Pass the hash

Printable View

December 19th, 2009, 03:41 AM
Keith

Pass the hash

I have setup a domain environment in vmware with Windows XP SP2 and Windows 2003 Server. I'm trying to pass the hash to elevate my privileges. I've logged into XP and have administrative privileges and can get hashes for domain accounts along with local accounts.

I have tried 2 tools, pass the hash toolkit and msvctl. With both i provide the username and hashes (lm and ntlm) and run cmd. In that new command prompt i try to map a network drive but when i do it asks for a password, so it looks like it is working somewhat but not completely. When i go to the task manager to see who owns the process it is the logged in user and not the elevated user. I've tried doing it with the local administrator but it is still owned by the local user

Any thoughts on why it's not working?
December 19th, 2009, 05:40 AM
Linen0ise

this page might give you a clue. You probably want to jump to steps 5-7

http://carnal0wnage.blogspot.com/200...sh-action.html
December 19th, 2009, 06:02 AM
Keith

thanks but i had already found that blog. It appears that is working, it opens the new command prompt but i get invalid password when trying to map the drive and i have given the elevated user rights to the share and have confirmed that they can view it by logging into the system with that account.
December 21st, 2009, 12:44 AM
westin

Hi Keith,

Maybe one of these videos will help?

http://vimeo.com/videos/search:pass%20the%20hash

[maybe I am blind, but where is the option to disable smilies?]
December 21st, 2009, 08:47 AM
t34b4g5

1 Attachment(s)

Quote:

Originally Posted by westin

Hi Keith,

Maybe one of these videos will help?

http://vimeo.com/videos/search:pass%20the%20hash

[maybe I am blind, but where is the option to disable smilies?]

in the Additional Options area when you click the Reply button. :)
December 21st, 2009, 09:12 AM
CybertecOne

If it was a problem with the 'Virtuality' of the scenario - Ensure the virtual switch/network is configured correctly, and that typical IP traffic is successfully going to and from each VM?

Just a thought no one else has mentioned such - I have witnessed some strange network issues with vmware, such as traffic only flowing from workstation to server, but not the other way etc.
December 21st, 2009, 04:18 PM
westin

1 Attachment(s)

Quote:

Originally Posted by t34b4g5

in the Additional Options area when you click the Reply button. :)

hmm... I don't seem to have that option...
December 21st, 2009, 11:45 PM
Keith

Quote:

Originally Posted by CybertecOne

If it was a problem with the 'Virtuality' of the scenario - Ensure the virtual switch/network is configured correctly, and that typical IP traffic is successfully going to and from each VM?

Just a thought no one else has mentioned such - I have witnessed some strange network issues with vmware, such as traffic only flowing from workstation to server, but not the other way etc.

Interesting.... i dont think it is that though. I tried it on my local machine and was just opening another command prompt with another user, but in task manager it still shows up as the original account, shouldnt it show up as the other account?
December 23rd, 2009, 12:05 AM
nihil

Hi westin,

I fixed your post for you :)
December 23rd, 2009, 02:56 AM
westin

Quote:

Originally Posted by nihil

Hi westin,

I fixed your post for you :)

Much appreciated Nihil.
December 23rd, 2009, 03:48 AM
Wazz

Use psexec with Metasploit......
December 29th, 2009, 02:30 AM
Keith

Ok metasploit worked. Still cant get the other tools to work. Does anyone know of any other tools?