Scribd Logo
Upload

Welcome to Scribd!

  • 19 views

    Kali 105

    Uploaded by

    michal hana
    This document discusses password cracking and authentication methods. It explains that Windows stores password hashes rather than plain text passwords for security. Two common hash types are LM and NTLM, with NTLM being more secure. It also describes the technique of "passing the hash" to authenticate to a system using the hash instead of cracking the password. Defenses against this like enabling the Windows firewall and UAC are discussed. The document also introduces Mimikatz, a tool that can recover passwords in plain text from Windows processes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Kali 105

    Uploaded by

    michal hana
    19 views11 pages
    This document discusses password cracking and authentication methods. It explains that Windows stores password hashes rather than plain text passwords for security. Two common hash types are LM and NTLM, with NTLM being more secure. It also describes the technique of "passing the hash" to authenticate to a system using the hash instead of cracking the password. Defenses against this like enabling the Windows firewall and UAC are discussed. The document also introduces Mimikatz, a tool that can recover passwords in plain text from Windows processes.

    Original Description:

    kali

    Original Title

    kali 105

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses password cracking and authentication methods. It explains that Windows stores password hashes rather than plain text passwords for security. Two common hash types are LM and NTLM, with NTLM being more secure. It also describes the technique of "passing the hash" to authenticate to a system using the hash instead of cracking the password. Defenses against this like enabling the Windows firewall and UAC are discussed. The document also introduces Mimikatz, a tool that can recover passwords in plain text from Windows processes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    19 views11 pages

    Kali 105

    Uploaded by

    michal hana
    This document discusses password cracking and authentication methods. It explains that Windows stores password hashes rather than plain text passwords for security. Two common hash types are LM and NTLM, with NTLM being more secure. It also describes the technique of "passing the hash" to authenticate to a system using the hash instead of cracking the password. Defenses against this like enabling the Windows firewall and UAC are discussed. The document also introduces Mimikatz, a tool that can recover passwords in plain text from Windows processes.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 11

    passwords.

    Granted, these are Windows LM Hashes and not the more secure Windows 7/ Server 2008 NTLM
    based hashes.
    But, I believe that with cracking speeds increasing, relying on passwords alone may no longer be a
    good security measure. Many companies and government facilities are moving away from using just
    passwords alone to using dual authentication methods.
    Biometrics and smartcards are really becoming popular in secure facilities.

    Not sure what Kind of Hash you have?


    There are several different types of hashes. Sometimes you might be able to retrieve a password hash,
    but might not be able to determine what type it is. Hash ID will identify the type of hash that you
    provide it.
    Simply run Hash ID and input the Hash.
    The program will check it and return the most likely type of hash that you have along with least likely
    types.
    From the Kali Menu:
    Kali Linux/Password Attacks/Offline Attacks/Hash-Identifier
    Just paste in the hash and Hash ID will try to determine what type it is:

    Looking up Hashes in Kali


    Looking up hashes manually online is interesting, but it would be better just to do it from within Kali.
    Well, you can with “Find my hash”.
    (Just a note, I really didn’t have any luck recovering LM or NTLM passwords using “Find my
    hash”, which I thought was very odd, as one place it seemed to check is the Objectif Sécurité
    website.
    Not sure what is going on there, but it had no problem with MD5 hashes.)
    findmyhash <Encryption> -h hash

