WEBVTT

00:00:00.140 --> 00:00:02.310
If you use Kali Linux as your OS,

00:00:02.310 --> 00:00:06.130
CME will come preinstalled and is accessible through the terminal.

00:00:06.140 --> 00:00:08.000
However, before we dive into the program,

00:00:08.000 --> 00:00:10.270
let's make sure there aren't any updates on the package

00:00:10.270 --> 00:00:13.560
since it was included in the image.

00:00:13.560 --> 00:00:16.630
Now that we have confirmed that there are no updates on the software package,

00:00:16.630 --> 00:00:20.300
let's run it for the first time to allow it to create the working

00:00:20.320 --> 00:00:23.000
directories it requires to operate correctly.

00:00:23.000 --> 00:00:25.340
CrackMapExec will set up the working directories in a

00:00:25.340 --> 00:00:27.830
hidden directory in your home folder.

00:00:27.830 --> 00:00:30.800
Do note that some functionalities of CME require you

00:00:30.800 --> 00:00:33.310
to run it with elevated privileges.

00:00:33.320 --> 00:00:36.700
Therefore, I will be running the tool with sudo during this demonstration.

00:00:36.700 --> 00:00:39.980
To make it a little easier or myself, I will create an alias.

00:00:39.980 --> 00:00:40.780
In some cases,

00:00:40.780 --> 00:00:45.690
I have noticed that certain functionality of CME is not working correctly.

00:00:45.690 --> 00:00:48.040
This is why the maintainer nowadays recommends to use

00:00:48.040 --> 00:00:49.990
the packaged version of the tool.

00:00:49.990 --> 00:00:52.660
Let's do a quick check if everything is working as it should.

00:00:53.340 --> 00:00:55.820
It seems that one module is not working correctly,

00:00:55.820 --> 00:00:58.810
as it seems to be missing the pylnk3 package.

00:00:58.810 --> 00:00:59.630
As a matter of fact,

00:00:59.630 --> 00:01:01.870
I know that this package is installed on the system and

00:01:01.870 --> 00:01:04.560
that it must be missing a link to it.

00:01:04.560 --> 00:01:06.690
There are several ways to fix this issue.

00:01:06.690 --> 00:01:06.910
However,

00:01:06.910 --> 00:01:10.590
my preferred way is to reinstall the package through the Python Pip

00:01:10.600 --> 00:01:13.110
manager so I know I'll have the latest version.

00:01:13.110 --> 00:01:17.050
Pip for Python 3 does not come installed by default with Kali Linux,

00:01:17.050 --> 00:01:20.230
so let's install it and upgrade the pylnk3 package.

00:01:20.230 --> 00:01:24.720
Now that the package has been relinked and it seems to be at the latest version,

00:01:24.720 --> 00:01:27.920
let's rerun the command to see if this has resolved the issue.

00:01:27.920 --> 00:01:30.470
Luckily, this has resolved the issue.

00:01:30.470 --> 00:01:33.490
Before I will show you the basic usage of the tool and explain what

00:01:33.490 --> 00:01:35.890
the command did that I issued to find the error,

00:01:35.890 --> 00:01:38.180
let's first have a look at files and directories it

00:01:38.180 --> 00:01:39.850
created when it was run for the first time.

00:01:39.850 --> 00:01:42.000
As I am running the tool with sudo,

00:01:42.000 --> 00:01:45.070
the directory is created in the home folder of the root user.

00:01:45.070 --> 00:01:50.700
In the hidden cme folder, we will find a few folders and a configuration file.

00:01:50.700 --> 00:01:53.160
The configuration file lets you set the connection details to

00:01:53.160 --> 00:01:55.170
your preferred post‑exploitation framework,

00:01:55.170 --> 00:02:00.530
as well as configure some options of the basic behavior and look of the tool.

00:02:00.530 --> 00:02:04.350
The subdirectories will be used to store data generated by the tool.

00:02:04.350 --> 00:02:08.330
One directory in particular I would like to look at is the workspaces directory.

00:02:08.330 --> 00:02:11.039
This folder holds all the data that is collected about the

00:02:11.039 --> 00:02:13.010
target network during the use of this tool.

00:02:13.010 --> 00:02:19.550
It is stored in SQL format and can easily be accessed with a tool called cmedb.

00:02:19.550 --> 00:02:22.020
Currently there is only one workspace, default,

00:02:22.020 --> 00:02:24.950
and it holds five SQLite databases.

