WEBVTT 00:00:01.540 --> 00:00:05.510 So I want to show you one more way of extracting password hashes from 00:00:05.510 --> 00:00:10.830 an Active Directory. In here, we will use a technique called AS‑REP 00:00:10.830 --> 00:00:15.550 Roasting, which usually works on retrieving hashes for legacy accounts 00:00:15.560 --> 00:00:20.260 with some misconfigurations. And, again, Rubeus makes this type of 00:00:20.260 --> 00:00:21.560 attack really simple. 00:00:22.140 --> 00:00:29.230 All we have to do is use Rubeus.exe, then asreproast, 00:00:29.230 --> 00:00:32.409 and the same options we used before, 00:00:32.540 --> 00:00:36.560 which is the format being hashcat and the output file for my hashes. 00:00:37.640 --> 00:00:42.120 Pretty simple, right? Once we run this, Rubeus will try to find misconfigured 00:00:42.120 --> 00:00:46.570 accounts that do not require Kerberos preauthentication, and then we'll 00:00:46.570 --> 00:00:51.940 retrieve those hash passwords for those accounts. And just like magic, take a 00:00:51.940 --> 00:00:53.860 look, we got the hashes for two accounts, 00:00:54.340 --> 00:01:00.950 the MSSQL‑03, which we already found before, and this ORACLE‑01 account, 00:01:01.340 --> 00:01:03.160 which is actually a new account for us. 00:01:04.140 --> 00:01:07.460 Really cool, right? And this attack worked because those 00:01:07.460 --> 00:01:09.860 accounts had an insecure configuration enabled. 00:01:10.540 --> 00:01:11.180 Take a look, 00:01:11.190 --> 00:01:14.550 I'm here on the domain controller for Globomantics. If we take 00:01:14.550 --> 00:01:16.690 a look at the properties for this account, 00:01:16.700 --> 00:01:21.320 you note that they have this option enabled here called Do not require 00:01:21.330 --> 00:01:26.620 Kerberos preauthentication. This misconfiguration is really common in legacy 00:01:26.620 --> 00:01:30.730 accounts, and because of this flag, that allowed us to be able to extract the 00:01:30.730 --> 00:01:33.660 hashes using the AS‑REP Roasting technique. 00:01:34.940 --> 00:01:36.950 Anyways, let's go back to the victim machine. 00:01:37.640 --> 00:01:41.750 The important thing is that now we have the hash passwords for those accounts. 00:01:42.540 --> 00:01:47.250 All we have to do now is crack those hashes, and you can do that in any way 00:01:47.250 --> 00:01:52.440 you want. Personally, I like to use the Kali Linux for that, so let me show 00:01:52.440 --> 00:01:58.450 you how that works. I have here a Kali Linux machine. In this machine, I 00:01:58.460 --> 00:02:03.080 already have the hashes from both attacks that we performed. To crack the 00:02:03.080 --> 00:02:04.660 passwords is really simple. 00:02:05.240 --> 00:02:08.759 I'll open the terminal and go to the Desktop folder. 00:02:10.440 --> 00:02:15.150 It is in this folder that I have my hashes, and also I have here a 00:02:15.150 --> 00:02:19.290 file called dictionary, which is a file containing thousands of 00:02:19.290 --> 00:02:21.260 common passwords that people usually use. 00:02:22.340 --> 00:02:25.930 So, okay, to crack this password I'll use this famous tool called 00:02:25.930 --> 00:02:28.820 hashcat. And if you never heard about it before, 00:02:28.830 --> 00:02:30.980 I definitely recommend you learning about it. 00:02:31.240 --> 00:02:33.260 It is your best friend for cracking hashes. 00:02:34.140 --> 00:02:39.980 So let's crack some Kerberos hashes. In here, I'll use hashcat, then 00:02:39.990 --> 00:02:45.650 ‑m to indicate the hashtag that I'm using. In our case, this is the 00:02:45.650 --> 00:02:50.160 type 13100, which is the Kerberos hashes. 