Description<\/h2>\n\nIn the previous challenge, you were able to retrieve password hashes of multiple local users on the machine FS2. While local users might not look as promising as domain users, chances are that you might still be able to abuse them for lateral movement.<\/p>\n<\/blockquote>\n
A vulnerability commonly observed in many infrastructures is something called password-reuse between multiple accounts on different systems. A good example of this is the local administrator account (which is present on all Windows systems by default), which might have the same password everywhere (or at least on some systems).<\/p>\n
We will now see how to efficiently check for password reuse for the recovered accounts in the Windows Attack Lab.<\/p>\n
Questions to Answer<\/h2>\n
Q1:<\/em><\/strong>
\nWhat is the vulnerability we are actually exploiting?<\/p>\nA1:<\/em><\/strong>
\nThe main vulnerability is the password reuse<\/code> . For the same account on the diffrent systems the same password is used.<\/p>\n
\nQ2:<\/em><\/strong>
\nHow can you efficiently check for password reuse across multiple systems?<\/p>\nA2:<\/em><\/strong> <\/p>\n\n- With
password spraying<\/code> it’s possible to check the password reuse over multiple systems (if passwords are known).
\ne.g. kerbrute:<\/em><\/li>\n<\/ul>\n\n.\/kerbrute passwordspray –dc 10.0.1.100 -d winattacklab.local users.txt Winter2019<\/p>\n<\/blockquote>\n
\n- Use of
CrackMapExec<\/code> if the the passwords are unknown but we have access to the NTLM hash (e.g. NTDS.dit)
\ne.g. CrackMapExec:<\/em><\/li>\n<\/ul>\n\n.\/cme smb 10.0.1.0\/24 –local-auth -u cme_users.txt -H cme_hashes.txt <\/p>\n<\/blockquote>\n
\nQ3:<\/em><\/strong>
\nWhat does CrackMapExec actually do under the hood?<\/p>\nA3:<\/em><\/strong>
\nCrackMapExec makes heavy use of the Impacket library and the PowerSploit Toolkit for working with network protocols and performing a variety of post-exploitation techniques.<\/p>\nIn our example below the toll performs the following tasks:<\/p>\n
\n.\/cme smb 10.0.1.0\/24 –local-auth -u cme_users.txt -H cme_hashes.txt <\/p>\n<\/blockquote>\n
\n- Scans the network
10.0.1.0\/24<\/code>for systems with SMB<\/code> (tcp\/445) running.<\/li>\n- For the detected systems the tool executes a
PTH<\/code> with the users(cme_users.txt) and hashes(cme_hashes.txt)<\/li>\n- Lists the successful
PTH<\/code> attempts<\/li>\n<\/ol>\nResults:<\/em>
\n![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/step13-1.png\")
<\/p>\n
\nQ4:<\/em><\/strong>
\nWith which user did manage to login to which target with what kind of credential (type & where did you get it from)?<\/p>\nA4:<\/em><\/strong> <\/p>\n\n- We get the NTLM hashes from the SAM dump on
FS2<\/code><\/li>\n- With the local
support<\/code> user we are able to access the WS1<\/code> with the NTLM hash(password-reuse<\/code>and PTH<\/code>)<\/li>\n<\/ol>\n
In the previous challenge, you were able to retrieve password hashes of multiple local users on the machine FS2. While local users might not look as promising as domain users, chances are that you might still be able to abuse them for lateral movement.<\/p>\n<\/blockquote>\n
A vulnerability commonly observed in many infrastructures is something called password-reuse between multiple accounts on different systems. A good example of this is the local administrator account (which is present on all Windows systems by default), which might have the same password everywhere (or at least on some systems).<\/p>\n
We will now see how to efficiently check for password reuse for the recovered accounts in the Windows Attack Lab.<\/p>\n
Questions to Answer<\/h2>\n
Q1:<\/em><\/strong> A1:<\/em><\/strong> Q2:<\/em><\/strong> A2:<\/em><\/strong> <\/p>\n .\/kerbrute passwordspray –dc 10.0.1.100 -d winattacklab.local users.txt Winter2019<\/p>\n<\/blockquote>\n .\/cme smb 10.0.1.0\/24 –local-auth -u cme_users.txt -H cme_hashes.txt <\/p>\n<\/blockquote>\n Q3:<\/em><\/strong> A3:<\/em><\/strong> In our example below the toll performs the following tasks:<\/p>\n .\/cme smb 10.0.1.0\/24 –local-auth -u cme_users.txt -H cme_hashes.txt <\/p>\n<\/blockquote>\n Results:<\/em> Q4:<\/em><\/strong> A4:<\/em><\/strong> <\/p>\n
\nWhat is the vulnerability we are actually exploiting?<\/p>\n
\nThe main vulnerability is the password reuse<\/code> . For the same account on the diffrent systems the same password is used.<\/p>\n
\n
\nHow can you efficiently check for password reuse across multiple systems?<\/p>\n\n
password spraying<\/code> it’s possible to check the password reuse over multiple systems (if passwords are known).
\ne.g. kerbrute:<\/em><\/li>\n<\/ul>\n\n
\n
CrackMapExec<\/code> if the the passwords are unknown but we have access to the NTLM hash (e.g. NTDS.dit)
\ne.g. CrackMapExec:<\/em><\/li>\n<\/ul>\n\n
\n
\nWhat does CrackMapExec actually do under the hood?<\/p>\n
\nCrackMapExec makes heavy use of the Impacket library and the PowerSploit Toolkit for working with network protocols and performing a variety of post-exploitation techniques.<\/p>\n\n
\n
10.0.1.0\/24<\/code>for systems with SMB<\/code> (tcp\/445) running.<\/li>\nPTH<\/code> with the users(cme_users.txt) and hashes(cme_hashes.txt)<\/li>\nPTH<\/code> attempts<\/li>\n<\/ol>\n
\n<\/p>\n
\n
\nWith which user did manage to login to which target with what kind of credential (type & where did you get it from)?<\/p>\n\n
FS2<\/code><\/li>\nsupport<\/code> user we are able to access the WS1<\/code> with the NTLM hash(password-reuse<\/code>and PTH<\/code>)<\/li>\n<\/ol>\n
![\"\"](\"https:\/\/cas.cybercop-training.ch\/wp-content\/uploads\/2021\/03\/step13-5.png\")
<\/p>\n