00:02:24.950 --> 00:02:30.130
Let's run cmedb and configure a new workspace for our demonstration.

00:02:30.130 --> 00:02:33.050
Remember, if you are using CrackMapExec through sudo,

00:02:33.050 --> 00:02:37.950
cmedb also needs to be run that way to be able to access the correct data.

00:02:38.050 --> 00:02:41.680
All right, cmedb is rather poorly documented; however,

00:02:41.680 --> 00:02:43.680
it is not hard to get around.

00:02:43.680 --> 00:02:45.140
By typing help at any point,

00:02:45.140 --> 00:02:48.460
you can obtain short bits of information of what commands

00:02:48.460 --> 00:02:50.500
are available to you during that stage.

00:02:50.500 --> 00:02:54.880
From the start, you will have the following three options,

00:02:54.890 --> 00:02:56.370
exit, proto, and workspace.

00:02:56.370 --> 00:03:00.510
As we are currently in the default workspace, let's create a new one.

00:03:00.510 --> 00:03:01.540
According to the help function,

00:03:01.540 --> 00:03:04.240
we should be able to get information about the workspace

00:03:04.240 --> 00:03:06.700
command by typing help and the topic.

00:03:06.700 --> 00:03:08.760
This, however, is not yet documented.

00:03:08.760 --> 00:03:12.540
As the functionality for workspace only consists of two commands,

00:03:12.540 --> 00:03:15.460
let's run it and create a new workspace.

00:03:15.460 --> 00:03:18.870
As you can see, we have directly moved to the new workspace.

00:03:18.870 --> 00:03:20.580
Let's switch back to the default.

00:03:20.580 --> 00:03:24.340
Currently, there is no way to remove workspaces from within cmedb,

00:03:24.340 --> 00:03:27.520
so after we have looked at the proto command,

00:03:27.520 --> 00:03:30.220
we will remove the workspace the old fashioned way.

00:03:30.220 --> 00:03:33.170
The proto command gives you access to where all the data is which

00:03:33.170 --> 00:03:35.720
has been gathered during the use of this tool.

00:03:35.720 --> 00:03:38.230
You can select the proto corresponding to what you

00:03:38.230 --> 00:03:41.020
have been using in CrackMapExec.

00:03:41.020 --> 00:03:43.800
Remember the five different SQL databases?

00:03:43.800 --> 00:03:46.690
These are the protocols you can choose.

00:03:46.690 --> 00:03:49.120
Let's take the SMB protocol, for example,

00:03:49.120 --> 00:03:52.560
as this is the most extensive part of CME and the protocol which

00:03:52.560 --> 00:03:55.240
we will be using during the demonstration.

00:03:55.240 --> 00:03:55.670
Typing help,

00:03:55.670 --> 00:03:59.220
you will find the commands available to you for this part of the database.

00:03:59.220 --> 00:04:03.410
All gathered information of our demo will be stored here.

00:04:03.410 --> 00:04:05.110
Currently, it is all empty,

00:04:05.110 --> 00:04:08.060
but during the attack on the network we will get back to this

00:04:08.060 --> 00:04:12.940
tool and see how it filled up with information.

00:04:12.940 --> 00:04:15.760
All right, with basic navigation of the database done,

00:04:15.760 --> 00:04:20.660
let's remove the workspace we just created and move on with CrackMapExec itself.

00:04:20.660 --> 00:04:24.290
Let's leave the elevated status and issue our cme command.

00:04:24.290 --> 00:04:27.240
This will print the general usage of CrackMapExec.

00:04:27.240 --> 00:04:31.610
Running the program with ‑h also gives you the same help information.

00:04:31.610 --> 00:04:34.390
You can see here the protocols available in the tool,

00:04:34.390 --> 00:04:39.780
which also correspond to the SQLite databases we've seen just a moment ago.

00:04:39.780 --> 00:04:42.550
By running cme with the protocol and ‑h,

00:04:42.550 --> 00:04:45.300
you will find an extensive description of what can be

00:04:45.300 --> 00:04:48.000
done with that specific protocol.

00:04:48.000 --> 00:04:49.720
Let's start with the target.

00:04:49.720 --> 00:04:55.140
This can be anything from an IP address to a range or even a subnet.

00:04:55.140 --> 00:04:57.700
However, depending on what commands you want to use it with,

00:04:57.700 --> 00:05:00.900
this becomes a lot more noisy, for example,

00:05:00.910 --> 00:05:02.200
password spraying a whole subnet.

