WEBVTT

00:00:02.750 --> 00:00:03.460
In this demo,

00:00:03.460 --> 00:00:06.550
we're going to leverage Abel to move laterally through the network

00:00:06.710 --> 00:00:09.460
to access and control a target system remotely,

00:00:09.720 --> 00:00:12.050
including sending commands to the system.

00:00:12.050 --> 00:00:15.040
Abel will be used to gather credentials stored on the remote

00:00:15.040 --> 00:00:18.610
system and run commands on the remote system and expand our

00:00:18.610 --> 00:00:20.650
foothold across the targeted network.

00:00:21.540 --> 00:00:23.640
We are going to start in our Windows attack system,

00:00:23.640 --> 00:00:27.550
which has Cain running on it, and we're connected to the Globomantics network.

00:00:28.060 --> 00:00:30.700
Let's go ahead and open Cain.

00:00:30.700 --> 00:00:36.490
For this attack, we'll take advantage of both the Network and the Cracker tabs.

00:00:36.880 --> 00:00:38.490
We will start with the Network tab,

00:00:38.500 --> 00:00:41.990
which we'll leverage to deploy Abel to a remote system.

00:00:41.990 --> 00:00:46.470
Expand out the Microsoft Windows Network and navigate to GLOBO‑PC‑01.

00:00:46.950 --> 00:00:49.300
Use the credentials from our man‑in‑the‑middle attack,

00:00:49.300 --> 00:00:53.810
and we will right‑click on the machine name and select Connect As option.

00:00:54.030 --> 00:01:00.510
We will enter the username of user1 and the password of password and click OK.

00:01:00.510 --> 00:01:04.530
Expand out the enumeration options and select Services.

00:01:04.530 --> 00:01:08.850
Right‑click on Services and click on Install Abel.

00:01:08.850 --> 00:01:14.120
Cain will now deploy the Abel executable to the GLOBO‑PC‑01 machine.

00:01:14.120 --> 00:01:17.450
This is made possible because we're using the user1 account,

00:01:17.840 --> 00:01:20.140
which is an administrator on the remote system.

00:01:20.940 --> 00:01:22.130
After installation,

00:01:22.300 --> 00:01:26.750
we will see that Abel has successfully deployed and is now a service running on

00:01:26.750 --> 00:01:31.180
the remote system as you can see in our Cain Services list.

00:01:31.180 --> 00:01:36.120
To start using Abel, minimize GLOBO‑PC‑01 from the Network list,

00:01:36.120 --> 00:01:38.690
and then re‑expand GLOBO‑PC‑01.

00:01:38.690 --> 00:01:41.860
We now see Abel has been added to the list of

00:01:41.860 --> 00:01:43.980
options to use against the machine.

00:01:44.780 --> 00:01:49.080
Let's explore some of the capabilities that we can take advantage of using Abel.

00:01:50.640 --> 00:01:51.700
Expand out Abel,

00:01:51.710 --> 00:01:54.840
and we'll see a number of options we can use to control our victim machine.

00:01:55.200 --> 00:01:56.750
Let's use the console first.

00:01:57.140 --> 00:02:01.070
The console will allow us to run commands remotely on the system as if we

00:02:01.070 --> 00:02:03.650
were running them locally from the machine's command prompt.

00:02:04.140 --> 00:02:08.449
Let's go ahead and create a new user account on GLOBO‑PC‑01 that we

00:02:08.449 --> 00:02:11.740
can use to connect to the system in the future without raising

00:02:11.740 --> 00:02:18.770
suspicion. We'll enter net user /add newuser password to create a new

00:02:18.770 --> 00:02:23.610
user account named newuser, and then add the account to the local

00:02:23.610 --> 00:02:27.690
administrator group on the system by entering net localgroup

00:02:27.870 --> 00:02:30.990
administrators newuser /add.

00:02:33.240 --> 00:02:36.460
We have now successfully create a user account we can use to

00:02:36.460 --> 00:02:38.350
exploit our victim machine in the future.

00:02:38.940 --> 00:02:41.680
Next, let's look at the hashes on the victim system.

00:02:42.130 --> 00:02:46.080
We click on Hashes under the Abel options, which will allow us to view all

00:02:46.080 --> 00:02:49.150
the password hashes for user accounts on the system.

00:02:49.830 --> 00:02:52.990
This will allow us to eventually harvest user credentials from the victim.

00:02:53.440 --> 00:02:58.230
We will click Yes to the prompt to include password history hashes. Here

00:02:58.230 --> 00:03:02.200
we'll see a list of all the user accounts and their associated LanMan and

00:03:02.200 --> 00:03:05.850
NTLM hashes for each password on the victim's machine.

00:03:06.390 --> 00:03:09.080
This even includes the new user account we created called

00:03:09.080 --> 00:03:12.450
newuser. This itadmin account looks interesting.

00:03:13.040 --> 00:03:16.730
We right‑click on it and select Send to Cracker. Actually,

00:03:16.940 --> 00:03:21.000
let's take full advantage of the tool and select Send All to Cracker so we

00:03:21.000 --> 00:03:25.560
have the option to harvest all the credentials found on the machine. To

00:03:25.560 --> 00:03:28.990
validate we have collected the hashes, we'll head to the Cracker tab.

00:03:28.990 --> 00:03:34.870
Looking under the LM and NTLM hashes, we can see that all of the hashes are

00:03:34.870 --> 00:03:39.630
now stored in Cain and available to crack and use to continue our attack in

00:03:39.630 --> 00:03:40.910
the Globomantics network.

00:03:42.620 --> 00:03:46.040
This will conclude our demo where we learned how to deploy Abel

00:03:46.040 --> 00:03:48.950
remotely to a system and harvest credentials,

00:03:49.180 --> 00:03:51.950
as well as control the system remotely from the console.