WEBVTT

00:00:01.340 --> 00:00:03.500
All right, we're back to our lab environment.

00:00:03.500 --> 00:00:04.720
Before we go,

00:00:04.730 --> 00:00:07.540
I want to quickly show you a really cool feature from

00:00:07.540 --> 00:00:09.860
Impacket that can help you to build persistence.

00:00:10.940 --> 00:00:14.650
The idea in this demo is trying to get passwords from several accounts.

00:00:14.650 --> 00:00:17.280
So later, if you need to access the server,

00:00:17.290 --> 00:00:20.190
you have multiple credentials to try to log in.

00:00:20.190 --> 00:00:24.980
The Impacket framework has a really neat script called secretsdump.

00:00:24.980 --> 00:00:34.110
To use it, I will just execute python3 secretsdump.py and then the domain,

00:00:34.110 --> 00:00:36.060
username, and IP of the target.

00:00:38.540 --> 00:00:42.650
Remember, this Kenny account is an admin account on the target server,

00:00:43.040 --> 00:00:46.150
and we are assuming here that you already compromised the machine

00:00:46.160 --> 00:00:47.960
and that you're trying to create persistence.

00:00:49.340 --> 00:00:52.660
Once I run this, it'll ask me the password for the counter that I'm using.

00:00:53.240 --> 00:00:56.260
So let me type it, and that's it.

00:00:57.140 --> 00:01:00.370
This script will run several different techniques to extract

00:01:00.380 --> 00:01:02.590
password hashes from the target machine.

00:01:02.590 --> 00:01:06.230
For example, it will try to extract passwords from the same files.

00:01:06.230 --> 00:01:09.860
It will also try to do some Kerberoasting attacks and a

00:01:09.860 --> 00:01:11.760
few other hash‑harvesting techniques.

00:01:13.040 --> 00:01:14.320
Once the script has completed,

00:01:14.320 --> 00:01:17.450
we are left with tons of accounts and their hashes.

00:01:18.340 --> 00:01:21.160
All you have to do now is try to brute force those hashes

00:01:21.170 --> 00:01:24.500
using Hashcat or any other hash‑cracking tool.

00:01:24.500 --> 00:01:28.560
In this way, you might get the plaintext passwords for a few accounts.

00:01:28.590 --> 00:01:31.490
So even if this Kenny account is disabled,

00:01:31.500 --> 00:01:34.940
we'll still have a few other credentials to log into the domain.

00:01:34.940 --> 00:01:39.160
Pretty cool, right? And the best part, this password dumping

00:01:39.160 --> 00:01:42.420
tool was not detected by the antivirus. So we don't have to

00:01:42.420 --> 00:01:43.660
worry about being detected.