00:05:02.200 --> 00:05:05.540
Even though it is the last option for the usage syntax,

00:05:05.540 --> 00:05:07.350
I would recommend starting with it,

00:05:07.350 --> 00:05:11.460
as it might conflict with arguments that have optional values.

00:05:11.460 --> 00:05:16.070
Next, we have the optional arguments which allow you to specify a username,

00:05:16.070 --> 00:05:17.980
password, additional connectivity information,

00:05:17.980 --> 00:05:21.530
or modules to use, and also password attack settings.

00:05:21.530 --> 00:05:24.520
Remember the command we used to check if all functionality was

00:05:24.520 --> 00:05:26.990
working correctly during the installation?

00:05:26.990 --> 00:05:31.350
This command lists the modules, in this case, for the SMB protocol.

00:05:31.350 --> 00:05:34.980
By replacing SMB with any other of the available protocols,

00:05:34.980 --> 00:05:39.370
MS SQL, WinRM, etc., you can get a list of what is available for those.

00:05:39.370 --> 00:05:43.080
The next section contains the different options you have for credential

00:05:43.080 --> 00:05:46.720
gathering through dumping of processes and files.

00:05:46.720 --> 00:05:48.770
The mapping, enumeration,

00:05:48.780 --> 00:05:52.440
and spidering sections are what we will use the most during this demonstration.

00:05:52.440 --> 00:05:56.510
It allows you to tap many information sources within the AD.

00:05:56.510 --> 00:06:00.320
The last few sections allow you to upload and download files,

00:06:00.430 --> 00:06:03.590
execute commands, obfuscate PowerShell scripts and clear them,

00:06:03.590 --> 00:06:07.970
and even allow you to bypass AMSI with your own custom bypass.

00:06:07.970 --> 00:06:11.650
A subset of all these commands can also be found at the other protocols.

00:06:11.650 --> 00:06:14.660
There might be some protocol‑specific options; however,

00:06:14.660 --> 00:06:15.980
the majority is the same.

00:06:15.980 --> 00:06:19.200
Now that we have seen the standard functionality of CME,

00:06:19.200 --> 00:06:23.310
let's look at what external tools have been added as submodules.

00:06:23.310 --> 00:06:25.680
As this tool is created for the use of SMB,

00:06:25.680 --> 00:06:28.740
you will find that the list of submodules for the

00:06:28.750 --> 00:06:32.220
other protocols is less extensive, if they are there at all.

00:06:32.220 --> 00:06:35.290
You can bring them up by replacing the SMB protocol with

00:06:35.290 --> 00:06:37.480
any of the other protocols as before.

00:06:37.480 --> 00:06:40.020
As we will be focusing on the SMB protocol,

00:06:40.020 --> 00:06:42.150
we'll leave the others for what they are.

00:06:42.150 --> 00:06:45.450
The modules range from enumeration and gathering scripts to

00:06:45.450 --> 00:06:48.030
connecting to external programs like BloodHound,

00:06:48.030 --> 00:06:49.490
Empire, and Metasploit,

00:06:49.490 --> 00:06:52.930
but also ways to inject executables into memory and keylogging,

00:06:52.930 --> 00:06:54.570
to name a few.

00:06:54.570 --> 00:06:57.110
So now that we have seen some of the features in this tool,

00:06:57.110 --> 00:07:00.530
let me show you how it actually works.

00:07:00.530 --> 00:07:03.250
Let's start off by looking for hosts that are available in our

00:07:03.250 --> 00:07:05.780
network which don't require SMB signing,

00:07:05.780 --> 00:07:07.640
and go from there.

00:07:07.640 --> 00:07:11.280
The gen‑relay‑list switch requires an output file to write the

00:07:11.290 --> 00:07:14.660
hosts to that don't require SMB signing.

00:07:14.660 --> 00:07:18.290
All responding hosts it finds will be added to the CME database.

00:07:18.290 --> 00:07:22.980
As for the IP section, you can input a single IP or range like I did,

00:07:22.980 --> 00:07:25.900
a whole subnet by using the short notation,

00:07:25.900 --> 00:07:28.120
or a combination of any of them.

00:07:28.120 --> 00:07:29.800
Now that the command has completed,

00:07:29.800 --> 00:07:32.310
we find that there are three hosts currently available in

00:07:32.310 --> 00:07:34.740
our test lab which meet our conditions.

