WEBVTT 00:00:00.640 --> 00:00:03.840 Hey everyone, and thank you for joining me on Pluralsight to 00:00:03.840 --> 00:00:06.630 learn more about lateral movement through the tool called 00:00:06.640 --> 00:00:11.050 CrackMapExec. CrackMapExec is an open source project released 00:00:11.050 --> 00:00:13.450 under the BSD‑2‑Clause license. 00:00:13.940 --> 00:00:17.790 The creator of this tool is Marcello Salvati, who is going by the 00:00:17.790 --> 00:00:23.190 handle Byt3Bl33d3r. Currently the tool is maintained by MPGN. Above 00:00:23.200 --> 00:00:26.540 all, I want to thank them for their contribution to the community, and 00:00:26.540 --> 00:00:29.740 I hope this course can showcase their work in such a way that others 00:00:29.740 --> 00:00:31.060 can appreciate it as well. 00:00:31.940 --> 00:00:33.240 In words of the creator, 00:00:33.250 --> 00:00:37.710 CrackMapExec is a post‑exploitation tool that helps automate assessing the 00:00:37.710 --> 00:00:42.160 security of large Active Directory networks. Built with stealth in mind, 00:00:42.160 --> 00:00:46.930 CrackMapExec follows the concepts of living off the land, abusing built‑in 00:00:46.930 --> 00:00:50.940 Active Directory features and protocols to achieve its functionality, and 00:00:50.940 --> 00:00:56.920 allowing it to evade most endpoint protection, IDS, and IPS solutions. 00:00:56.920 --> 00:01:01.150 CrackMapExec is a versatile tool written in and updated to work with 00:01:01.150 --> 00:01:05.160 Python 3. It is useful for both red teamers and the defenders alike, 00:01:05.160 --> 00:01:09.450 either to perform attacks on the network or simulate attack scenarios. 00:01:09.450 --> 00:01:13.300 It is available through the package manager on Kali Linux or by 00:01:13.300 --> 00:01:16.580 downloading it from the project's GitHub page here. 00:01:16.580 --> 00:01:18.740 Operation instructions can also be found on the wiki 00:01:18.740 --> 00:01:20.770 included on the GitHub project page. 00:01:20.770 --> 00:01:22.400 Once you have retrieved the package, 00:01:22.400 --> 00:01:25.820 all the independent packages will be downloaded and installed 00:01:25.820 --> 00:01:27.660 during the installation process of this tool. 00:01:27.660 --> 00:01:31.380 If you wish not to install from the source or directly onto your system, 00:01:31.380 --> 00:01:35.390 you can also download a compiled binary or run it from a Docker image. 00:01:35.390 --> 00:01:36.740 As a matter of fact, 00:01:36.740 --> 00:01:41.050 the maintainer recommends to use the compiled version over the source. For 00:01:41.060 --> 00:01:43.710 this demonstration, I will use the installation through the package manager, 00:01:43.710 --> 00:01:46.120 as this is my preferred installation option. 00:01:46.120 --> 00:01:49.360 All the other installation methods are equally smooth. 00:01:49.360 --> 00:01:51.300 If you haven't picked up on this already, 00:01:51.300 --> 00:01:55.430 CrackMapExec, henceforth referred to as CME, is a 00:01:55.430 --> 00:01:59.460 post‑exploitation tool which allows you to map AD domains for 00:01:59.460 --> 00:02:01.310 information regarding its structure, settings, 00:02:01.310 --> 00:02:05.190 files, and users by using programs and protocols which are readily 00:02:05.190 --> 00:02:08.960 available in the environment, gathering credentials for cracking and 00:02:08.970 --> 00:02:10.930 executing tools on the compromised hosts. 00:02:10.930 --> 00:02:15.210 One could almost say it's an AD networking, pen‑testing, Swiss Army knife. 00:02:15.210 --> 00:02:16.430 At the end of this course, 00:02:16.430 --> 00:02:20.600 you will know how to install the tool, map an AD network and its 00:02:20.600 --> 00:02:24.020 shares, extract user credentials, and use the information gathered to 00:02:24.020 --> 00:02:26.410 further your presence within the network. 00:02:26.410 --> 00:02:30.420 Now, let's take a look at where CME stands on the cyber kill chain. 00:02:30.420 --> 00:02:34.190 CME is mainly used to gather information in the Active Directory domain, 00:02:34.190 --> 00:02:37.370 and with it, further your presence within the network. 00:02:37.380 --> 00:02:42.160 With that, it would place CME firmly on the lateral movement category. 00:02:42.160 --> 00:02:46.510 As the focus of CME is to allow extraction of information to gain 00:02:46.510 --> 00:02:49.740 more credential access across the Windows AD domain, it would fall 00:02:49.740 --> 00:02:53.040 within the Credential Access and Lateral Movement categories in 00:02:53.050 --> 00:02:54.950 the MITRE ATT&CK framework. 