We talked about understanding who we are.
We talked about maintain a persistence.
Now it's time to try to get some passments.
We've probably seen in the past where we can't exactly go into the actual SAM
file itself,
unless we're using forensics tools to be able to create a bit-for-bit copy of
something
that's already in the running process that's system-locked.
And the SAM is one of those files inside of C drive Windows System 32 Etsy
that is system-locked.
I mean to say C drive Windows System 32 can fig.
Yes, I totally said that the first time and I didn't edit it back.
Anyway, let's go up on over here real quick.
We can see that we are in the actual PowerShell itself from our last portion of
the skill.
We're actually going to exit out of this and go back to meter feeder.
Just take control C. I keep forgetting that we don't use exit in there.
And you could see now that I'm in meter feeder command prompt.
So I am still in session one of our actual connection inside of MSF console.
And if you say, "question mark and hit enter,"
you will get a lot of commands that come up that allow you to be able to go
through and do a couple of things.
One of which, in particular, which I'm going to be zooming in on for us is, is
#um.
Now, there's two commands that will be looking at both of them,
but first is the actual #um itself for this portion of the skill.
What is it? What does it do?
Well, since we are on the system as an administrator,
and because we're on as learner through our back door channeling,
we're able to execute the command of #um.
And if we weren't, we would be using the one right above it called getSystem
to where we try to force elevation of commands.
And so this is where we start doing that pivot into the different users and
stuff like that.
Now, that one in particular, getSystem will be doing that one later
when we go into Windows Active Directory Exploitation for different skills.
Don't you worry, we're going to get there.
But right now, we're going to be taking a look at #um.
So let me press enter so we can go to the next line.
Simply do #um.
You see right there.
And as soon as we hit enter, you can see that we get a bunch of different
information on here.
I'm going to scroll up for us.
There we go.
And I'm going to zoom in and show you what we're taking a look at.
Default account and Eric.
Here while running command #validationfailed,
workspace does not match origin sessions host workspace.
There's other, this could be like a permissions thing.
But if you remember in one of the previous skills,
we did create a user account named Eric on here as a regular user.
And we have his information as far as the actual password #hash,
we don't exactly know what it is yet.
And then we also have the default account.
Now, what does this really mean for us?
Well, I'm glad you asked.
Because then we can take those hashes and start running them against password
attack programs
that we're going to be having in individual skills.
Just know that you can use things like John the Ripper Rainbow Table.
Or Loft, Crack.
There's many different other programs out there
and different methods for us inside of Cali to be able to start working those
hashes.
But #hashdump allows us to be able to go through
and not only get the actual users, the group, and also their user ID.
But more importantly, the ability to work on that hash offline.
And I stress offline because if you're trying to work this hash
inside of the actual system itself, why you're still connected,
you run the risk of actually getting caught during your pen test.
And while you may get that one password cracked and start being able to use it,
risk and reward here.
So these are some things to consider whenever we're going through and starting
to get passwords.
That's something you would copy and save to your desktop.
And in our later skills, when we're working in password cracking and password
attacks,
is when you would actually take focus on that.
And think about it, because your pen test isn't going to last just for a single
day.
It could.
But most pen tests are over a period of time.
So if you're already in the system and you start collecting hashes from these
different
systems that you're inside since you've been doing lateral movements,
like we've been talking about earlier in this skill,
you're going to be collecting all sorts of different hashes that you could
easily put on
automated tasks later in the day.
So they can work overnight for you to be able to go back
freshly after a good night's arrest to be able to attack more systems.
And those hashes may come back as a general password,
but it can also set you up for other things too, like passing the hash.