search
GitHub: HorrorClause

Network Services

Let us imagine that we want to manage a Windows server over the network. Accordingly, we need a service that allows us to access the system, execute commands on it, or access its contents via a GUI or the terminal. In this case, the most common services suitable for this are RDP, WinRM, and SSH. SSH is now much less common on Windows, but it is the leading service for Linux-based systems.

All these services have an authentication mechanism using a username and password. Of course, these services can be modified and configured so that only predefined keys can be used for logging in, but they are configured with default settings in many cases.

hashtag
WinRM

Windows Remote Managementarrow-up-right (WinRM) is the Microsoft implementation of the network protocol Web Services Management Protocolarrow-up-right (WS-Management). It is a network protocol based on XML web services using the Simple Object Access Protocolarrow-up-right (SOAP) used for remote management of Windows systems. It takes care of the communication between Web-Based Enterprise Managementarrow-up-right (WBEM) and the Windows Management Instrumentationarrow-up-right (WMI), which can call the Distributed Component Object Modelarrow-up-right (DCOM).

However, for security reasons, WinRM must be activated and configured manually in Windows 10. Therefore, it depends heavily on the environment security in a domain or local network where we want to use WinRM. In most cases, one uses certificates or only specific authentication mechanisms to increase its security. WinRM uses the TCP ports 5985 (HTTP) and 5986 (HTTPS).

A handy tool that we can use for our password attacks is CrackMapExecarrow-up-right, which can also be used for other protocols such as SMB, LDAP, MSSQL, and others. We recommend reading the official documentationarrow-up-right for this tool to become familiar with it.

hashtag
CrackMapExec

Installing CrackMapExec

We can install CrackMapExec via apt on a Parrot host or clone the GitHub repoarrow-up-right and follow the various installationarrow-up-right methods, such as installing from source and avoiding dependency issues.

$ sudo apt-get -y install crackmapexec

CrackMapExec Menu Options

Running the tool with the -h flag will show us general usage instructions and some options available to us.

$  crackmapexec -h
usage: crackmapexec [-h] [-t THREADS] [--timeout TIMEOUT]
                    [--jitter INTERVAL] [--darrell]
                    [--verbose]
                    {mssql,smb,ssh,winrm} ...

      ______ .______           ___        ______  __  ___ .___  ___.      ___      .______    _______ ___   ___  _______   ______
     /      ||   _  \         /   \      /      ||  |/  / |   \/   |     /   \     |   _  \  |   ____|\  \ /  / |   ____| /      |
    |  ,----'|  |_)  |       /  ^  \    |  ,----'|  '  /  |  \  /  |    /  ^  \    |  |_)  | |  |__    \  V  /  |  |__   |  ,----'
    |  |     |      /       /  /_\  \   |  |     |    <   |  |\/|  |   /  /_\  \   |   ___/  |   __|    >   <   |   __|  |  |
    |  `----.|  |\  \----. /  _____  \  |  `----.|  .  \  |  |  |  |  /  _____  \  |  |      |  |____  /  .  \  |  |____ |  `----.
     \______|| _| `._____|/__/     \__\  \______||__|\__\ |__|  |__| /__/     \__\ | _|      |_______|/__/ \__\ |_______| \______|

                                         A swiss army knife for pentesting networks
                                    Forged by @byt3bl33d3r using the powah of dank memes

                                                      Version: 5.0.2dev
                                                     Codename: P3l1as

optional arguments:
  -h, --help            show this help message and exit
  -t THREADS            set how many concurrent threads to use (default: 100)
  --timeout TIMEOUT     max timeout in seconds of each thread (default: None)
  --jitter INTERVAL     sets a random delay between each connection (default: None)
  --darrell             give Darrell a hand
  --verbose             enable verbose output

protocols:
  available protocols

  {mssql,smb,ssh,winrm}
    mssql               own stuff using MSSQL
    smb                 own stuff using SMB
    ssh                 own stuff using SSH
    winrm               own stuff using WINRM

CrackMapExec Protocol-Specific Help

Note that we can specify a specific protocol and receive a more detailed help menu of all of the options available to us. CrackMapExec currently supports remote authentication using MSSQL, SMB, SSH, RDP and WinRM.

CrackMapExec Usage

The general format for using CrackMapExec is as follows:

You can also use the flag:

This will continue to bruteforce after finding the first successful combo.