00:02:54.950 --> 00:02:58.160 One of the features that sets CME apart is that it is able to 00:02:58.160 --> 00:03:01.370 spider the domain shares and its contents, allowing you to not 00:03:01.370 --> 00:03:03.300 only look for accessible shares, 00:03:03.300 --> 00:03:08.320 but also specific keywords within files available in those shares. 00:03:08.320 --> 00:03:11.430 Once information has been gathered and more credentials have been collected, 00:03:11.430 --> 00:03:16.270 you can leverage several techniques like WinRM or SMBExec to 00:03:16.270 --> 00:03:18.440 execute commands on the target system. 00:03:18.450 --> 00:03:21.830 With this, you can download and execute your bailouts or non‑binaries 00:03:21.830 --> 00:03:24.760 on the system that can help you further your goals. 00:03:24.760 --> 00:03:28.900 CME is also able to manipulate several security measures, allowing you 00:03:28.910 --> 00:03:32.450 to execute Kerberoasting attacks, for example. In this course we will 00:03:32.450 --> 00:03:35.190 look at the AS‑REP Roasting technique. 00:03:35.190 --> 00:03:37.940 These are just a small part of what CME has to offer. 00:03:37.940 --> 00:03:40.160 We will look through some of the other functions 00:03:40.160 --> 00:03:42.050 during the demonstration, however, 00:03:42.050 --> 00:03:45.150 these are the techniques we will be using on our target network. 00:03:45.150 --> 00:03:48.820 I want to quickly go over how the tool came to be and how it 00:03:48.820 --> 00:03:51.050 is used within the target infrastructure. 00:03:51.060 --> 00:03:55.610 After that, we will dive into the demo and see in action what we have discussed. 00:03:55.610 --> 00:03:59.500 CrackMapExec was inspired by three different tools of which Byt3Bl33d3r 00:03:59.500 --> 00:04:03.640 thought were sub optimal at the time, so he took part of each tool and 00:04:03.640 --> 00:04:06.990 created the initial version of what we have today. 00:04:06.990 --> 00:04:10.710 The tools which led to the creation were CredCrack by 00:04:10.720 --> 00:04:13.270 gojohnny, which allows for stealthy credential harvesting 00:04:13.270 --> 00:04:17.100 over the AD network; SMBMap by Shawn D. 00:04:17.100 --> 00:04:21.490 Evans, which leverages the SMB protocol to investigate resources 00:04:21.500 --> 00:04:26.170 available; and SMBExec by Pentest Geek, which makes it possible to 00:04:26.180 --> 00:04:28.200 execute files through the SMB protocol. 00:04:28.200 --> 00:04:29.660 Since the creation of CME, 00:04:29.660 --> 00:04:32.550 a lot of functionality has been added to aid in getting 00:04:32.560 --> 00:04:34.760 the most out of the SMB protocol, 00:04:34.760 --> 00:04:39.120 but also WinRM, MSSQL, and a little SSH, as Linux servers are 00:04:39.120 --> 00:04:41.490 getting more common within company domains. 00:04:41.490 --> 00:04:44.310 Now that we know the tool's inception and lifted the veil a little 00:04:44.310 --> 00:04:47.970 on how it operates, let's quickly look at how the functions operate 00:04:47.970 --> 00:04:50.000 within a Windows target environment. 00:04:50.010 --> 00:04:53.760 CME allows a red teamer to abuse protocols available in the Windows 00:04:53.770 --> 00:04:57.180 operating system to gather information on components in the domain 00:04:57.180 --> 00:04:59.420 network like domain‑connected computers, 00:04:59.420 --> 00:05:01.720 users, groups, and password hashes, in some cases, 00:05:01.720 --> 00:05:05.600 even in clear text; file shares with access rights, and several 00:05:05.610 --> 00:05:08.020 other things throughout a Windows AD domain. 00:05:08.020 --> 00:05:12.200 In this scenario, we have obtained the credentials of a user from Finance. 00:05:12.200 --> 00:05:16.310 With these credentials, CME allows us to escalate our privileges 00:05:16.310 --> 00:05:18.930 through cracking password hashes or passing tickets, 00:05:18.930 --> 00:05:22.010 allowing you to impersonate users within the domain and 00:05:22.010 --> 00:05:23.920 even execute files on their behalf. 00:05:23.920 --> 00:05:25.100 During this demonstration, 00:05:25.100 --> 00:05:29.780 we will look for a user which has Kerberos pre‑authentication disabled. 00:05:29.780 --> 00:05:34.010 Even though this is a relatively rare scenario within domains, as 00:05:34.010 --> 00:05:35.840 pre‑authentication is turned on by default, 00:05:35.840 --> 00:05:39.800 it allows us to retrieve the user's password hash for offline cracking. 00:05:39.800 --> 00:05:40.360 Now, let's dive in.