00:07:34.740 --> 00:07:37.600
The output of this scan shows us the host IP,

00:07:37.600 --> 00:07:40.240
what OS they are running, what the hostname is,

00:07:40.240 --> 00:07:44.530
if they are joined to a domain, and, maybe the most important thing of all,

00:07:44.530 --> 00:07:48.850
if SMB signing is enabled and the use of SMB version 1 is permitted.

00:07:48.850 --> 00:07:51.540
Now that we know what hosts are available to us,

00:07:51.540 --> 00:07:53.910
we can make the scan scope more narrow.

00:07:53.910 --> 00:07:58.250
This will shorten the query time and, with that, make less noise on the network.

00:07:58.250 --> 00:08:01.080
Let's see what information we can discover by using the

00:08:01.080 --> 00:08:04.660
credentials we have from our compromised finance user.

00:08:04.660 --> 00:08:09.410
First, we will gather some information to populate our CME database with domains,

00:08:09.410 --> 00:08:10.890
users, and groups.

00:08:10.890 --> 00:08:13.280
Enumerating the users, we see that besides Bob,

00:08:13.280 --> 00:08:17.220
there are users called Alice and Frank in this domain.

00:08:17.220 --> 00:08:20.860
With the groups command you can not only get all the available groups but

00:08:20.860 --> 00:08:24.880
also specify a specific group to get users assigned to it.

00:08:24.890 --> 00:08:28.860
For example, we just found out that Frank is part of the domain admins.

00:08:28.860 --> 00:08:31.450
Let's continue and enumerate the shares on the network.

00:08:31.450 --> 00:08:34.480
Let's also add back all the IPs we discovered and adjust the

00:08:34.480 --> 00:08:36.470
switch once again to search for shares.

00:08:36.470 --> 00:08:37.450
As a domain user,

00:08:37.460 --> 00:08:40.549
we have access to the NETLOGON and SYSVOL folders on

00:08:40.549 --> 00:08:44.670
the domain controller by default, so let's investigate those in a bit.

00:08:44.680 --> 00:08:48.370
The IT machine seems to have an IT‑sensitive share we cannot access.

00:08:48.370 --> 00:08:50.800
Might be something of interest there.

00:08:50.800 --> 00:08:53.010
The Finance machine has a folder called yearly.

00:08:53.010 --> 00:08:58.200
As we are not interested in financial records, we'll leave it for what it is.

00:08:58.200 --> 00:09:01.580
Depending on your goals, you can investigate all these shares.

00:09:01.580 --> 00:09:05.240
However, I will just be looking to further my access to the network.

00:09:05.250 --> 00:09:08.280
Let's see if there are any passwords available in the files in

00:09:08.290 --> 00:09:10.930
these shares by spidering the content of them.

00:09:10.930 --> 00:09:12.610
It looks like we've got a hit.

00:09:12.610 --> 00:09:15.310
There seems to be a password in the Groups.xml in the

00:09:15.310 --> 00:09:17.530
SYSVOL share on the domain controller.

00:09:17.530 --> 00:09:21.580
Let's extract those credentials with the module that has been created for it.

00:09:21.580 --> 00:09:22.980
Look at that.

00:09:22.980 --> 00:09:26.520
It seems the domain administrators have added a LocalAdmin

00:09:26.520 --> 00:09:29.620
user to the workstations and forgot to remove the group

00:09:29.630 --> 00:09:31.070
policy rule after adding it.

00:09:31.070 --> 00:09:33.180
Now that we have these credentials,

00:09:33.180 --> 00:09:38.800
let's quickly have a look at what has been added so far in the CME database.

00:09:38.800 --> 00:09:44.280
Running cmedb, we end up where we left off, in the SMB protocol database.

00:09:44.280 --> 00:09:48.240
Just as a reminder, the following commands are available to us.

00:09:48.240 --> 00:09:50.060
Let's have a look what we discovered.

00:09:50.060 --> 00:09:50.780
As you can see,

00:09:50.790 --> 00:09:54.900
we have all the information regarding the hosts and also if there are any

00:09:54.900 --> 00:09:57.930
credentials we have discovered that gave us admin access.

00:09:57.930 --> 00:10:01.280
At the time, unfortunately, we have not.

00:10:01.280 --> 00:10:05.180
The only things that are left out are if SMB signing is enabled

00:10:05.180 --> 00:10:09.090
for a given host and if SMBv1 is permitted.

00:10:09.090 --> 00:10:09.640
This, however,

00:10:09.640 --> 00:10:13.750
is displayed on screen every time you connect to a particular host.

00:10:13.750 --> 00:10:16.490
Let's see how the shares database has filled up.

