Hey everybody welcome to the next video.
We're gonna be talking about pulling hashes from machines.
We're going to take a look at Windows and Linux.
Now on a Linux machine the common place you're going to find your hashes is under BTC past IBD.
Now if we go ahead and cut that out you're going to see here that we don't see any hashes now it's becoming
less and less common for admins to keep hashes in the past a midi file.
Instead they keep it in the ATC shadow file.
The way you can tell if an admin has the set up is a you're not going to find any hashes in here and
two you'll see an X where the password hash would be on older systems you will see it in the pass to
see past D newer systems ATC shadow.
So if we go ahead and look at that cat out EDC shadow we can see here that there are stars next this
which means there's not a password set for it but it doesn't mean you can log in with it.
What I want you to notice here is this is our password or our route machine.
So we copy this down rect preferably you'd want to copy the copy as entire Rochas machines are applications
such as John the Ripper and others will actually go ahead and use this and rip out the hashes for you
and try to correct them as you will.
Now keeping in mind that you're going to grab all of these from every system that you compromised because
you never know if somebody is using a weak password for something and it might be pretty nice to be
able to grab and gain access to three or four different accounts on the same machine.
So that also adds into the persistence factor where you don't have to worry about adding different types
of payloads or malware onto the machine you could just worry about having a valid username and password
SSA to the machine with.
So this is how you find it on Linux.
It's pretty straightforward and it's and it's pretty easy to look at but what I want to take you over
to is on Windows.
So right now we're going to be doing this with an interpreter session.
And what we're doing with the interpreter session can be done on the machine locally without an interpreter.
I'm just doing this for ease of use for you guys to get used to using maternal Ritter because it's a
very valuable tool.
I do recommend trying everything out manually especially on the windows machine such as moving over
binaries and actually running them and getting the getting the output yourself rather than using interpreter
because it's important to understand how to do things manually but also you don't need to reinvent the
wheel every single time either.
So I'm going to go ahead and execute a binary on our victim machine to get us a shell call.
So we've gone ahead and opened up and return bitter.
So if we go ahead and open up shell we can see this is indeed an admin base shell hostname.
Perfect.
Go ahead and get the shell.
So we got some return here and we're going to want to do first is attempt to load hashes from the system.
Now there's two things you can do.
You can load hashes from the machine or pull hashes from the machine and pull plaintext passwords that
are sitting in memory.
So the first thing we can do is we get our UI I.D. we can notice that we are administrator and to dump
hashes and medicinally or interpreter dump hashes or I'm sorry.
Hash stuff so you can see here we've got the administrative administrator hash the exploit me hash home
user group and the guest.
So what we can see here is that these two are probably the most important to us.
This looks like a different user that standard and we're always going to want the admin Hash again grab
this whole string and we're able to feed that into other parser cracking programs.
But let's take a let's take it this a step further.
What happens if we want to pull passwords from memory so somebody is actively logged in their past will
be stored and in clear in memory.
So we want to be able to grab those as well if we need to.
Because it's no point trying to crack a password if you can grab it.
The clear text right away.
So what we're going to be doing is going to loading a module called mini cats.
Now you can run many cats on the machine locally so there is a binary on Cally that you can move over
and copy over many cats and run it there.
And that's completely fine you can run it locally grown and the interpreter I'm going to show you how
to do it them interpreter but I also want you guys to take a step further and go ahead and try to use
interpreters upload function to go ahead and push it over and then use the shell interpreter to spawn
a shell execute it yourself.
It's always good to be able to know how to do things manually work with the executable itself.
So the first thing we're gonna do is we're going to go load maybe cats go and load that up.
Now remember we are the administrator right now so a lot of maybe cats command we're going to dash if
we're going to do Sam dump and we're gonna grab our hashes
slam dunk.
So you're going to see access is denied.
The reason for that is we are administrator and Paul hashes.
You need to be actually at the system level because of the way the Stam file is protected.
The Sam file has a special inclusive lock on it by the OS that doesn't allow anybody but system in a
certain process to access the same file while the machine is running.
That's why when you can get access to a physical machine and you can boot up a Linux OS over top of
it you're able to rip off the same file and use Sam dump on another machine to actually rip the hashes
out offline.
So what we're gonna do is or do get system since we're already administrator it doesn't take very much
to get to get the actual system level.
So if we get you 80 again we'll see we are indeed anti authority system.
So let's run Mimi Katz again and you can see but we've got her and tell them hashes for exploit me an
administrator same hashes we pulled up with hashed them but we're doing it with Mimi cats which can
be.
This is the same executable you can pull off and do manually of course you'll have to respond a shell
that is anti system which is very easy to do I'll leave that to you guys for a little bit of homework.
There's quite a few different ways to do it.
So let's go ahead and clear.
Not wanting to work for me.
We'll go ahead load up another maybe cats come in.
But this time we're gonna grab everything from memory so if we do SDK I'll say we're going to do search.
Passwords
and you can see here in memory it's found nine different instances of a username and password combination.
So administrator on exploit PPC has a password admin password which is correct and it doesn't matter
how complicated the password is if the user is logged in and you have admin rights on that machine you're
good to go.
You can even create a custom binary that runs automatically on startup that will respond back to your
server with usernames and passwords on machines actively and just have it run continuously on every
machine you compromised so that way you'll always grab anything net new from a user being logged into
a second user logs in your binary will look at it look in memory find something that's not new and go
ahead and transfer you over the password you do this on 10 or 15 machines eventually an admin is going
to take a look at that machine and what you can do even further is to fish the admin and make them think
that something's wrong with that machine or send some alert to that scene in the second that they log
in.
Now you've got their username and password and you can now start escalating privileges even further
and you can see we have a exploit me user with the password of password which is indeed correct.
So as you can see there's a lot of ways to pull hashes as well as the clear text password from the machine
but hashes are important.
Windows because there's something called past the hash which we're going to go over and another video
that you can use password hashes just like passwords on Windows systems.
So you just give it give it a password hash instead of the clear text password nibble authenticate you
just like it would if you gave it the clear text password which is very very powerful when you're looking
at this from an attack or a red team or perspective because you don't need them to be logged in as long
as their password hash is loaded on the system in the same file you are able to gain access to any other
machine that's using that same password for the same user.
So again it's very powerful.
Always always always always go ahead and grab the hashes and any clear text passwords on any machine
you can and then keep a running tab on them throughout the entire engagement.
Keep them secure.
More specifically if you're a contractor make sure they're in a secure location everything's approved
the location is stored as approved by the organization but if you're on an internal red team make sure
that they're on an approved space in there as well.
Just make sure everything's secure and nothing gets leaked.
And by the time you're done with the engagement you might have a few hundred hashes that you can work
with and then you can use patch the hash while passwords spraying on machines so you can combine the
two together and try to find out which machines you can log into with past Ash.