WEBVTT

00:00:01.590 --> 00:00:04.120
Now that we know how to use the ADRecon tool,

00:00:04.160 --> 00:00:07.720
I want to show you one interesting attack that we can perform with this tool.

00:00:08.740 --> 00:00:12.210
The ADRecon tool is able to perform a Kerberoast attack,

00:00:12.420 --> 00:00:16.010
which basically queries the domain for SPN service accounts and

00:00:16.010 --> 00:00:19.150
extracts the hash passwords from the Kerberos tickets.

00:00:20.120 --> 00:00:21.890
If you never heard about this attack before,

00:00:22.050 --> 00:00:24.190
just Google about it. It is a pretty cool attack.

00:00:25.240 --> 00:00:28.440
So I'm already here in the terminal, and I'm already using PowerShell.

00:00:28.440 --> 00:00:31.260
To get hash credentials from the service accounts,

00:00:31.330 --> 00:00:34.580
we need to execute the ADRecon script, but adding the

00:00:34.580 --> 00:00:38.550
‑Collect flag and specify the Kerberoast attack.

00:00:39.740 --> 00:00:42.870
Also, I want the results to be saved in the CSV format,

00:00:43.080 --> 00:00:48.270
so I'll put ‑OutputType and then CSV.

00:00:48.270 --> 00:00:49.610
Perfect.

00:00:49.710 --> 00:00:51.850
Now, all I have to do is to press Enter.

00:00:53.310 --> 00:00:56.320
And in just a few seconds we have a new CSV file created,

00:00:56.740 --> 00:00:57.950
so let's take a look at it.

00:00:58.480 --> 00:00:59.280
This new file,

00:00:59.320 --> 00:01:03.650
it is inside of the ADRecon folder and into this output folder here.

00:01:04.640 --> 00:01:09.350
In here, let's go to CSV results and open the Kerberoast file.

00:01:10.990 --> 00:01:11.370
Awesome.

00:01:11.370 --> 00:01:11.820
Take a look.

00:01:11.830 --> 00:01:15.650
We have here the name of the service accounts and the hashes in two formats.

00:01:16.240 --> 00:01:18.860
One is for the John the Ripper password cracking tool,

00:01:19.220 --> 00:01:22.050
and the other one is for the hashcat password cracking tool.

00:01:22.940 --> 00:01:25.050
All we have to do now is crack those hashes.

00:01:26.240 --> 00:01:28.950
So, let me copy those hashes for the hashcat tool.

00:01:30.440 --> 00:01:30.880
Perfect.

00:01:30.930 --> 00:01:31.310
Now,

00:01:31.370 --> 00:01:35.250
let me go to my Kali Linux virtual machine where I have all my writing tools.

00:01:36.640 --> 00:01:40.450
In here, I open the terminal, go to the Desktop folder,

00:01:41.640 --> 00:01:45.500
and save the hashes into a new file called gbm_hashes,

00:01:45.690 --> 00:01:47.850
which stands for Globomantics hashes.

00:01:51.130 --> 00:01:51.610
Perfect.

00:01:51.620 --> 00:01:53.140
We can check the content of the file now,

00:01:53.240 --> 00:01:54.650
just to make sure the hashes are there.

00:01:55.630 --> 00:01:56.050
Also,

00:01:56.060 --> 00:01:59.560
I have here a password list file containing several passwords

00:01:59.640 --> 00:02:01.750
that'll be used to crack the hashed passwords.

00:02:02.940 --> 00:02:03.440
Perfect.

00:02:03.460 --> 00:02:05.920
Now all I have to do is run the hashcat.

00:02:06.690 --> 00:02:11.250
For that, I will type hashcat and then ‑m to define the mode,

00:02:11.740 --> 00:02:15.350
or in other words, to specify the type of the hashes that we're trying to crack.

00:02:15.940 --> 00:02:18.700
It is pretty much impossible to memorize all the hashes from hashcat,

00:02:18.700 --> 00:02:22.950
so let me open my browser and Google hashcat modes.

00:02:24.700 --> 00:02:27.210
Then let me go to the first link, which is the official documentation.

00:02:28.390 --> 00:02:31.150
And here, let me search for the word Kerberos.

00:02:33.290 --> 00:02:36.150
As you can see, there are three types of Kerberos hashes here.

00:02:36.830 --> 00:02:43.150
If we take a look in _____ hashes, you see that they start with krb5tgs.

00:02:44.040 --> 00:02:48.760
Krb, it stands for Kerberos, 5 is the version of the Kerberos hash,

00:02:49.020 --> 00:02:51.640
and tgs is the type of hash.

00:02:52.440 --> 00:02:54.350
So let's take a look at the hashcat modes.

00:02:55.480 --> 00:02:55.830
Perfect.

00:02:55.830 --> 00:02:56.570
Here, take a look.

00:02:56.870 --> 00:03:02.920
The Kerberos TGS hash, and the code for this hash is 13100.

