WEBVTT 00:00:02.140 --> 00:00:05.820 Are you looking to leverage some of the same capabilities offered by Kali Linux, 00:00:05.830 --> 00:00:09.250 but on the Windows operating system, including cracking passwords? 00:00:09.640 --> 00:00:12.570 Hello, and welcome to Credential Access with Cain and Abel. 00:00:12.790 --> 00:00:13.810 I'm Jeff Stein, 00:00:13.900 --> 00:00:16.810 and in this course I will take you through how you can use Cain and Abel 00:00:16.810 --> 00:00:20.370 to take advantage of valid credential sets to impersonate legitimate 00:00:20.370 --> 00:00:22.660 users and move laterally through a network. 00:00:23.040 --> 00:00:23.590 Additionally, 00:00:23.590 --> 00:00:26.010 I will walk you through how you can use the tooling to manipulate 00:00:26.010 --> 00:00:29.360 network traffic and use the collected data to further your red 00:00:29.360 --> 00:00:31.740 teaming objectives towards exploitation, 00:00:31.920 --> 00:00:34.110 credential access, and lateral movement. 00:00:34.350 --> 00:00:38.250 Before we get started, let's jump into a quick overview of what Cain and Abel is. 00:00:39.240 --> 00:00:41.460 Cain and Abel is a tool for the Windows operating 00:00:41.460 --> 00:00:44.380 system created by Massimiliano Montoro, 00:00:44.610 --> 00:00:47.370 and I want to thank him for his work in developing the software. 00:00:47.840 --> 00:00:51.140 It has many different features, but originally was developed for simple 00:00:51.140 --> 00:00:55.030 password cracking. Over time as more features have been added, 00:00:55.030 --> 00:00:57.820 the main purpose of the software has continued to be to 00:00:57.820 --> 00:01:00.420 take advantage of different hacking techniques to exploit 00:01:00.420 --> 00:01:02.300 poor computer security practices, 00:01:02.330 --> 00:01:06.350 with the end goal focused on password recovery for ethical purposes. 00:01:06.940 --> 00:01:08.650 The tool is offered as a freeware, 00:01:08.790 --> 00:01:13.050 and while the product hasn't been updated since 2014 and the home page of 00:01:13.050 --> 00:01:16.990 the site hosting Cain and Abel went offline in mid‑2019, 00:01:17.190 --> 00:01:19.430 you can still find the software for download at the 00:01:19.430 --> 00:01:21.750 site archive on the Wayback Machine. 00:01:22.040 --> 00:01:24.280 In addition to the password cracking capabilities, 00:01:24.290 --> 00:01:27.520 which is arguably Cain and Abel's bread and butter, some of the 00:01:27.520 --> 00:01:29.440 features which we will cover in this course, 00:01:29.540 --> 00:01:31.420 which I think make the software special, 00:01:31.430 --> 00:01:34.310 are the ability of the tool to perform a man‑in‑the‑middle 00:01:34.310 --> 00:01:37.130 attack, as yet another way to access credentials, 00:01:37.270 --> 00:01:40.780 as well as the ability to extend Cain's functionality by using 00:01:40.790 --> 00:01:44.150 Abel on a vulnerable system to enable remote access and 00:01:44.150 --> 00:01:46.040 execution of commands on the system. 00:01:46.270 --> 00:01:49.210 Another thing to keep in mind with Cain and Abel is that while its 00:01:49.210 --> 00:01:52.190 creator has always advocated its use for ethical purposes, 00:01:52.440 --> 00:01:55.570 many antiviruses have classified the tools as malware, 00:01:55.580 --> 00:01:59.350 which you should keep in mind while running it on a system. You may need 00:01:59.350 --> 00:02:02.680 to bypass your antivirus software in order to take full advantage of the 00:02:02.680 --> 00:02:04.860 tools or even to install the software. 00:02:05.540 --> 00:02:08.669 Now that we have a good idea of how we will utilize Cain and Abel, 00:02:08.680 --> 00:02:11.360 let's take a look at where the software falls on the kill chain. 00:02:13.240 --> 00:02:15.440 If you are familiar with the cyber kill chain, 00:02:15.580 --> 00:02:19.610 you will see that the features of Cain can be used starting at the recon phase 00:02:19.820 --> 00:02:23.960 to identify potential networks and continue through exploit and onto the 00:02:23.960 --> 00:02:26.950 escalate phase where credentials are accessed by the tool. 00:02:27.440 --> 00:02:28.180 Additionally, 00:02:28.190 --> 00:02:32.360 you can extend your progress initiated by Cain into lateral movement by 00:02:32.360 --> 00:02:35.270 taking advantage of Abel's remote access capabilities. 00:02:36.240 --> 00:02:39.090 If we map the techniques we will learn during this course to the 00:02:39.090 --> 00:02:42.040 MITRE ATT&CK framework, we'll be covering two of the attack 00:02:42.040 --> 00:02:44.570 framework categories of credential access, 00:02:44.580 --> 00:02:48.640 including discovery and brute force with the password cracking sub‑technique, 00:02:49.010 --> 00:02:52.260 as well as command and control with remote access software. 00:02:52.840 --> 00:02:56.650 Now let's quickly review how our attack scenario will look with Cain and Abel. 00:02:57.040 --> 00:02:59.350 We will start by connecting to our victim network. 00:03:00.020 --> 00:03:00.850 In our scenario, 00:03:00.850 --> 00:03:04.100 this will be the network of Globomantics, an evil corporation 00:03:04.100 --> 00:03:06.160 which we will target for credential access. 00:03:06.640 --> 00:03:08.810 After performing some network reconnaissance, 00:03:08.820 --> 00:03:12.550 we will execute a man‑in‑the‑middle attack to gather credentials against a 00:03:12.550 --> 00:03:15.850 victim system connecting to the Globomantics internet server. 00:03:16.540 --> 00:03:18.280 Once we have exploit credentials, 00:03:18.290 --> 00:03:20.820 we will move laterally across our victim network, 00:03:21.060 --> 00:03:25.360 targeting additional assets on the network to control with Abel and continue 00:03:25.360 --> 00:03:27.970 accessing additional credentials to further our attack.