-: Escalation of Privileges, or I've got the power. 2 2
As we've worked our way through, 3 3
we have now performed our reconnaissance, 4 4
we've scanned and enumerated, we've gained our access, 5 5
and now we're trying to escalate our privileges. 6 6
We want to go from being a normal user to a system 7 7
level user and then eventually to a domain admin. 8 8
This is our fourth step of the hacking process. 9 9
It's our escalation of privileges. 10 10
We're gonna gain administrative system 11 11
or root access by escalating our account privileges. 12 12
After we've escalated our privileges, 13 13
the next thing we're gonna do is we're gonna have 14 14
full control over the network or system, 15 15
and we can gain administrative access over the work station, 16 16
and then expand out to the domain if possible. 17 17
This is gonna give us complete control of the network 18 18
where we can do whatever we want. 19 19
What are some methods of escalation? 20 20
Well, we can exploit an administrator 21 21
or a system to begin with. 22 22
We can steal passwords with keyloggers 23 23
or we can crack the password itself. 24 24
We can do that through the SAM database in Windows 25 25
or we can use the shadow database inside Linux. 26 26
In Windows, the passwords that 27 27
you have are stored as a binary encrypted hash. 28 28
When I go to log into Windows, 29 29
it actually hashes my password, 30 30
and then it compares it to the hash that it has stored. 31 31
If those two match, it then lets me into the system. 32 32
Now because it has this database, 33 33
the SAM database, if we can steal that database, 34 34
we can take it offline, and we could try 35 35
attacking it, and cracking it. 36 36
Why would we wanna do that offline 37 37
instead of just trying to fat-finger 38 38
and try to brute force our way into the system? 39 39
Well, most people have set up their systems now 40 40
so you can only attempt the password three times 41 41
and then it will lock you out for a certain amount of time. 42 42
For example, let's say that I'm trying to guess 43 43
the password for my user account. 44 44
I go in there and I type in one, 45 45
and then I type in two, and then I type in three. 46 46
Now I gotta wait 15 minutes and then I can try it again. 47 47
That can take me forever if I was trying 48 48
to guess the password password. 49 49
Instead what we do is we try to steal the database itself. 50 50
We could take it offline and then we can attack it 51 51
millions of times a second with a fast computer 52 52
and not have to worry about being locked out 53 53
because the system isn't being tested, 54 54
just the password to see if I've matched the encryption. 55 55
How do we steal that SAM database? 56 56
Well, one of the ways you can do it is physical access. 57 57
Physical access means I actually have, 58 58
I'm able to touch the machine I'm trying to attack. 59 59
If I get into the office and I can copy the SAM 60 60
using the NT Emergency Repair Disk, 61 61
or I reset the user password using NTFSDOS or LINNT, 62 62
then I can take that and just take that 63 63
password from the physical access. 64 64
Now if we're hacking remotely, 65 65
that's not gonna be an option for us. 66 66
In that case, we need logical access, 67 67
using something like Meterpreter 68 68
where we can do a hashdump. 69 69
Now once we have that hashdump, 70 70
we can then use that hashdump 71 71
to try to crack those passwords 72 72
and use something like Pwdump, 73 73
LCP, Ophcrack, or John the Ripper. 74 74
Lots of different password cracking tools out there 75 75
once we have this database that we can then compare to. 76 76
Now there's many different 77 77
authentication types used in Windows. 78 78
There's LANMAN authentication, 79 79
there's NT LANMAN authentication, 80 80
NT LANMAN v2 authentication, and Kerberos. 81 81
We're gonna talk about LM authentication. 82 82
LM authentication is LANMAN authentication. 83 83
It was used by Windows 95, 98, and ME. 84 84
It's based on DES, which is the data encryption standard, 85 85
making it very easy to crack. 86 86
DES is only 56-bits long, therefore most modern 87 87
computers can crack it fairly easy. 88 88
Now the reason why this is important 89 89
is it's still used for backwards compatibility 90 90
in some systems, so you may be able 91 91
to find some LANMAN passwords. 92 92
If you do, they're easy to crack, go and use those. 93 93
Because LANMAN had gotten kind of outdated 94 94
because of the sophistication of computers, 95 95
they upgraded it and it became NT LANMAN. 96 96
NT LANMAN was used in the Windows NT systems, 97 97
anything less than Service Pack 3. 98 98
Again, very old systems, but it is still used 99 99
some places for backwards compatibility. 100 100
This was based on DES again, so 56-bit keys, 101 101
as well as using a hash of MD4, 102 102
which again is very antiquated these days. 103 103
NTLM v2 is NT LANMAN version two. 104 104
It was used in Windows NT Service Pack 3 and beyond. 105 105
It was a replacement for the NT LANMAN 106 106
that again had become old and antiquated. 107 107
The newer version is Kerberos, 108 108
and Kerberos was actually started 109 109
in Windows 2000, and is still in use today. 110 110
It was used in Windows 8 and Windows 2012. 111 111