The appearance of (Pwn3d!) is the sign that we can most likely execute system commands if we log in with the brute-forced user. Another handy tool that we can use to communicate with the WinRM service is Evil-WinRMarrow-up-right, which allows us to communicate with the WinRM service efficiently.

hashtag
Evil-WinRM

Installing Evil-WinRM

Evil-WinRM Usage

If the login was successful, a terminal session is initialized using the Powershell Remoting Protocolarrow-up-right (MS-PSRP), which simplifies the operation and execution of commands.

hashtag
SSH

Secure Shellarrow-up-right (SSH) is a more secure way to connect to a remote host to execute system commands or transfer files from a host to a server. The SSH server runs on TCP port 22 by default, to which we can connect using an SSH client. This service uses three different cryptography operations/methods: symmetric encryption, asymmetric encryption, and hashing.

Symmetric Encryption

Symmetric encryption uses the same key for encryption and decryption. However, anyone who has access to the key could also access the transmitted data. Therefore, a key exchange procedure is needed for secure symmetric encryption. The Diffie-Hellmanarrow-up-right key exchange method is used for this purpose. If a third party obtains the key, it cannot decrypt the messages because the key exchange method is unknown. However, this is used by the server and client to determine the secret key needed to access the data. Many different variants of the symmetrical cipher system can be used, such as AES, Blowfish, 3DES, etc.

Asymmetrical Encryption

Asymmetric encryption uses two SSH keys: a private key and a public key. The private key must remain secret because only it can decrypt the messages that have been encrypted with the public key. If an attacker obtains the private key, which is often not password protected, he will be able to log in to the system without credentials. Once a connection is established, the server uses the public key for initialization and authentication. If the client can decrypt the message, it has the private key, and the SSH session can begin.

Hashing

The hashing method converts the transmitted data into another unique value. SSH uses hashing to confirm the authenticity of messages. This is a mathematical algorithm that only works in one direction.

Hydra - SSH

We can use a tool such as Hydra to brute force SSH. This is covered in-depth in the Login Brute Forcingarrow-up-right module.

To log in to the system via the SSH protocol, we can use the OpenSSH client, which is available by default on most Linux distributions.

hashtag
Remote Desktop Protocol (RDP)

Microsoft's Remote Desktop Protocolarrow-up-right (RDP) is a network protocol that allows remote access to Windows systems via TCP port 3389 by default. RDP provides both users and administrators/support staff with remote access to Windows hosts within an organization. The Remote Desktop Protocol defines two participants for a connection: a so-called terminal server, on which the actual work takes place, and a terminal client, via which the terminal server is remotely controlled. In addition to the exchange of image, sound, keyboard, and pointing device, the RDP can also print documents of the terminal server on a printer connected to the terminal client or allow access to storage media available there. Technically, the RDP is an application layer protocol in the IP stack and can use TCP and UDP for data transmission. The protocol is used by various official Microsoft apps, but it is also used in some third-party solutions.

Hydra - RDP

We can also use Hydra to perform RDP bruteforcing.

Linux offers different clients to communicate with the desired server using the RDP protocol. These include Remminaarrow-up-right, rdesktoparrow-up-right, xfreerdparrow-up-right, and many others. For our purposes, we will work with xfreerdp.

xFreeRDP

hashtag
SMB

Server Message Blockarrow-up-right (SMB) is a protocol responsible for transferring data between a client and a server in local area networks. It is used to implement file and directory sharing and printing services in Windows networks. SMB is often referred to as a file system, but it is not. SMB can be compared to NFS for Unix and Linux for providing drives on local networks.

SMB is also known as Common Internet File Systemarrow-up-right (CIFS). It is part of the SMB protocol and enables universal remote connection of multiple platforms such as Windows, Linux, or macOS. In addition, we will often encounter Sambaarrow-up-right, which is an open-source implementation of the above functions. For SMB, we can also use hydra again to try different usernames in combination with different passwords.

Hydra - SMB

However, we may also get the following error describing that the server has sent an invalid reply.

Hydra - Error

This is because we most likely have an outdated version of THC-Hydra that cannot handle SMBv3 replies. To work around this problem, we can manually update and recompile hydra or use another very powerful tool, the Metasploit frameworkarrow-up-right.

Metasploit Framework SMB_Login

Now we can use CrackMapExec again to view the available shares and what privileges we have for them.

CrackMapExec

To communicate with the server via SMB, we can use, for example, the tool smbclientarrow-up-right. This tool will allow us to view the contents of the shares, upload, or download files if our privileges allow it.

Connecting with Smbclient

PreviousCredential StorageNextPass The Hash (PtH)