00:03:03.940 --> 00:03:06.750
So let's go back to the terminal and type this code in there.

00:03:08.540 --> 00:03:08.860
Cool.

00:03:08.870 --> 00:03:12.900
Now we need to put the name of the file containing the hashes and then the

00:03:12.900 --> 00:03:16.790
name of the file containing the password list. And that's it.

00:03:16.950 --> 00:03:17.850
Let's execute it.

00:03:19.640 --> 00:03:20.760
Oh, wait, take a look.

00:03:20.940 --> 00:03:21.910
We've got an error here.

00:03:22.090 --> 00:03:25.530
And this error is really common if you're using Kali Linux in a virtual machine.

00:03:26.040 --> 00:03:29.250
It basically says that it did not find any GPUs to run.

00:03:29.890 --> 00:03:33.180
So, we can ignore this error by using ‑‑force,

00:03:33.450 --> 00:03:36.680
which will tell hashcat to use my CPU instead of my GPU.

00:03:37.820 --> 00:03:39.000
So, let's start again.

00:03:39.440 --> 00:03:43.950
Let's use the same command, but let's use the flag ‑‑force.

00:03:45.040 --> 00:03:45.560
Perfect.

00:03:45.570 --> 00:03:46.810
Now, when I press Enter,

00:03:46.820 --> 00:03:50.840
hashcat will try to use the password list to find the clear text password

00:03:50.840 --> 00:03:53.450
for the hashes that we extracted with the ADRecon tool.

00:03:54.540 --> 00:03:57.200
After a few minutes, you see this, the hashes,

00:03:57.210 --> 00:04:00.690
and then column, and the plain text password.

00:04:00.690 --> 00:04:03.650
For this sql‑admin‑1 account,

00:04:03.830 --> 00:04:08.150
the clear text password is Secret123 and an exclamation mark.

00:04:10.140 --> 00:04:12.930
For this svc‑iis‑01 account,

00:04:12.930 --> 00:04:20.529
the password is alsoSecret123!. And for this svc‑iis‑02 account,

00:04:20.760 --> 00:04:25.770
the password isPassword123!. Pretty cool,

00:04:25.770 --> 00:04:26.110
right?

00:04:26.340 --> 00:04:27.220
Just in a few minutes,

00:04:27.250 --> 00:04:30.010
we're able to get the plain text passwords for those service accounts.

00:04:30.910 --> 00:04:32.950
So, let's try to use this first account.

00:04:33.710 --> 00:04:37.750
As you can see, it is used to log into this SQL‑SERVER‑01 machine.

00:04:38.680 --> 00:04:41.000
Since we have tons of information from ADRecon,

00:04:41.210 --> 00:04:43.050
let's take a look on what the server is.

00:04:43.840 --> 00:04:47.530
So let's go back to our Windows machine and open the

00:04:47.530 --> 00:04:49.140
report that I _____ in the previous demo.

00:04:51.990 --> 00:04:55.860
In here, let's go to the Computers tab, and in this list,

00:04:55.890 --> 00:04:59.390
I can see that this SQL‑SERVER‑01 machine is running Windows

00:04:59.390 --> 00:05:02.550
2008, and I even have the IP address here.

00:05:03.410 --> 00:05:03.840
Perfect.

00:05:03.930 --> 00:05:06.850
Now that I have the IP address, the username, and the password,

00:05:07.030 --> 00:05:09.550
let's use Remote Desktop to look into the server.

00:05:11.940 --> 00:05:15.950
So I type the IP here and I click on Connect.

00:05:17.040 --> 00:05:20.650
Here, Windows is asking which credentials I want to use to log into machine.

00:05:21.440 --> 00:05:23.220
Since I will use a different credential,

00:05:23.330 --> 00:05:27.450
I will go to the button More options and click on Use a different account.

00:05:28.800 --> 00:05:31.310
Now here I can type the credentials for the account

00:05:31.310 --> 00:05:34.450
that we just got the password, which is sql‑admin‑1,

00:05:35.090 --> 00:05:40.660
and the password isSecret123!. So, let's just click on OK,

00:05:41.390 --> 00:05:44.990
accept the certificate warning, and that's it.

00:05:45.210 --> 00:05:46.050
We're in the server.

00:05:46.480 --> 00:05:50.090
We can even open a prompt to check which user we are using here.

00:05:50.090 --> 00:05:53.330
And we can check the permissions for this user using the

00:05:53.330 --> 00:05:57.750
comment net user /domain sql‑admin‑1.

00:05:59.140 --> 00:06:02.450
As you can see here, this user is a local admin to the server.

00:06:03.320 --> 00:06:03.910
That's awesome.

00:06:04.070 --> 00:06:06.870
Just by using the ADRecon and some other techniques,

00:06:07.000 --> 00:06:10.190
we're able to get the hash passwords for a few accounts and use

00:06:10.190 --> 00:06:12.750
those accounts to get admin access to a server.

00:06:13.350 --> 00:06:14.150
Pretty cool, right?