So the first thing that I like to do when I compromise a user account or a machine is I like to do what
it's called Pass the password or possibly pass the hash.
So when we talk about what this is this is just passing this around the network.
So remember we captured the password.
Password one to read cracked it when we captured it with responder.
Now we have a user name and a credential and we logged into a machine.
We dumped some hashes and we have credentials there as well.
Right.
So utilizing those we can either take those credentials off line that we dumped or we can take those
hashes and try to pass them around or pass the password around.
So taking a look at what this means on a technical level there is a tool that we're going to use called
crack map exactly.
Now crack the SEC just takes the user name domain and password as you see here and what it does is it
throws that password all around the subnet here.
So we'll take it against the subnet third around and we'll see where it sticks.
Now if you recall we have our user Frank Cassell who is not only an admin on the Punisher machine but
also an admin on Spider man machine as well.
So playing off the different example of past the hash let's say that we have a P.S. exact here which
is what I setup.
We have P.S. exact with maternal.
We get on to this machine and we run a hash stump.
Well we can take the hash stump of that local user here and you can see we just capture the last bit
of this hash and we'll just try to pass that around.
So what that looks like is something like this where you do the same thing against the network here
with the user f Castle which is a local user.
And then the capital H for a hash and then dash dash local signifying that we're going to go ahead and
pass this round locally.
And you could see that we didn't have any luck on this one and that's OK but that's still what we're
after is we're after trying to pass as local hash around to see if we can get on any machines.
This one is a big one.
These two are big ones.
Now you do not have to crack this password to build a pass as hash ram.
That's huge.
The other thing is if you do have a password you could pass that around and see where you can get on
any machine as well.
These local accounts are very dangerous.
The issue is a lot of administrators will reuse the same account and password to set up machines.
So if you're able to dump an administrator password or a hash then guess what.
You can pass Ash along network and I have seen it where the entire network uses the same local administrator
password or hash and you own the whole network without really having to compromise anything.
So looking into these local hashes these local accounts are super important as well.
So from here we're going to install our tool.
We're going to take a look at a couple different features and what we can do here and then we're going
to play around crack map exactly and see what it's capable of as well so let's go ahead and just dive
into the next video and we're going to go ahead and install a crack map Zach.