In this 3-part series we are demonstrating how nGuard most commonly gains an initial foothold on internal networks, then takes that initial access and pivots through the network to obtain full command and control over systems. If you missed parts I or II, check them out here and here.
In this third part, we are going to round out our initial compromise, show you how we can obtain full command and control over a host, and show you the results of our password cracking attempts. For this part we are going to be using PowerShell Empire. The original tool was deprecated, but later was revived and now is maintained on GitHub. The framework has multiple modules and listed on the GitHub they say, “Empire 4 is a post-exploitation framework that includes pure-PowerShell Windows agents, Python 3.x Linux/OS X agents, and C# agents. It is the merger of the previous PowerShell Empire and Python EmPyre projects. The framework offers cryptologically-secure communications and flexible architecture. On the PowerShell side, Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework.”
To set this attack up and eventually have persistent command and control of a host, which will be called agents, we need to configure the server and the client. In separate terminals we will run these commands:
powershell-empire server
powershell-empire client
Once those are started, we can now set up a listener. In this attack we will need to configure the client to use an http listener. To do this we will configure the Bind IP and host to use our local IP and choose a port to run on.
After the listener is executed, we will see our sever reflect the results:
The next thing we will want to configure is our stager, which will output the encoded PowerShell command we want to execute on our compromised host. To do this we use the http listener and input the command generate.
Now that we have our encoded PowerShell, we want to go back to our Responder and ntlmrelayx tools. We will leave Responder running in the same configuration used in Part II and only have to change our ntlmrelayx command. This time we will add the -c option to have the PowerShell command run on the host, rather than dumping the SAM hashes.
Once our connection using the ntlmrelayx tool is created and our PowerShell command executes we will receive a connection back to our local machine from a compromised host in the form of an agent.
Now that we have an agent, there are many modules and commands we can run to further exploit the compromised host. In the video demonstration below you will see examples of commands like whoami for basic information about the host and mimikatz to look for more hashed and cleartext credentials on the host.
In part I we talked about loading the hashes in our password cracker and when reviewing we can see the password hash for two users were cracked in 4 minutes and 26 seconds!
Although we were able to crack the password in a relatively short time, environments with complex password requirements may take a significant amount of time to crack or will not during the time you have on an engagement. Since this task may be time consuming or unsuccessful it is much easier and quicker to utilize the hashes and not have to rely on discovering cleartext credentials.
Check out the video below to see all these steps live in action:
IIf you have any questions about this attack or want to see if nGuard can perform attacks like this on your internal network during one of our internal penetration testing assessments please reach out to an Account Executive.
