
allowing you to impersonate users within the domain and
even execute files on their behalf.
During this demonstration,
we will look for a user which has Kerberos pre‑authentication disabled.
Even though this is a relatively rare scenario within domains, as
pre‑authentication is turned on by default,
it allows us to retrieve the user's password hash for offline cracking.
Now, let's dive in.