Module 6:

System Hacking

System hacking is the process of testing computer systems and software for
security vulnerabilities that an attacker could exploit to gain access to the
organization’s systems to steal or misuse sensitive information.

1. Footprinting
2. Scanning
3. Enumeration
4. Vulnerability Analysis
5. System Hacking
Gaining Access: The previous phases of hacking, including footprinting and reconnaissance,
scanning, enumeration, and vulnerability assessment, help attackers to identify security
loopholes and vulnerabilities that exist in the target organizational IT assets. Attackers use this
information to gain access to the target organizational system.

 Cracking passwords: Password cracking involves gaining access to low-privileged user

accounts by cracking passwords using techniques such as brute-forcing, password
guessing, and social engineering.
 Vulnerability Exploitation: Attackers exploit the identified vulnerabilities, such as buffer
overflows, to gain root-level access to the target system.

Escalating Privileges: attackers then escalate their privileges to administrative levels, to

perform a protected operation. Attackers exploit vulnerabilities that exist in OSs and software
applications to escalate privileges.

Maintaining Access: Attackers ensure that high levels of access are maintained to perform
malicious activities such as executing malicious applications and stealing, hiding, or tampering
with sensitive system files.
  Executing Applications: Once the attacker has administrator privileges, they can
attempt to install malicious programs such as Trojans, backdoors, rootkits, and
keyloggers, which grant them remote system access and enable them to remotely
execute malicious codes. Installing rootkits allows the attacker to gain access at the OS
level to perform malicious activities. To maintain access for later use, they may even
install backdoors.
 Hiding Files: Attackers use rootkits and steganography techniques to attempt to hide
the malicious files they install on the system, and thus their activities.

Clearing Logs: To maintain future system access, attackers attempt to avoid recognition by
legitimate system users. To remain undetected, attackers wipe out the entries corresponding to
their activities in the system logs, thus avoiding detection by users.

 Covering Tracks: To remain undetected, it is important for the attackers to erase from
the system all evidence of security compromise. To achieve this, they might modify or
delete logs in the system using certain log-wiping utilities, thus removing all evidence of
their presence.

System Hacking Goals: --->>>

1. Gaining Access
2. Escalating Privileges
3. Executing Applications
4. Hiding Files
5. Covering Tracks

#01: Gaining Access: --->>>

Compromising accounts that already exist in the system.

 Cracking Passwords: --->>>

Microsoft Authentication
When users log in to a Windows computer, a series of steps is performed for user
authentication. The Windows OS authenticates its users with the help of three mechanisms
(protocols) provided by Microsoft.

Security Accounts Manager (SAM) Database: ---

Location of SAM file: C:\windows\system32\config\SAM
This would be shadow in Linux.
/etc/passwd
/etc/shadow

 Password List Generator Tools: --->>>

♦ Crunch
♦ Cupp
♦ Cewl

$ crunch -h
crunch <min> <max> <character set> -o <outputfile>
  LLMNR/NBT-NS Poisoning Attack through
SMB

LLMNR: LLMNR is a protocol that allows name resolution without the

requirement of a DNS server. It is able to provide a hostname-to-IP based off
a multicast packet sent across the network asking all listening Network-
Interfaces to reply if they are authoritatively known as the hostname in the
query. It does this by sending a network packet to port UDP 5355 to the
multicast network address. It allows IPv4 and IPv6 hosts and supports all
current and future DNS formats, types, and classes. It is the successor of
NBT-NS.

NBT-NS: NetBIOS name service (NBT-NS) is a Windows protocol that is used

to translate NetBIOS names to IP addresses on a local network. It is
analogous to what DNS does on the internet. Each machine is assigned a
NetBIOS name by the NBT-NS service. Works on UDP port 137. It is the
predecessor of LLMNR.
How to Perform LLMNR/NBT-NS Poisoning Attack:
---
$ sudo python [Link] -I eth0 -wd
For testing purpose Now check your kali IP and paste it windows search bar like this:
You can see we got LLMNR Hash ;)

Let’s Crack Hash Using Hash cat tool: ---

$ hashcat –help | grep NTLM

$ hashcat –m (mode) 5600 <hash file path> <wordlists path> --force –O (-O for
optimization)

$ hashcat –m 5600 NTML_hash.txt [Link] --force –O

Active Directory in Windows: [Link].

 Windows stores user passwords in SAM, or in the Active Directory database in domains.
Passwords are never stored in clear text and are hashed, and the results are stored in
the SAM.
 The system does not store the passwords in plaintext format but in a hashed format, to
protect them from attacks.
 Windows uses the Security Accounts Manager (SAM) database or Active Directory
Database to manage user accounts and passwords in hashed format (a one-way hash).
 The system implements the SAM database as a registry file, and the Windows kernel
obtains and keeps an exclusive filesystem lock on the SAM file.
 As this file consists of a filesystem lock, this provides some measure of security for the
storage of passwords.

It is not possible to copy the SAM file to another location in the case of online attacks. Because
the system locks the SAM file with an exclusive filesystem lock, a user cannot copy or move it
while Windows is running. The lock does not release until the system throws a blue screen
exception, or the OS has shut down. However, to make the password hashes available for
offline brute-force attacks, attackers can dump the on-disk contents of the SAM file using
various techniques. The SAM file uses an SYSKEY function (in Windows NT 4.0 and later
versions) to partially encrypt the password hashes.

......By....Mohit Sambharwal
How Are Hash Passwords Stored in Windows SAM?
 Windows OSs use a Security Account Manager (SAM) database file to store user
passwords.
 The SAM file is stored at %SystemRoot%/system32/config/SAM in Windows systems,
and Windows mounts it in the registry under the HKLM/SAM registry hive. It stores LM
or NTLM hashed passwords.
 NTLM supersedes the LM hash, which is susceptible to cracking.

