Lateral Movement and Pivoting Lecture 3 | Lecture Note

University:
Campbell University
Course:
HSEC 444 | Cybersecurity
Academic year:

2022
Views:

393

Pages:

8
Author:

5prinzg1s

Pass-the-Hash: Review ● NTLM is a challenge-response mechanism. 1. The server sends a challenge to the client. 2. The client encrypts the challenge with it’s NTLM hash to generate the response 3. The response is sent to the server and checked. Pass-the-Hash ● Here’s the problem… the plaintext is converted to the hash on the client side instead of the server side (like, for example, logging into a webservice). ● This means that only the hash is used in authentication. ● If we get a hash, we can authenticate as that user without cracking their hash! 21 Pass-the-Hash with Mimikatz 1) Run Mimikatz as admin user 2) Elevate privileges to do admin things 22 Pass-the-Hash with Mimikatz 3) Dump hashes 23 Pass-the-Hash with Mimikatz 4) Revert 5) Pass the hash to run a command as the user with their hash instead of password. 6) In this case, the command is a rev shell 24 Pass-the-Hash with Mimikatz 7) Now that you have that shell, you can run commands as that user from that shell. 25 Pass-the-Hash with Impacket Also, once you have the hash, you can pass it using Impacket tools. 26 Pass-the-Hash with Metasploit Note that Metasploit’s psexec module will allow you to use full NTLM (LM:NT format) hashes for the SMBPass field instead of passwords 27