00:10:16.490 --> 00:10:20.180
Shares shows us all the shares in the domain with any comments,

00:10:20.180 --> 00:10:24.690
how many credentials we possess that have read and write access.

00:10:24.690 --> 00:10:24.820
Lastly,

00:10:24.820 --> 00:10:28.710
let's see the credentials we have discovered by viewing the creds database.

00:10:28.710 --> 00:10:31.500
You see here that it logs all the users it discovers,

00:10:31.500 --> 00:10:34.750
as well as any passwords we found or used.

00:10:34.750 --> 00:10:38.230
You might also have noticed that all entries have an ID.

00:10:38.230 --> 00:10:40.490
Be it CredID or HostID,

00:10:40.490 --> 00:10:43.940
the ID can also be used within CME instead of the

00:10:43.940 --> 00:10:46.340
user password combo or host IP.

00:10:46.340 --> 00:10:48.650
Okay, so in the last step,

00:10:48.660 --> 00:10:52.000
we discovered that the administrators of the Contoso domain use a

00:10:52.000 --> 00:10:54.750
local account for administration of workstations.

00:10:54.750 --> 00:10:58.700
This might indicate, if the domain was set up by a really incompetent admin,

00:10:58.700 --> 00:11:01.490
that the User Account Control restrictions for

00:11:01.500 --> 00:11:03.550
remote use might have been adjusted.

00:11:03.550 --> 00:11:06.080
Let's try it out and see if we can access the shares

00:11:06.080 --> 00:11:08.350
with our LocalAdmin user remotely.

00:11:08.360 --> 00:11:10.390
With the ‑‑local‑auth switch,

00:11:10.390 --> 00:11:14.670
we can force CME to authenticate to the localhost instead of the domain.

00:11:14.670 --> 00:11:16.250
It seems that we are in luck.

00:11:16.250 --> 00:11:20.320
Not only did we find a LocalAdmin account, we can also use it remotely.

00:11:20.320 --> 00:11:24.260
If the UAC was not adjusted, we can still use these credentials.

00:11:24.260 --> 00:11:24.440
However,

00:11:24.440 --> 00:11:28.190
we would have had to log into the workstation with known domain

00:11:28.190 --> 00:11:32.020
credentials to be able to fill out the UAC pop‑up.

00:11:32.020 --> 00:11:35.970
Anyway, now that we have full access to the IT‑sensitive share,

00:11:35.970 --> 00:11:40.840
let's scan that one for potential confidential material like passwords.

00:11:40.840 --> 00:11:45.020
We will rerun the command we previously ran and adjust it to function

00:11:45.020 --> 00:11:48.520
locally on the IT host with our LocalAdmin account.

00:11:48.520 --> 00:11:50.920
Ah, it seems there is another password in that share.

00:11:50.920 --> 00:11:54.400
We could connect to the share directly and read the file,

00:11:54.400 --> 00:11:56.790
download, or read the file through the command line.

00:11:56.850 --> 00:11:59.900
To showcase that we can easily run commands from CME,

00:11:59.900 --> 00:12:02.650
we will try and locate the file on disk.

00:12:02.650 --> 00:12:07.720
To do so, let's run a search command to locate where it is.

00:12:07.720 --> 00:12:10.600
Okay, so this gets blocked by the antivirus.

00:12:10.600 --> 00:12:13.980
Let's try another way by running the command through the command

00:12:13.980 --> 00:12:15.900
prompt instead of directly into PowerShell.

00:12:15.900 --> 00:12:21.130
We can change the use from PowerShell to cmd by exchanging the capital X

00:12:21.130 --> 00:12:24.570
to a lowercase x and adjusting the command a little.

00:12:24.570 --> 00:12:26.150
There we have to path.

00:12:26.150 --> 00:12:28.440
Let's cancel the search process and continue with

00:12:28.440 --> 00:12:31.370
reading the file to get its content.

00:12:31.370 --> 00:12:33.300
With this new credential in our possession,

00:12:33.300 --> 00:12:36.670
let's query the AD to find out if there are any users with

00:12:36.670 --> 00:12:38.550
Kerberos pre‑authentication disabled.

00:12:38.550 --> 00:12:40.980
We can do so with the following command.

00:12:40.980 --> 00:12:45.140
Again, we will use the SMB protocol, type in the IP of the domain controller,

00:12:45.140 --> 00:12:49.540
and use our newly gained credentials to query the AD.

00:12:49.540 --> 00:12:52.710
Our Frank user seems to have this specific option enabled.