    Conclusion
    In this section we learned that computers do not store passwords in plain text in the system ’ s
    security database. The password is encrypted in some way and the resulting encrypted hash is
    recorded.
    We also learned that the Windows LM hash is not very secure and can be cracked very easily by
    using a simple lookup table or “Rainbow table” as it is sometimes called.
    If the LM hash cannot be found in one of the online databases, then a cracking program is needed.
    You can turn off LM hashing, but security researchers have found that many networked systems and
    programs still use them (even when turned off!) for backward compatibility.
    Chapter 17 – Pass the Hash
    Introduction
    In the previous section we looked at how insecure Windows LM based passwords can be, but what
    about NTLM based Passwords?
    Windows systems usually store the NTLM hash right along with LM hash, the NTLM hash being more
    secure. And as I mentioned, the LM hash can be turned off (or just use passwords longer than 14
    characters). But what a lot of people have asked me is how much longer would it take to access the
    user account, if only the NTLM hash was available?
    This is a great question, and the answer is, if certain circumstances are met and a certain technique is
    used, it could take the same amount of time.
    Let me explain, if you can retrieve the LM or NT hashes from a computer, you do not need to crack
    them. There is really no need. Sometimes you can simply take the hash as-is and use it as a token to
    access the system. This technique is called “Pass the Hash”.
    The Pass the Hash attack is not new, at the ever popular “BlackHat USA” conference last year there
    was a presentation called, “Still Passing the Hash 15 Years Later”. That should give you some idea
    how long this attack has been used.
    Though some of these attacks no longer work on updated systems. AV and patched Windows systems
    are catching some of the mechanisms used and blocking them. And networks set to use NTLM2 or
    Kerberos only defeat these kinds of attacks.
    Also the Windows User Account Control feature in Windows 7 blocks a lot of pass the hash type
    attacks that still work against Windows XP systems. But if UAC is disabled, as we will see later in
    this section, it could still work.
    But it is still worth a look at some of the Pash the Hash techniques.

    Passing the Hash with Psexec


    Probably one of the standby methods of passing the hash for years has been the psexec command.
    In this tutorial we will start with having an active remote session through Meterpreter.
    As you can see I typed the “sessions” command to view active sessions. There is only one, so I
    started an interactive session using the “sessions -i 1” command.
    I successfully connected with the Windows 7 session and lastly typed “getuid” to display the active
    user who was logged into the system, who in this case was “Ralf”.
    Now let’s get system level access so we can dump the hashes. This is done simply by running the
    Bypass UAC module discussed earlier in the book, but I will show the steps here:

    Good, the user Ralf was an administrator and the Bypass UAC function worked. It also dropped us
    automatically into session 2. Now we can just run the “getsystem” command to get system level
    credentials:

    As shown above, using the “getuid” command again we verify that we are indeed the user “System”.
    Now just type “hashdump” to recover the system hashes:
    This will list the password hints and more importantly, the password hashes:
    Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    Fred:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
    Alice:1001:aad3b435b51404eeaad3b435b51404ee:2e4dbf83aa056289935daea328977b20:::
    Bob:1002:aad3b435b51404eeaad3b435b51404ee:d6e0a7e89da72150d1152563f5b89dbe:::
    George:1003:aad3b435b51404eeaad3b435b51404ee:317a96a1018609c20b4ccb69718ad6e7:::
    Ralf:1004:aad3b435b51404eeaad3b435b51404ee:2e520e18228ad8ea4060017234af43b2:::

    As you can see we have the hashes for all of the users. Let’s see if we can connect to the Windows 7
    system as the user Administrator.
    We will use the SMB Psexc module to do this.
    1. Background the current session and type “use exploit/windows/smb/psexec”:

    If you want to see the options for this or any exploit remember you can “show options”.
    2. Type, “show options”:

    Alright, now we just need to set the IP address for the remote host (RHOST), the user name as
    SMPUser and use the hash as SMBPass.
    3. Type “set RHOST <TargetIPNumber>” and hit enter.
    4. Then type “set SMBUser Alice”:
    Okay we have the target system IP address set, and we have the user Alice selected. We just need to
    set the SMB password. This is where the magic starts. Instead of putting in a password, which we
    don’t know, we can just use the password hash!
    5. Type “set SMBPass” and copy and paste in her password hash, then press enter:

    (Paste in the entire hash as shown above. Leave out the user ID part of the user account a
    “1001:” in this case, and leave off the trailing three “:”’s at the end.)
    And the results?
    On an updated Windows 7 system with the UAC set to any level other than off, nothing happens! You
    get an Access Denied error message and no connection:

    But on a system that has UAC turned completely off, it is a different story:

    This is what happens in real life sometimes when testing security. What seems to be an opening just
    may not work. So you back up and try something else. In this case we were not able to get a shell with
    UAC enabled, but got it without problem with a system with UAC disabled.

