In our challenge, we set out to finish up something that we didn't complete in one of the previous
portions of our skill, and that is using Hirons against our Windows 10 workstation that hosts
BWAP inside of our lab. Now, as you can see here, I have the Hyper-V manager opened up.
I'm going to right-click and go into settings and make sure that I have the boot order correct,
DVD first. Now I'm going to go in and assign Hirons to the actual DVD ISO for
Hirons, and I'll be using the regular x64 bit. Apply. Okie dokie. Now Windows 10 is still running,
which means I'm going to have to restart it. So let's go ahead and pop up open Windows 10 real
quick while it's loading, and then that way we can do a full restart on it and boot into
the actual Hirons. Now remember, I already saved the lab before the challenge started,
so when I do this, this will not affect how you, the learner, go into AdeptLabs moving forward,
because this will reset back to template mode for you when you go into the actual skill itself.
So when you see the loading files, you know that this is a Hirons load and not a Windows 10,
because Windows 10 has its own little boot screen and everything. Now concerning on a physical
workstation, if you bring in the actual hard drive from a location inside for examination like this,
when you go into your UEFI configuration for boot manager, you will have to assign the proper EFI
file, which is searchable inside of the actual ISO. Like I said, I have my ISO using a tool
called Rufus put onto one of my USB sticks, which is the Legos, and I just boot from that,
and so that way it's easier for me to be able to break into the physical system itself.
Now as Hirons is actually loading up, we remembered that it was actually going through
its little startup phase, and part of that is actually installing network drivers for it to
be able to communicate on the network or internet. You might want to do this in an isolated environment,
and one of the reasons for this is that if the hard drive that you have cloned or forensics copied,
it has a, let's say, a beacon to call home or connect to a shared drive or something like that,
that network connection on the open network itself could alert the organization that is
subject to this pen test that one of their systems is in a location that it should not be,
tipping them off that the hard drive is out of place. And certain security measures could be
taken by the organization, thus preventing you from being able to conduct further examination
using this avenue of approach. And one thing you could do as we go into the start menu,
go into all programs, into the security, passwords, and then the NT password edit,
is that you could put it in an isolated VLAN to monitor it through network monitoring tools like
Wireshark to see whatever it is that it is trying to communicate to. That way you could get an idea
of more inter-private network activity and get an idea of what systems are actually in that private
network, so long as they're within the IP scopes approved for your rules of engagement. Now again,
remember, this newer version of Hirens does identify that the C drive is the physical hard
drive. So if I go up all the way into this PC, and let me move this over real quick, you can see
that we have C drive and X drive. X drive being the RAM drive for all you older folks out there
in the Windows 3.11 and 95 world, where the operating system is loaded into. And you'll
notice too that the size of the actual X drive, let me zoom in for this real quick, is going to
be the same size of the actual RAM allocated to the virtual machine, or it would be the same size
of what's on the physical system itself if you used a physical system. And this is where that
four gig minimum threshold comes into play, that if you have something less than four gigs, and I
know this is like 3.999 or you know not exactly four, but it's four gigs. But if it's less than
four gigs, let's say you're running a two gig system like Windows 7 or something like that,
you would have to use the one-on-one version of the Hirens to be able to go in and do this,
because it's a more condensed version allowing it to be able to sit in that live memory and have
all the tools available for you. Now I'm going to go ahead and click open because the SAM is
already selected, and I'm going to select learner and change the password. At this point, I'll just
say Kali, and click OK. And I'm going to save changes. Now you could do this with other accounts
as well too, and if one of the accounts is locked, you will have the option to unlock it.
And you could just do that as a way to be able to get into other service accounts and see if
there's any passwords or policies in there you want to take a look at. But you'll notice that
there is nothing in here that says account is locked, other than when you actually highlight it,
the unlock button becomes clickable. So the ID number 504 WGAD utility account
is an account that is locked that we've seen before when we did the hash dumps.
So I'm just going to hit exit since I've already saved the changes, and at this point I just need
to restart the system. Now as I'm restarting the system, I'll walk back over to Hyper-V real quick,
go into my settings, and remove the ISO from being inside of the CD-DVD tray.
That way when it boots back up, it'll go into Windows 10 mode as far as its boot manager goes
inside of the UEFI. Because I still left DVD as being in the beginning of the actual boot order
itself. So I'll be right back after this loads up and we can log in. All right, we're here and
we're at our login screen for our Windows 10, 1, 2, 3, 4, which is Kali. And that four characters,
the reference account is currently locked and may not be logged on to. Well, good news,
the password was set, but the account is locked. So as a bonus, we're going to go unlock the
account. Back in it real quick, I didn't want to go through the startup and everything because
we've already seen that. I've selected ID 1001 Learner, and you can see that unlock is highlighted
for clickable. So I'm going to go ahead and click that and then save changes and then restart the
system. Sometimes this does happen because it's a quirk that whenever the SAM is modified, that for
some reason it does lock the account, or it may be something I just thought about that the password
doesn't meet the complexity requirements. Let's reset the password again, change password. This
time we're going to say, what's a good password for this? Kali, Kali, and then click okay.
I've totally forgot about those complexity requirements because the local security policy
is still active regardless of what kind of password we set on here. All right,
our moment of truth, let's see if we can get in. 1, 2, 3, 4, 1, 2, 3, 4.
It looks like we're being able to log in. Like I said, you might have to play around with this a
little bit, do it a couple of times and get more familiar with it on your own.
But that's the general idea of how to be able to use Hiren against Windows 10 as an example,
and reset user credentials or even go through and do more stuff if you decide to play around
with it a little bit more. Now, don't be afraid to start poking around and using Hiren,
like this one right here, the Windows Login Unlocker. You may find it to be a little bit
more handy than the other NT password cracker that we've been using as familiarization.
Just something to think about. In the skills coming up, we're going to be messing around
with some other tools because we're not always going to have physical access to the system.
We need to be able to work and deal with systems as they come about on the network. So, there are
a couple of other tools that we're going to be messing around with. We're going to be messing
on the network. So, there are a couple of other password tools that we need to go over,
and these tools are the ones that you're going to see that have flexibility on the actual system
and network overall. I hope this has been informative for you. I'd like to thank you
for viewing.