Now Windows 10 has moved on to a different system. 112 112
But up through Windows 8 and Windows 2012, 113 113
Kerberos was still what is being used, 114 114
so it's one of the more modern authentication methods. 115 115
Let's talk about LANMAN hashes work. 116 116
Well essentially, you have a password 117 117
and it's converted to all uppercases. 118 118
Let's use the code of LETMEIN. 119 119
The password is then padded with null, or blanks, 120 120
to make it 14 characters long. 121 121
So we have LETMEIN, and one, and then blank. 122 122
We have that string. 123 123
It's broken up into two sets of seven. 124 124
We have LETMEIN, and one, blank, blank, 125 125
blank, blank, blank, blank, blank. 126 126
Each of those parts is then encrypted separately. 127 127
We then push those back together with a kung-kay-shun 128 128
and that gives us what our LM hash is gonna be. 129 129
What is that gonna look like in the real world? 130 130
Well, here's a hashdump of a system. 131 131
Inside Meterpreter, we use the command hashdump. 132 132
It's part of the Metasploit Framework 133 133
and it allows us to collect the remote hashes off 134 134
that remote system using an interactive shell. 135 135
Notice here, we'll just run the hashdump 136 136
and we'll be able to get the system key back. 137 137
Here's what a hashdump looks like. 138 138
Notice we have the administrator. 139 139
He's a user 500 account and then we have his LM hash. 140 140
We have the guest. 141 141
He's a 501 account and his LM hashes. 142 142
HelpAssistant, SUPPORT, Bazinga, track, troll, 143 143
all those user accounts, all of those admin accounts, 144 144
and you'll see those accounts there with their LM hashes. 145 145
We can then take that information offline 146 146
and use something Ophcrack or John the Ripper 147 147
to then get the actual password from it. 148 148
Another way to collect the hashes 149 149
is using a program called L0phtcrack. 150 150
L0phtcrack is gonna be able to extract 151 151
the hashes from local or remote machines. 152 152
It also can sniff passwords 153 153
as they're going across the network. 154 154
So if I am locally on that network, 155 155
I can launch L0phtcrack, and I can start 156 156
copying those hashes as they're going 157 157
across the network, and then crack them using L0phtcrack. 158 158
Again, this is good if you're in the local network. 159 159
But if you're doing a remote exploitation, 160 160
something like hashdump with Metasploit 161 161
is gonna be more effective for you. 162 162
Another way of doing this is using a program like Pwdump. 163 163
Pwdump is a command-line tool that 164 164
can bypass the SYSKEY encryption of the SAM 165 165
if you have the admin rights already. 166 166
It can collect the hashes and store them as a text file. 167 167
Once you have them as a text file, that hashdump, 168 168
you can again go through and crack those passwords. 169 169
So what are some methods of actually cracking a password? 170 170
Well, one of the ways is dictionary, 171 171
another way is brute force, and another is hybrid. 172 172
What is a dictionary attack? 173 173
Well, a dictionary attack uses 174 174
a dictionary or word list to crack a password. 175 175
This is gonna be the quickest method 176 176
of doing it, but it's only as good as the dictionary I have. 177 177
So let's talk about this. 178 178
Let's say I have 1,000 words in my dictionary 179 179
and I'm trying to crack a password. 180 180
Well, what ends up happening is I take 181 181
the first word in the dictionary, 182 182
I encrypt it, I compare that encrypted hash 183 183
to the LANMAN hash I had stolen. 184 184
If they match, I know my password. 185 185
If not, I move on to the next one and I keep doing it. 186 186
This can take some actual time. 187 187
If I wanna do millions of millions 188 188
of passwords, this will take a long time. 189 189
So one of the ways we speed that up 190 190
is we use what's called a rainbow table. 191 191
What a rainbow table does is it's actually 192 192
a dictionary, but it's already pre-hashed. 193 193
So now I just compare hash to hash 194 194
instead of having to create the hash and compare the hash. 195 195
So that's one way to speed up a dictionary attack as well. 196 196
Another way to do this is what's called 197 197
a brute force attack. 198 198
Now, a Bruce force attack will find 199 199
the password every single time without fail. 200 200
The only problem is this can take forever. 201 201
So what ends up happening is it actually uses 202 202
random numbers and letters, and it will 203 203
actually start guessing passwords. 204 204
If I say I wanna check every password 205 205
up to eight characters, it's gonna start with A. 206 206
Then it's gonna go AA. 207 207
Then it's gonna go AB, AC, AD, 208 208
and keep going until it gets out to AAAA, AAAB, AAAC. 209 209
It will keep going until it finds it. 210 210
This can take hours, years, or decades 211 211
depending on how long and how complex the password is. 212 212
But it is 100% successful. 213 213
Now when I say a long time, there are some times 214 214
that a brute force attack can take you a billion years. 215 215
For instance, if you have a 16 character password 216 216
that's uppercase, and lowercase, has special characters 217 217
and numbers, that is gonna take millions of years 218 218
