So we've got these three hashes here and all we need to copy is this second half right here.
So we're going to copy the second half and we can copy this and we're going to use crack map exact to
try to break it.
So or at least try to pass it.
So what we can do is we could say something like track map exact.
Give the range that we're going to test again.
So fifty seven zero twenty four and then we're going to say user name and this one is Frank Castle like
this.
So because we have the space and they're going to go ahead just put that in quotations and then we're
going to do a capital H for hash paste that in there.
And the last thing we want to note is that this is local so dash dash local is important to put in here.
Go ahead and hit enter and see it's going to try to pass this around the network and gain access.
Now it doesn't say that it's pound here which is interesting but we do have the user light up green
which is an indicator that this might have actually worked in the attack.
So if we see Poland or we seen a green one here like a green plus sign that's a good indicator that
this has worked pone is a guarantee.
The Green Arrow or the green plus sign here is a good chance but this has resulted in false positives
in the past.
We do know that it worked and it attempted to pass it along the rest of the way here.
It was unsuccessful as expected which is OK.
But again passing this hash around the network you never know what you're going to find.
You never know this could light up Green for All of these with pound all the way down the list and then
guess what.
We have every single machine and I've had this happen in countless assessments.
And if you want to story time quick story time there was a assessment that I was up against that was
using something called privilege access management which are going to talk about really quick in the
next video but that's a great mitigation to these sorts of attacks because what happens is a user goes
in and they have to check out their domain account.
So there are tools called like cyber arc or psychotic that can be used where you go in you type a password
you check out your domain account and your domain account password is really long it's some crazy complex
15 to 30 character password you utilize that for eight hours or so and then guess what when you check
it back in that password rotates to a new password so you only know this crazy complex password for
eight hours.
It's impossible to capture eleven are or any kind of hash that's NTI and B2 and try to crack it but
guess what I was able to use SMB really on an assessment dump out the same hashes just like this.
I saw administrator on there I just went and copied this put it into crack map exact just like I did
here.
Fluid around the network and it owned everything in cyber.
Perfect access management.
That's not cheap we're talking million dollar software that they focus on security in their domain controller
went down in seconds because they weren't thinking about their local admin accounts local Afghan accounts
are so important especially if you're reusing these passwords it's gonna hurt you so bad.
So keep this in mind as another form of attack utilizing these local hashes.
And another thing to do as well is you can't put this into P.S. exactly and get a shell out of it if
you want you can use P.S. exact up pi to do this.
So for example if we go to P.S. exact and we just say dash dash help you'll see in here that there is
a place for hashes so you can utilize the whole hash to authenticate instead of utilizing a password.
So we can do something along the lines of this his exact pie and will this say something like we'll
say Frank Castle like this and we won't give it a password and we'll just say at this will be 1 9 2
1 6 8 fifty seven got one forty one and then we'll say hatches and then we need the whole hatch for
this one so we need to alum hatch and the empty hatch and if we look here this is the 11th hatch and
the second part is the ante Hatch you need the entire hatch for P.S. exact to work here it's gotten
past that and we'll hit enter and we can see while this user was able to authenticate here we were able
to request the share.
We weren't able to get any admin access via this one.
So even though this user has access to this machine we're still not able to get a right able share where
we can upload and get a shell and to prove concept here we can try it on another computer say forty
two where we know we don't have privileges and you can see there's a log in failure so there's a difference
here but this is just another thing that you can do.
You can attempt to get a show with this local user without ever having to use P.S. exact or know the
password or anything.
So just building upon this if you pass is password around the network and this password works all over
the place then your next move would be to do this setup here.
Put your hash in and then try to fire it and get a shell.
This is a quick way to own a domain controller.
For example if the domain controller is allowing something like this or that user is valid on that domain
controller.
So from here we're gonna go ahead and talk mitigation strategies and then we'll move on to some more
fun attacks in active directory.