WEBVTT

00:00:02.140 --> 00:00:02.850
In this demo,

00:00:02.850 --> 00:00:05.150
we are going to leverage Cain to access system

00:00:05.150 --> 00:00:07.050
credentials from our victim system.

00:00:07.640 --> 00:00:10.200
We will do this by using our exploited system to gather

00:00:10.200 --> 00:00:13.340
valuable password hash information and then perform a

00:00:13.340 --> 00:00:15.640
cryptanalysis attack against the hash.

00:00:15.640 --> 00:00:18.460
We will then use the credentials to move laterally

00:00:18.460 --> 00:00:19.900
through the Globomantics network.

00:00:20.540 --> 00:00:23.000
We are going to start on our Windows attack system,

00:00:23.150 --> 00:00:27.250
which has Cain running on it, and we are connected to the Globomantics network.

00:00:27.840 --> 00:00:29.350
Let's go ahead and open Cain.

00:00:29.990 --> 00:00:34.250
For this attack, we will take advantage of both the Network and the Cracker tabs.

00:00:34.840 --> 00:00:36.790
We will start with the Network tab,

00:00:36.790 --> 00:00:40.320
and to use the credentials gathered during our man‑in‑the‑middle attack from

00:00:40.320 --> 00:00:44.600
GLOBO‑PC‑01 to target additional systems on the network.

00:00:44.600 --> 00:00:48.980
Expand out the Microsoft Network to navigate to GLOBO‑PC‑02.

00:00:48.980 --> 00:00:52.250
Using the credentials from our man‑in‑the‑middle attack,

00:00:52.640 --> 00:00:56.450
we will right‑click on the machine name and select the Connect As option.

00:00:57.030 --> 00:01:03.150
We will enter the username of user1 and the password of password, and click OK.

00:01:03.790 --> 00:01:06.780
Expand out the enumeration options and start to enumerate

00:01:06.780 --> 00:01:08.880
the groups and users on the machine.

00:01:09.540 --> 00:01:10.650
So far, so good.

00:01:11.470 --> 00:01:16.220
Now let's deploy Abel to the system similar to how we targeted GLOBO‑PC‑01.

00:01:17.120 --> 00:01:19.550
Select Services to start that process,

00:01:19.760 --> 00:01:22.470
and we see that we receive an Access is denied error.

00:01:23.340 --> 00:01:25.640
This is because while the credentials we captured during our

00:01:25.640 --> 00:01:29.810
man‑in‑the‑middle attack was a local administrator on GLOBO‑PC‑01,

00:01:30.300 --> 00:01:33.350
this is clearly not the case on the system we are targeting.

00:01:33.940 --> 00:01:37.360
We see, in addition to the user1 account on GLOBO‑PC‑02,

00:01:37.750 --> 00:01:39.750
there are 2 additional counts on the system,

00:01:40.240 --> 00:01:42.250
itadmin and user2.

00:01:43.350 --> 00:01:45.720
Let's move back to the Cracker tab to compare the

00:01:45.730 --> 00:01:49.570
NTLMcredential hashes we gathered from GLOBO‑PC‑01.

00:01:50.410 --> 00:01:53.210
Sure enough, we see that in addition to user1,

00:01:53.530 --> 00:01:55.510
both systems have a itadmin account.

00:01:56.420 --> 00:01:59.870
Let's see if we can crack the NTLM hash to take advantage of the

00:01:59.880 --> 00:02:03.150
itadmin account on the GLOBO‑PC‑02 system.

00:02:03.880 --> 00:02:05.970
Select itadmin and right‑click on it.

00:02:06.630 --> 00:02:09.740
Similar to our dictionary attack against the WPA handshake,

00:02:09.740 --> 00:02:13.240
we have a few options to try to crack the password for itadmin.

00:02:13.900 --> 00:02:16.270
This time, let's choose Cryptanalysis Attack,

00:02:16.660 --> 00:02:20.700
and then we will select NTLM Hashes, and select the RainbowCrack option.

00:02:21.630 --> 00:02:24.970
Cain will now open the cryptanalysis window and allow us to select

00:02:24.970 --> 00:02:27.690
a rainbow table to run against the NTLM hash.

00:02:28.190 --> 00:02:29.320
Click Add Table,

00:02:29.500 --> 00:02:31.180
and we'll select the rainbow table that I have

00:02:31.180 --> 00:02:32.860
built using the RainbowCrack tool.

00:02:33.400 --> 00:02:37.680
Click OK, and now we can start our cryptanalysis of the hash by clicking Start.

00:02:38.640 --> 00:02:41.260
Cain will now run through the pre‑computed hashes in the

00:02:41.260 --> 00:02:43.480
rainbow table to identify any matches.

00:02:44.410 --> 00:02:45.070
Sure enough,

00:02:45.070 --> 00:02:50.250
we have a match and now have gathered a password of it from the itadmin account.

00:02:51.240 --> 00:02:54.790
Let's now take those credentials back over to the GLOBO‑PC‑02

00:02:54.790 --> 00:02:58.350
system on the Network tab, and see if they allow us to further our

00:02:58.350 --> 00:03:00.200
lateral movement through the network.

00:03:01.500 --> 00:03:04.530
Click on the Network tab, and expand out the Microsoft Network

00:03:04.570 --> 00:03:08.860
to navigate to GLOBO‑PC‑02. Right‑click on the machine name,

00:03:08.990 --> 00:03:10.780
and select the Connect As option.

00:03:11.940 --> 00:03:17.850
We will enter the username of itadmin and the password of it, and click OK.

00:03:19.070 --> 00:03:23.970
Expand out the enumeration options and select Services This time we do not

00:03:23.970 --> 00:03:28.550
receive a denial error. Right‑click on Services, and click Deploy Abel.

00:03:29.210 --> 00:03:34.570
Success. The credentials work, and we can now leverage GLOBO‑PC‑02 to further

00:03:34.570 --> 00:03:40.000
our attack similar to our use of GLOBO‑PC‑01. This will conclude our demo in

00:03:40.000 --> 00:03:44.230
which we gathered additional credentials using a cryptanalysis attack to enable

00:03:44.230 --> 00:03:49.390
movement across the network using Abel from the GLOBO‑PC‑01 system to the

00:03:49.390 --> 00:03:50.450
GLOBO‑PC‑02 machine.