Pass-the-Hash (PtH) - Revision history

MDrewitz at 19:14, 17 December 2024

2024-12-17T19:14:35Z

← Older revision		Revision as of 19:14, 17 December 2024
Line 165:		Line 165:
	== Conclusion ==		== Conclusion ==

	The pass-the-hash attack can be a horrifying attack given what kind of privileges it gives the attacker in the case of a successful attack, but this is not the end of the mitigation methods that were implemented with a regular update to the system it should mitigate the attack and protect servers against it. Also, there is a ~~server~~ lining, in that it pushes forward the security of Windows servers and lets the developers focus on improving them to let system administrators have much more secure servers to deal with. Although , it cannot be ruled out completely that attackers would find new approaches to exploit vulnerabilities in authentication protocols.		The pass-the-hash attack can be a horrifying attack given what kind of privileges it gives the attacker in the case of a successful attack, but this is not the end of the mitigation methods that were implemented with a regular update to the system it should mitigate the attack and protect servers against it. Also, there is a silver lining, in that it pushes forward the security of Windows servers and lets the developers focus on improving them to let system administrators have much more secure servers to deal with. Although , it cannot be ruled out completely that attackers would find new approaches to exploit vulnerabilities in authentication protocols.

	== Sources ==		== Sources ==

MDrewitz: Added another vulnerability to LM

2024-12-17T18:50:40Z

Added another vulnerability to LM

← Older revision		Revision as of 18:50, 17 December 2024
Line 47:		Line 47:
	*It did not allow long passwords, but only up to 14 chars.		*It did not allow long passwords, but only up to 14 chars.
	*Only 56 Bit out of 128 Bits were used for the key		*Only 56 Bit out of 128 Bits were used for the key
			*The split of the password when hashing made for two weaker concatenated hashes

NKirnbauer: gendering

2024-10-03T07:43:49Z

gendering

← Older revision		Revision as of 07:43, 3 October 2024
Line 139:		Line 139:
	When the administrator logs in to the employee's pc, the hash value is saved locally in the LSASS process. Now the attack is ready to be carried out.		When the administrator logs in to the employee's pc, the hash value is saved locally in the LSASS process. Now the attack is ready to be carried out.

	Because the employee knows a way to become a local admin ~~he downloads~~ mimikatz, ~~executes~~ it, and ~~types~~ the following:		Because the employee knows a way to become a local admin they download mimikatz, execute it, and type the following:

	privilege::debug;		privilege::debug;

NKirnbauer: gendering

2024-10-03T07:42:34Z

gendering

← Older revision		Revision as of 07:42, 3 October 2024
Line 153:		Line 153:
	sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NTLM_HASH /run:cmd		sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NTLM_HASH /run:cmd

	After this, a cli should open with administrative privileges and the employee is able to extract any information ~~he or she wants~~.		After this, a cli should open with administrative privileges and the employee is able to extract any information they want.

Ikramer at 18:37, 12 March 2024

2024-03-12T18:37:42Z

← Older revision		Revision as of 18:37, 12 March 2024
Line 180:		Line 180:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Pentesting]]

LGross at 15:33, 7 January 2024

2024-01-07T15:33:05Z

Show changes

LGross: /* Introduction */

2024-01-07T14:37:44Z

Introduction

← Older revision		Revision as of 14:37, 7 January 2024
Line 4:		Line 4:
	== Introduction ==		== Introduction ==

	~~Generally~~, ~~passwords are essential for today's security standards. Every account~~, ~~client or server must have~~ a ~~password~~ which ~~protects sensible data from not authorized parties. Despite~~ the ~~importance of keeping passwords securely, people do still not take this term into consideration as much as needed.~~		Since 1993, when Microsoft introduced the Lan Manager, local Windows networks had a weak point which made it possible for an attacker to authenticate themself as a user in the network if they gained access to a machine in the network. A Windows network consists of several systems, machines and protocols which work together to authenticate a user or a machine in said system. But early Windows iterations came with an authentication mechanism which was insecure and easy to attack once an attacker had an entry point into a Windows network.
	~~Therefore,~~ in ~~2016,~~ the Windows ~~Defender Credential Guard~~, a ~~tool included~~ with ~~Windows 10,~~ was ~~released. Consequently, the system becomes more resistant~~ to ~~"Pass The Hash" attacks~~.