00:12:52.710 --> 00:12:54.260
How lucky for us.

00:12:54.260 --> 00:12:57.020
Before we execute the attack through a module included in his tool,

00:12:57.020 --> 00:12:59.130
let me explain a little about this attack to give it

00:12:59.130 --> 00:13:01.090
a general idea of how it works.

00:13:01.090 --> 00:13:03.940
The Kerberos protocol is very reliant on timestamps.

00:13:03.940 --> 00:13:06.840
With pre‑authentication enabled, which it is by default,

00:13:06.840 --> 00:13:10.470
the user initiates the AS REQ, or authentication server request,

00:13:10.470 --> 00:13:13.800
by sending over a timestamp encrypted by the password.

00:13:13.800 --> 00:13:16.340
This does two things.

00:13:16.340 --> 00:13:19.160
First, verification by the Kerberos Key Distribution Center,

00:13:19.160 --> 00:13:21.640
or KDC, that the user is who he says he is,

00:13:21.640 --> 00:13:24.200
as he knows the password, and secondly,

00:13:24.200 --> 00:13:26.960
verify that the request with the timestamp is within a

00:13:26.970 --> 00:13:29.060
few minutes of its own server time.

00:13:29.060 --> 00:13:32.660
This makes sure that the user is not just replaying a

00:13:32.660 --> 00:13:33.980
recorded authentication request.

00:13:33.980 --> 00:13:37.950
When everything is in order, the server will respond with the AS REP,

00:13:37.950 --> 00:13:39.930
the authentication server reply.

00:13:39.940 --> 00:13:43.280
This reply contains a Ticket Granting Ticket for the client and

00:13:43.280 --> 00:13:46.200
some data encrypted with the client's password.

00:13:46.200 --> 00:13:46.900
Now,

00:13:46.910 --> 00:13:49.240
the configuration issue here is that the

00:13:49.250 --> 00:13:51.920
pre‑authentication has been disabled, and due to that,

00:13:51.920 --> 00:13:54.650
the client is not required to send an encrypted timestamp

00:13:54.650 --> 00:13:57.030
to the Kerberos Key Distribution Center.

00:13:57.030 --> 00:14:01.880
A plain authentication request is sufficient for the KDC to send us an AS REP,

00:14:01.880 --> 00:14:05.450
which we can then use to brute force the section of data which is

00:14:05.450 --> 00:14:08.440
encrypted to try and retrieve the client's password offline.

00:14:08.440 --> 00:14:12.010
Now that we know a thing or two about the attack we are performing,

00:14:12.010 --> 00:14:15.260
let's switch protocol to LDAP and use the built‑in

00:14:15.260 --> 00:14:17.330
functionality to roast this Kerberos.

00:14:17.330 --> 00:14:17.570
First,

00:14:17.570 --> 00:14:21.240
we will bring up the help section to search for the command we are going to use.

00:14:21.240 --> 00:14:25.050
In the Retrieve hash section, we find our reproast command,

00:14:25.050 --> 00:14:27.260
which takes a username as parameter.

00:14:27.260 --> 00:14:30.660
Let's build up the commands and try to retrieve our hash.

00:14:30.660 --> 00:14:30.950
Once again,

00:14:30.950 --> 00:14:34.190
we will build up our CME commands now using the LDAP

00:14:34.190 --> 00:14:36.490
protocol and our ASREPROAST switch.

00:14:36.490 --> 00:14:39.580
With the authentication server response successfully retrieved,

00:14:39.580 --> 00:14:41.670
we can begin our cracking offline.

00:14:41.670 --> 00:14:46.000
You can feed the hash directly into Hashcat with type 18200 or adjust

00:14:46.000 --> 00:14:48.770
it a little bit to be able to crack it with John.

00:14:48.770 --> 00:14:50.650
We will, however, feed it into John,

00:14:50.650 --> 00:14:54.460
so we'll need to remove the $23 just before the

00:14:54.470 --> 00:14:56.710
username to make it compatible with John.

00:14:56.710 --> 00:15:00.270
I created a word list based on passwords that were in use in this domain,

00:15:00.270 --> 00:15:02.350
so we might be able to crack it fast.

00:15:02.350 --> 00:15:05.640
And there you have it, the password to the domain admin.

00:15:05.640 --> 00:15:06.140
With it,

00:15:06.140 --> 00:15:09.680
you now have the keys to the kingdom and a great feeling of owning

00:15:09.690 --> 00:15:11.560
the network with the tool called CrackMapExec.