Hey everybody welcome to the next video.
We're going to be talking about.
Pass the hash.
Now we've pulled hashes from the previous video.
We went over how to pull it for Linux and for Windows but for past the hash we're going to be looking
at just the Windows side.
This is a Windows baseball inability now what pass the hashes is that Windows has an issue where it
can take a password hash and use that to authenticate the user without the clear text password.
So we take a look here.
This is the output of hash dumped from the interpreter that we used before.
You can see that this part right here.
This is the full hash for administrator and this is the full hash for exploit me and guest and hunger
abuser.
So what we want to do is use something I'll pass the hash.
So there is a executable or binary on Kelly that comes with this called PCH dash when XY see it help
function.
So he can see you can do authentication with cobras as well.
So it's a very powerful tool and you can pretty much run whatever you want on the system.
So the first thing you can do is you want to use it.
So in this case we'll do administrator
and we'll do a percent sign and then what we're going to want is the password hash.
So go ahead.
Copy that
and notice that we're not using any password here.
And then we're gonna say what account.
What machine do we want to touch.
Two to one 680 111 which the machine we attacked before.
And then we're going to run CMT all you see.
So we go ahead and run this.
We should be prompted with our command line.
And here we are.
Who am I.
Administrator in the new IP config.
We can see we are 1 in 2 1 6 8 1 down 11.
This is perfect.
So we're a local admin on this machine and we've provided zero passwords none.
So this is just using the hash that we ripped off and we can log in this machine as many times as we
want without ever having to crack the password.
Now we have used.
We do know what the password is because we decided to actually look it up in memory and it happened
the user happen to be logged in.
But if the administrator was not logged in at that point in time then we could use the hash to log into
the system instead.
So we're going to clear that now.
We'll do another one in this case.
We're going to do the exploit me user just so you can show that we can do this with multiple users.
So we'll do exploit me percent sign and we'll go ahead and grab the hash for this user
and based.
So go ahead and run the same thing CMB Daddy XY and boom something failed.
Now what's important to understand here is the entry status access denied.
This error is referring to what Microsoft put in place to help beat pass the hash vulnerabilities.
And it does it well for the most part however it doesn't work for administrator accounts.
The reason being for the actual administrator account itself the reason being is because UAC user access
control is what's causing the problem.
Now if you were to disable or bypass UAC you could log in as this user.
Because it wouldn't prompt the user for the UAC prompt anymore but there are a multiple ways to do this.
You can do it through interpreter or you can do it manually by either bypassing it or turning off UAC.
We have administrative access.
The reason we might want to log in is a different user is because if the users part of a domain and
they happen to have access outside of this single system that the administrator does not we might be
able to leverage that a little bit further to move a little bit laterally up the domain chain.
But what I want you guys to do is take a little bit of time and research how to bypass UAC from an interpreter
standpoint and also manually manually bypassing is slightly more difficult.
So look at manually turning off UAC from the command line only only from the command line.
I'm talking about this type of command line not through a interpreter session.
Learn how to do with an interpreter because you always want to know the easy quick and resourceful way.
But knowing if you don't have a interpreter session available then you need to be able to do it inside
the regular command line just from the system itself.
So go ahead take a little bit of time learn how to do that on common Windows systems especially XP and
above or Vista and above you're going to run into UAC prompts for users.