    Passing the Hash Toolkit


    In Kali, the “Passing the Hash (PTH) Toolkit ” is a collection of ten utilities that allow you to use
    hashes to perform different functions. PTH was fairly recently added to Kali and can be opened from
    the menu:
    Kali Linux/Password Attacks/Passing the Hash
    Or in the file system at /usr/bin/:

    You can use the commands to do some pretty interesting things. We are not going to cover the
    command, but many of them may look similar to Windows users.
    Just use the help switch (--help) and you will get a help list of command options and uses:

    Though it is a bit beyond the scope of this book, the author of Pass the Hash Toolkit has some great
    write-ups on his site, including one on how to use the Pass the Hash WMIS command and Powershell
    to get a remote shell.
    (http://passing-the-hash.blogspot.com/2013/07/WMIS-PowerSploit-Shells.html)
    As seen below:
    And it works very well as you can see a remote session was created with the user (Alice) and
    password hash that was provided:

    Defending against Pass the Hash Attacks


    So what can be done to prevent these types of attacks?
    During testing I found that using the built in Windows firewall with the Windows 7 machine was a
    hindrance.
    I also found that many pass the hash type attacks would not work at all on Windows 7 if the User
    Account Control (UAC) setting was turned on to any level except “Never Notify”:
    The utility that many complained about in Windows Vista (and turned off!) actually does improve the
    security of your system.
    On Windows 7 systems, make sure that UAC is enabled and set to something other than “Never
    Notify”.
    Additionally, turning off LM and NTLM altogether and enabling NTLMv2 thwarted this attack. This
    was accomplished by setting the authentication level to “Send NTLMv2 response only\refuse LM &
    NTLM” in the system security policy.
    Next, one would wonder about just using Kerberos authentication. From what I saw, there seems to
    be no sure fire way to force Kerberos across the board. Also, many devices on a network still create
    and use LM/ NTLM hashes for backwards compatibility, so removing them completely from your
    network is still a task.
    Chapter 18 – Mimikatz Plain Text Passwords
    Introduction
    In this section we will look at recovering remote passwords in plain text.
    You read that right, plain text!
    I’ve communicated with Benjamin Delpy (aka Gentil Kiwi), the mastermind behind “Mimikatz”, on a
    couple occasions and he seems to be one of the nicest guys in the security community.
    I am not going to pretend that I understand exactly how he does what he does, but this master
    programmer has found that Windows stores passwords in plain text (!) in several locations in
    Windows processes.
    And he has found out how, with his programming wizardry, to pull them out.
    Mimikatz has been available as a stand-alone program for a while now, and has been added into the
    Metasploit Framework as a loadable Meterpreter module, making recovering passwords once you
    have a remote session incredibly easy.
    And did I mention the passwords are in plain text?

    Loading the Module


    We will start with an active Windows 7 System level remote shell in Meterpreter.
    (See the Chapter on Bypassing UAC to see how to go from an administrator level to system level
    account).

    We need to load in the mimikatz module, there is a 32 and 64 bit module, choose accordingly. For
    this section we will be using the 32 bit.

    1. At the Meterpreter prompt, type “load mimikatz”.


    2. Type “help” for a list of available commands:
    The help is pretty self-explanatory; basically type the corresponding command for the creds that you
    want to recover.
    So for Kerberos just type “kerberos” at the Meterpreter prompt. Or type “msv” to recover the hashes.
    Using these commands you can recover user passwords from multiple system sources - Windows
    Login passwords, MS Live passwords, terminal server passwords, etc.
    You can also use the “ mimikatz-command” to perform even more functions like retrieving stored
    credentials. But for now we are just interested in passwords.

    Recovering Hashes and Plain Text Passwords


    1. Type “msv”:

    And there you go - a list of the password hashes. Well, we could grab the hash and try to crack it, or
    run it through an online rainbow table, but what if we don’t have that kind of time?
    It would be nice just to get the password in plain text.
    Well, if the user has logged into the system, you can.
    2. Type “Kerberos”:

    You might also like