15. Password Attacks

1. Attacking Network Serice Logins (SSH/RDP, HTTP)

2. Password Cracking Fundamentals

3. Working with Password Hashes

• brute-force: try all possible combinations

• dictionary-based: used predefined lists

• use a single password against different usernames

should not take more than 3 minutes in labs and challenges

• important: do we know the default username?

• 
  

• mutate given password lists

• goal: dictionary with passwords according to certain password policy

1. Extract hashes

2. Format hashes

3. Calculate cracking time

4. Prepare wordlist

5. Attack the hash

• tool to extract hashes and exploit windows authentication system

• must be run as admin

• Windows stores hahsed user passwords in the Security Account Manager (SAM) database file

  • not salted

  • located at C:\Windows\system32\config\sam

  • SAM is only accessible for kernel process

• Other processes use the hashes, e.g. the LSASS prcess, which caches hashes in memory

• mimikatz can be used to extract user hashes, but requires privileged user

• because of missing salts, a found hash + username can be used to authenticate against local or remote targets -> pass-the-hash

• Example:

  • found NLTM hashes of local admin on HOST01

  • use this hash to authenticate against admin on HOST02, where a restricted SMB instance is hosted

  • requriment: both loca admins with same password

• UAC remote restrictions since windows vista

  • if attacking remote systems, we most likely do not have permission to code execution because we need the password of the user

  • only for local administrators relay attacks give RCE

• useful if we can not use mimikatz

• replaced by Kerberos, but still often used to support older software

• Net-NTLMv2:

  • Challenge-Response

  • Server sends challenge, client encrypts challenge with NTLM hash

• Crack: Attacker makes client to connect to attacker-controlled server, then attacker tries to break NLTM hash (hashcat)

• Rleay:Attacker makes client to connect to attacker-controlled server and relays all message to actual server