00:02:51.240 --> 00:02:53.920 And then I'll put the name of the files with the Kerberos 00:02:53.920 --> 00:02:57.060 hashes and then the name of the file containing the 00:02:57.060 --> 00:03:00.440 dictionary of passwords. And that's it. 00:03:00.450 --> 00:03:02.360 That's all we need to crack those hashes. 00:03:03.040 --> 00:03:06.660 Also, you don't have to memorize every single hash type number in hashcat. 00:03:07.140 --> 00:03:09.930 This too has a really good documentation, and you can 00:03:09.930 --> 00:03:11.360 find that information in there. 00:03:12.140 --> 00:03:13.790 So, since we have the comment ready, 00:03:13.800 --> 00:03:18.410 let's just run this. And this might take a few minutes, so to 00:03:18.410 --> 00:03:20.360 save us some time I'll speed up this video. 00:03:23.240 --> 00:03:23.840 Take a look. 00:03:23.850 --> 00:03:27.160 We were able to crack the passwords for two out of three accounts. 00:03:28.040 --> 00:03:34.360 Basically, we got the passwords for the accounts MSSQL‑02 and MSSQL‑03. 00:03:35.440 --> 00:03:39.290 So, let's just take notes of those passwords and let's try to crack the 00:03:39.290 --> 00:03:44.290 other hashes, the ones from the AS‑REP roasting attack. In here, I'll 00:03:44.290 --> 00:03:49.920 basically use the same command, but now I'll use the hash mode 18200, 00:03:49.930 --> 00:03:54.480 which is for the AS‑REP format, and the file name is the one for the 00:03:54.490 --> 00:03:56.150 AS‑REP roasting hashes. 00:03:57.840 --> 00:04:01.160 And again, this might take a few minutes, so I'll speed up this video. 00:04:04.640 --> 00:04:05.740 Perfect, take a look. 00:04:05.750 --> 00:04:09.990 We were able to crack two accounts here, the MSSQL‑03, 00:04:10.030 --> 00:04:13.940 which we already had the password for, and this ORACLE‑01, 00:04:14.140 --> 00:04:15.560 which is a new account for us. 00:04:16.640 --> 00:04:20.350 Pretty cool, right? So basically I have here all the accounts that we 00:04:20.350 --> 00:04:24.400 were able to crack. As you can see, Globomantics doesn't use the 00:04:24.400 --> 00:04:28.690 strongest passwords out there, so let's see if any of those accounts is 00:04:28.690 --> 00:04:34.170 an admin account. For that, I'll go back to my Windows victim machine. 00:04:34.170 --> 00:04:40.040 And now let's use the comment net user to test if any of those accounts 00:04:40.070 --> 00:04:41.350 is an admin user. 00:04:42.640 --> 00:04:45.250 First, the MSSQL‑02 account. 00:04:46.640 --> 00:04:49.160 No, take a look, this is a regular user. 00:04:49.640 --> 00:04:53.150 Let's try the next one, which is the MSSQL‑03 account. 00:04:55.740 --> 00:04:58.110 Perfect, take a look, this is an administrator account. 00:04:58.190 --> 00:05:03.360 We got it! Just to check, let's see if the ORACLE‑01 is also an admin account. 00:05:05.440 --> 00:05:07.560 Perfect, this one is also an admin account. 00:05:07.940 --> 00:05:09.050 This is really good for us. 00:05:09.640 --> 00:05:12.340 This means that we have the username and password for 00:05:12.340 --> 00:05:14.050 two admin accounts in the domain. 00:05:14.640 --> 00:05:16.160 We can do whatever we want with that. 00:05:16.940 --> 00:05:17.510 For example, 00:05:17.520 --> 00:05:22.490 I can log into this server again using Remote Desktop, but now 00:05:22.490 --> 00:05:24.720 instead of using my low‑level credentials, 00:05:24.730 --> 00:05:32.690 I can use one of the admin credentials. And take a look, we're in, and 00:05:32.690 --> 00:05:36.260 we are logged as ORACLE‑01 which is an administrator. 00:05:37.340 --> 00:05:38.210 Really cool, right?. 00:05:38.480 --> 00:05:40.760 And that's how I escalate privileges with Rubeus.