Accessing accounts without a password by Passing the Hash

 Introduction

This post will demonstrate how it is possible to gain access to administrator accounts without knowing the password. The attack works by passing the users local hash in place of the password.

This attack only works with local SAM hashes(NTLM) and not Domain hashes(NTLM2). As demonstrated in a previous post, these local hashes can be acquired via Local SMB Relay attack. https://swepssecurity.blogspot.com/2021/02/capturing-local-sam-hashes-via-smb.html. Since many administrators use the same passwords for both local and domain accounts it is possible to login to a domain controller and other high value systems using only local hashes.

 

Hash Spraying 

Say you have an Administrators NTLM hash on a network that has hundreds or even thousands of computers. Trying to login with the hash on each and every system would be a near impossible task. Not only that, enumerating the NTLM hashes on each system to gain further access would be even more of a nightmare. Luckily there is a tool called "crackmapexec" which is designed for exactly this purpose and part of Impackets suite. 

crackmapexec is able to use a single hash and spray the entire subnetwork with it to not only try and gain access but once gaining access to a system, dumping all of those local hashes as-well. Crackmapexec is able to spray for the following protococols: ldap, ssh, smb, winrm and mssql. I will be spraying for smb logins. Note the --sam switch to dump the local SAM hashes once accessed.

crackmapexec smb 192.168.1.0/24 -u Administrator -H 64f12cddaa88057e06a81b54e73b949b --sam

 

 

As you can see the Administrator has local accounts on a number of systems including a Server2019 system. 

 

Logging into accounts using the hash

 

 To login to an account using the hash we can use Impackets psexec tool. 

 

psexec.py Administrator:@192.168.1.50 -hashes aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b

 

 

 

 

 

 Mitigation

• Avoid re-using local account passwords
• Disable Guest and Administrator accounts
• Do not use the same passwords for Domain and Local accounts
• Rotate passwords
• Limit the local administrators