	Pass-~~the~~-~~hash is a method used by cyberattackers to~~ authenticate ~~themselves~~ to ~~servers~~, even if they do not have the real password in plaintext! ~~The Attacker gets~~ access to ~~servers or~~ services ~~by using~~ the ~~hash value~~ of the ~~needed~~ password~~. Further~~, ~~due to~~ the ~~weakness of operating systems, like Windows or Linux or~~ authentication protocols ~~like NTLM,~~ the ~~hash value can be read out easily with some special tools~~.		With Pass-The-Hash attackers can authenticate themself to a domain server, even if they do not have the real password in plaintext! On a machine under an attackers control, they can read the hash values of all user who logged onto that machine and gain access to files and services the corresponding users would have access to. Once in possession of the password hash, they can exploit a design weakness in the authentication protocols Windows implements to impersonate themself as registered users in the system.

	~~The authentication~~ protocols ~~authenticate the user~~ by ~~checking the hash~~ of the ~~password instead of the password itself. Hence the hashing algorithm always resolves to the same hash as long as the password is not changed.~~		While still all Windows operating systems implement this protocols, they are not configured by default and a system administrator must switch them on intentionally. So, if no mistakes were made during configuration of the Windows local network, the Pass-The-Hash attack should not be feasible anymore.

	~~This allows the attackers to focus on obtaining the hash~~, ~~which is a lot easier than trying to get~~ the ~~password using brute~~-~~force.~~

	~~While the~~ attack ~~is more common on windows servers environments, it is still possible to attack, for example, a Linux server that is using the same vulnerable protocols that we are going to discuss~~.

	== Pass-the-Hash Attack ==		== Pass-the-Hash Attack ==

MIkic: /* Conclusion */

2023-01-08T16:03:35Z

Conclusion

← Older revision		Revision as of 16:03, 8 January 2023
Line 147:		Line 147:
	== Conclusion ==		== Conclusion ==

	The pass-the-hash attack can be a horrifying attack given what kind of privileges it gives the attacker in the case of a successful attack, but this is not the end of the mitigation methods that were implemented with a regular update to the system it should mitigate the attack and protect servers against it. Also, there is a server lining, in that it pushes forward the security of Windows servers and lets the developers focus on improving them to let system administrators have much more secure servers to deal with. Although , it cannot be ruled out completely that attackers would find a new ~~approach~~ to exploit vulnerabilities in authentication protocols.		The pass-the-hash attack can be a horrifying attack given what kind of privileges it gives the attacker in the case of a successful attack, but this is not the end of the mitigation methods that were implemented with a regular update to the system it should mitigate the attack and protect servers against it. Also, there is a server lining, in that it pushes forward the security of Windows servers and lets the developers focus on improving them to let system administrators have much more secure servers to deal with. Although , it cannot be ruled out completely that attackers would find new approaches to exploit vulnerabilities in authentication protocols.

	== Sources ==		== Sources ==

MIkic: /* Tools */

2023-01-08T15:41:36Z

Tools

← Older revision		Revision as of 15:41, 8 January 2023
Line 77:		Line 77:
	There are some tools which can be used to perform the ”Pass The Hash” attack. Consequently, two of the most popular tools are introduced :		There are some tools which can be used to perform the ”Pass The Hash” attack. Consequently, two of the most popular tools are introduced :

	* ~~samdump2~~		* Samdump2
	* ~~mimikatz~~		* Mimikatz

	=== Samdump2 ===		=== Samdump2 ===

MIkic: /* Demonstration using mimikatz */

2023-01-08T15:35:54Z

Demonstration using mimikatz

← Older revision		Revision as of 15:35, 8 January 2023
Line 139:		Line 139:


	Furthermore, the hash value of the password can even be cracked~~, which was found by Mimikatz~~. If the password is not secure enough such as ”123456789”, you can find out the actual password by using a random free password hash cracker on the internet. This is the reason being,		Furthermore, the hash value of the password can even be cracked. If the password is not secure enough such as ”123456789”, you can find out the actual password by using a random free password hash cracker on the internet. This is the reason being,
	why passwords should be taken much more into consideration.		why passwords should be taken much more into consideration.