to crack with a standard computer. 219 219
A brute force attack is good if you 220 220
can kinda give it some parameters. 221 221
If I can say, "Hey, I know the password 222 222
"is gonna be between 14 and 16 characters," 223 223
that can help 'cause I can eliminate 224 224
having to do all the work up to 14 characters. 225 225
But again, it's still gonna take a long time. 226 226
Now, one of the ways I can do this better 227 227
is I can do what's called a hybrid attack. 228 228
This is where I take a dictionary list 229 229
and I can add some things to the beginning 230 230
or the end of it, or even in between it, 231 231
to work it a little bit better. 232 232
So this takes more time than a dictionary attack, 233 233
but less time than a brute force attack. 234 234
For example, if I thought the password 235 235
had something to do with password, 236 236
then I can use things like 1password, 237 237
or password123, or password but I replace 238 238
the As for at and the S is for dollar signs. 239 239
Those type of things are using a hybrid attack. 240 240
Where is this really helpful? 241 241
Well, if you did a good job in your 242 242
reconnaissance phase, and you know 243 243
some information about the person, most people tend 244 244
to pick passwords that are familiar to them. 245 245
Dogs' names, spouses' names, city they grew up in, 246 246
high schools, their favorite football team. 247 247
You start putting those things into your dictionary program 248 248
with a hybrid attack, it can start having some good results 249 249
and be able to find these complex passwords 250 250
that are based off something the person knows. 251 251
What are some of these password 252 252
cracking tools that are out there? 253 253
Well, one of the most popular ones 254 254
out there is called Cane and Able. 255 255
What Cane and Able is, it's a multipurpose tool 256 256
that performs password cracking, 257 257
Windows enumeration, and VOIP sniffing. 258 258
But we're really talking about 259 259
the password cracking portion here. 260 260
It can do dictionary attacks, it can do brute force attacks, 261 261
and it can do those rainbow table attacks. 262 262
The nice thing with the rainbow table 263 263
is that again, it's gonna speed up 264 264
those dictionaries and become the fastest method out there. 265 265
Now, what is this picture up here above my head? 266 266
Well, you'll see on the left side 267 267
it has length six, seven, eight, or nine. 268 268
That's the length of the password. 269 269
If I wanted to have every single possible password 270 270
out there that is up to six characters long, 271 271
that's about two gigabytes of text. 272 272
If I wanted all the way up through 273 273
nine characters, that's 60 terabytes of text. 274 274
So again most people, their passwords, 275 275
are up in the 12, 14, 16 characters. 276 276
You can see how large these text files are and how long 277 277
it's gonna take even with using a rainbow table, 278 278
which has pre-encrypted, pre-hashed information. 279 279
It's still gonna be tons and tons 280 280
of information and it will take a long long time. 281 281
That's why we say passwords and having strong passwords 282 282
is by far the most important thing in security. 283 283
Another one we have out there is John the Ripper. 284 284
Now, John the Ripper can crack 285 285
Kerberos, LANMAN hashes, and more. 286 286
The password that are cracked though, 287 287
they're not case-sensitive. 288 288
So if I come back and it cracks it, 289 289
and it says it's password, it could be all capital, 290 290
all lowercase, or a mixture of the two. 291 291
I don't really know, but at least 292 292
I've gotten it down into something reasonable. 293 293
Now the fact that I know that it's eight characters 294 294
and it has password as the letters, 295 295
I can start going through it and there's only 296 296
a couple of options, and I'll be able 297 297
to figure it out pretty quickly. 298 298
Ophcrack is another one that we have out there for 299 299
password cracking and this one is really 300 300
efficient because it uses rainbow tables, so it's very fast. 301 301
But again, those rainbow tables can be very large. 302 302
Like I said, if I had up to nine characters, 303 303
that means all the passwords between 304 304
zero and nine characters long, 305 305
every possible combination, there's 60 terabytes 306 306
of text out there to symbolize that. 307 307
What's one of the ways that we can do this faster? 308 308
The one I'm gonna use is Crackstation. 309 309
If you go to Crackstation.net, 310 310
it uses rainbow tables for fast 311 311
password cracking, but the nice thing 312 312
is it's all done on their servers. 313 313
For instance, if I take this LANMAN hash 314 314
on the screen, and I copy it, and I paste it 315 315
into Crackstation.net, what will I get? 316 316
Passphrasefloppy. 317 317
It comes back fairly quickly 318 318
and you'll be able to find that. 319 319
Now if instead I use that doing Ophcrack, 320 320
it could've taken minutes to hours 321 321
depending on where it was inside the rainbow table. 322 322
But by using it in Crackstation, 323 323
and using that cloud computing architecture they have, 324 324
it can come back much much quicker for me.