Okie dokie, we have the hash from our Windows 10 system that we
used with CredDump and, or you wanted to use SamDump, depending
on the versioning of Windows and TrustButVerify, but here we are.
And we have, oh, let me pop in the side screen real quick.
And we have our hash for Ford Prefect in a file.
Now, the reason I have it character for character as it came out of our
hash output is because that's how HashCat is going to read it as a hash file.
And you'll notice that this is inside that Windows 10 folder as well.
And I'm going to go now show you here, HashCat.
Now, HashCat basically is a way for password spraying and brute force
and dictionary tags to all work together, depending on how you use it.
We're going to be using it with a word list.
Now, a word list should not be confused with a rainbow table.
What it is, is that a word list is a list of words that you have included
for passwords that are a potential.
So like password, towel, 42, don't panic, things like that.
Specific to the organization that we're pen testing.
Sorry for the stutter, they're tongue twisters, you see.
But what happens is, is that instead of using the entirety of a rainbow
table, like an off crack, HashCat will take that word list and depending
on the specification of hashing or encryption for that system that's
identified, we'll take that word out of the list and put it against that.
So in our Windows example here, what's going to happen is, is that it's
going to go line by line in the word list and take each of them to the
identified NTLM hashing algorithm and see if it matches the hash output
that we have in our hash dump.
And if the two match, then we know for a fact that we have a password that's cracked.
So where do all these files and settings exist?
Well, I'm glad you asked because the words, word list in the code box
below is shared all across Kelly.
There's multiple of them.
And I even modified one.
We're using john2.lst.
Now the actual file itself is Windows 10 inside of the 10 folder.
And I'll have the HashCat command below as well.
So what we're doing is we're saying, Hey, HashCat, run sudo mode.
And the dash M is going to identify our mode and we have selected mode 1000.
Now I will put a link to the HashCat help file on the Kelly site.
And the reason for this is, is because there are hundreds, if not thousands
of different types of modes that HashCat can run in specific to whatever it is
that you're trying to crack is the actual mode that you want to be able to use it here.
It just so happens for systems like Windows 10 mode 1000 equals NTLM.
And there are different versions of NTLM out there.
So you may find yourself having to run four or five tries of HashCat to see if
you're matching the right hash mode pertinent to the actual hash dump that you did.
Ask me how I know.
So now once we have identified the mode, we need to identify the attack level.
And there are six different attack levels with zero being the most brute force of them all.
This is going to attract not a lot of attention at all because it's
being done locally on the system.
Basically we're talking about resourcing here.
So if I say attack mode 0-A0, I'm going to allocate all the resources I can on this
particular system to be able to use HashCat.
Now, dependent upon the actual word list that you provide and the number of
hashes that you're trying to break, this is that's going to determine how
long this is actually going to take.
But what we have here is just the basic command of using a word list from the
hashes that we've outputted for the previous portion of the skill right above into here.
So now it's going to run and you can see here that I've truncated
the process of how this runs.
It took about five minutes for it to actually go through.
It's actually found the hash already because I did the verification
process before we got here.
So this is the output that you get that you may notice something.
There's no password.
Well, in order to be able to do that, you have to run the exact same command again,
same hash file, same mode, same attack mode, same everything, word list and all
with a dash dash show on the end of it.
So now I'm just going to type dash dash show.
And when I press enter, I'll zoom in for you.
You can see the Ford prefix hash is there.
The NTLM hash and his password is of course Hitchhiker because he has his towel with him.
So now we've got a way to be able to dump hashes out of the SAM file, put them in a
document for us for, to be able to process in the programs like Hashcat for us to be
able to do credentials, but is Windows the only thing that Hashcat can be used for?
No, we'll see in just a second.