Hacking with Ease: Pass the Hash Attack Made Simple with CrackMapExec

Note: The CrackMapExec repository is no longer actively maintained. It has been succeeded by NetExec. For more details, click here.

In this blog, we’re going to unravel the secrets of one particularly powerful attack method: “Pass the Hash Attack.” And to make things even more accessible, we’ll be exploring how to perform this attack with the help of the versatile tool, CrackMapExec.

Fig: crackmapexec

before we dive in, let’s understand what a Hash is.

What’s in a Hash? Unraveling the Delicious Mystery!

In its simplest form, a hash is a cryptographic function that takes input data of any size and transforms it into a fixed-size string of characters, usually represented in hexadecimal format.

This process is a one-way street, meaning that once data is hashed, it cannot be reverted back to its original form. Picture it as a blender that takes various ingredients (data) and blends them together, creating a unique smoothie (hash) that bears no resemblance to the original components.

CrackMapExec: Unleashing Cyber Ninja Skills for Network Adventures!

CrackMapExec (CME) is a popular open-source post-exploitation tool used in the field of cybersecurity and penetration testing. It is designed to automate and simplify the process of security assessments for large Active Directory networks.

The primary goal of CrackMapExec is to provide security professionals, ethical hackers, and red teamers with a versatile toolset that helps identify potential vulnerabilities and weaknesses within the targeted network.

CME makes heavy use of the impacket library for working with network protocols and performing a variety of post-exploitation techniques.\

You can find out more about this Tool here.

With CrackMapExec, we can perform various actions like credential harvesting, brute-force attack, service attack and many more.

In this blog, we will focus on pass the hash attack using CrackMapExec.

Pass the Hash Attack: Cracking the Code to Unauthorized Access?

In the realm of cybersecurity, Pass the Hash (PtH) attack is a formidable technique used by hackers to gain unauthorized access to computer systems and networks. This attack method doesn’t involve stealing plaintext passwords but rather exploits hashed credentials to bypass authentication mechanisms.

When users log in to a system or network, their passwords are not stored in plain text. Instead, most systems use a one-way hashing algorithm to convert the passwords into fixed-length hashes. These hashes are then stored in databases or security systems.

In a traditional authentication process, when a user enters their password, the system hashes it and compares the result to the stored hash. If they match, the user gains access.

In a Pass the Hash attack, the attacker gains access to a system or network and extracts the hashed credentials from the system’s memory or storage. The attacker doesn’t need to know the original password; they only need the hash.

Armed with the stolen hash, the attacker can use it to authenticate to other systems within the network where the same user credentials are valid.

The Demonstration of this attack is performed in my Active Directory Home lab setup. You are also encouraged to perform this attack in your own AD home lab network.

Pass The Hash Attack : A demonstration

First we will install crackmapexec in our linux machine.

sudo apt install crackmapexec

Now it’s important to note that this attack requires to have a initial foothold like access to a shell or a set of legitimate credentials.

Considering we have intial set of credentials, and we are able to dump the hashes from the target windows system using tools like secretsdump.py

Now we can think of dumping the hashes offline, and try to crack them using Hashcat or any other preferred password cracking tool.

But, not every hash is meant to be cracked. Some hashes are happy just staying encrypted and snug in their security blankets.

Pass the Hash attacks doesn’t require the attacker to spend time and resources cracking complex passwords. The attacker simply reuses the stolen hash, saving time and increasing their chances of success.

Now, let’s say we have legitimate set of credentials and we used them to dump the hashes. We now have following information about our target along with its hash.

Domain Name: MARVEL.local
Username: fcastle
NTLM Hash: 58a478135a93ac3bf058a5ea0e8fdb71

Now, we can try to either crack this hash or use it by passing it throughout the network and check whether we can login into other machines using crackmapexec.

 crackmapexec smb <I.P address/subnet> -u <username> -d <Domain Name> -H <Hash>

CrackMapExec can also be used to execute a command via -x option. But for this blog we will only focus on performing pass the hash attack. Although you are welcome to play with this option and see what you might unravel.

After executing the command, we can find that the user was also able to logon to the FRANK Machine present in the Network.

Fig: CrackMapExec performing pass the hash attack

Now, We can try to login into the Machine using Psexec.py

psexec.py “username”:@<I.P Address> -hashes <hash>

Et Voila ! we got access to the machine.

Now with the security point of view, we will understand why this attack is highly effective.

1. No Password Cracking: Unlike traditional password cracking, Pass the Hash doesn’t require the attacker to spend time and resources cracking complex passwords. The attacker simply reuses the stolen hash, saving time and increasing their chances of success.
2. Avoiding Detection: By leveraging hashes instead of plaintext passwords, Pass the Hash attacks can evade some security measures designed to detect password cracking attempts.
3. Persistent Access: Once an attacker gains access to a system and extracts hashed credentials, they can use those hashes indefinitely until the passwords are changed or the compromised accounts are disabled.

Mitigating Pass the Hash Attacks

1. Strong Password Policies: Encourage users to create strong, complex passwords to increase the difficulty of password cracking.
2. Multi-Factor Authentication (MFA): Implement MFA to add an extra layer of security, making it more challenging for attackers to compromise accounts.
3. Regular Password Changes: Enforce regular password changes to minimize the window of opportunity for attackers to use stolen hashes.
4. Monitoring and Intrusion Detection: Employ robust monitoring and intrusion detection systems to detect suspicious activities, such as lateral movement using Pass the Hash.
5. Least Privilege: Limit user privileges to only what is necessary for their roles to reduce the potential impact of a successful attack.

Conclusion

In conclusion, Pass the Hash attack is a crafty and potent technique employed by attackers to maneuver through computer systems and networks without the need to crack plaintext passwords.

By grasping the mechanics behind this technique, organizations can fortify their defenses and develop robust strategies to mitigate the risks posed by such attacks.

Keep in mind that by staying vigilant, following best security practices, and adding a dash of humor, we can outwit the mischievous intentions of Pass the Hash attacks and safeguard our data from the clutches of cyber mischief. So, stay secure and keep smiling! 😄🔒