Note: LM hashes have been disabled in Windows Vista and later Windows operating systems,
LM will be blank in those systems.

 NTLM Authentication Process: --->>>

NTLM includes three methods of challenge–response authentication: LM, NTLMv1, and

NTLMv2, all of which use the same technique for authentication. The only difference between
them is the level of encryption. In NTLM authentication, the client and server negotiate an
authentication protocol. This is accomplished through the Microsoft-negotiated Security
Support Provider (SSP).
Note: Microsoft has upgraded its default authentication protocol to Kerberos, which provides
stronger authentication for client/server applications than NTLM.

The following steps demonstrate the process and the flow of client
authentication to a domain controller using any NTLM protocol:

 The client types the username and password into the logon window.
 Windows runs the password through a hash algorithm and generates a
hash for the password that is entered in the logon window.
 The client computer sends a login request along with a domain name
to the domain controller.
 The domain controller generates a 16-byte random character string
called a “nonce,” which it sends to the client computer.
 The client computer encrypts the nonce with a hash of the user
password and sends it back to the domain controller.
 The domain controller retrieves the hash of the user password from the
SAM and uses it to encrypt the nonce. The domain controller then
compares the encrypted value with the value received from the client.
A matching value authenticates the client, and the logon is successful.
  Kerberos Authentication: --->>>

 Microsoft has upgraded its default authentication protocol to Kerberos which provides a
stronger authentication for client/server applications than NTLM.
 Kerberos is a network authentication protocol that provides strong authentication for
client/server applications through secret-key cryptography.
 This protocol provides mutual authentication, in that both the server and the user verify
each other’s identity.
 Messages sent through Kerberos protocol are protected against replay attacks and
eavesdropping.
 Kerberos employs the Key Distribution Center (KDC), which is a trusted third party. This
consists of two logically distinct parts: an authentication server (AS) and a ticket-
granting server (TGS). Kerberos uses “tickets” to prove a user’s identity. Microsoft has
upgraded its default authentication protocol to Kerberos, which provides a stronger
authentication for client/server applications than NTLM.

Kerberos Authentication Process: --->>>

 Kerberos is a network authentication protocol that provides strong authentication for
client/server applications through secret-key cryptography, which provides mutual
authentication.
 Both the server and the user verify each other’s identity.
 Messages sent through this protocol are protected against replay attacks and
eavesdropping.
 Kerberos employs the KDC, which is a trusted third party, and consists of two logically
distinct parts: an AS and a TGS.
 The authorization mechanism of Kerberos provides the user with a ticket-granting ticket
(TGT) that serves post-authentication for later access to specific services, Single Sign-On
via which the user need not re-enter the password again to access any authorized
services.
 Notably, there is no direct communication between the application servers and the KDC;
the service tickets, even if packed by TGS, reach the service only through the client who
is willing to access them.

 Types of Password Attacks: --->>>

 Non-Electronic Attacks: The attacker does not need technical knowledge to crack
the password, hence it is known as a non-technical attack.

 Social Engineering: Convincing people to reveal passwords.

 Shoulder Surfing: Looking at either the user’s keyboard or screen while he/she is
logging in.
 Dumpster Diving: Searching for sensitive information in the user’s trash-bins, printer
trash bins, and in/on the user’s desk for sticky notes.

 Active Online Attacks: The attacker performs password cracking by directly

communicating with the victim’s machine.
  Dictionary Attack: A dictionary file is loaded into the cracking application that runs
against user accounts.
 Brute-Force Attack: The program tries every combination of characters until the
password is broken.
 Rule-based Attack: This attack is used when the attacker gets some information
about the password.

 Trojan/Spyware/Keyloggers: --->>>

 The attacker installs a Trojan/Spyware/Keylogger on the victim's machine to collect the

victim's usernames and passwords.
 The Trojan/Spyware/Keylogger runs in the background and sends back all user
credentials to the attacker.

 Hash Injection Attack/Pass-the-Hash (PtH): --->>>

 A hash injection/PtH attack allows an attacker to inject a compromised hash into a local
session and use the hash to validate network resources.
 The attacker finds and extracts a logged-on domain admin account hash.
 The attacker uses the extracted hash to log on to the domain controller.

This type of attack is possible when the target system uses a hash function as part of the
authentication process to authenticate its users. Generally, the system stores hash values of the
credentials in the SAM database/file on a Windows computer. In such cases, the server
computes the hash value of the user-submitted credentials or allows the user to input the hash
value directly. The server then checks it against the stored hash value for authentication.

Different techniques are used to perform a hash injection/PtH attack:

 The attacker tries to compromise admin privileges to capture cache values of the user’s
password hashes from the local user account database or SAM. However, offline usage
 of these cached hashes can be restricted by the network admin. Hence, this approach
may not always be feasible.
 The attacker dumps the password hashes from the local user account database or SAM
to retrieve password hashes of local users, and gains access to admin accounts to
compromise other connected systems.
 The attacker captures LM or NTLM challenge–response messages between the client
and server to extract encrypted hashes through brute-forcing.
 The attacker retrieves the credentials of local users as well as those belonging to the
security domain from the Windows [Link] process.
 The hacker carries out this attack by implementing the following five steps:
 The hacker compromises one workstation/server using a local/remote exploit.
 The hacker extracts stored hashes using tools such as pwdump7, Mimikatz, etc. and
finds a domain admin account hash.
 The hacker uses tools such as Mimikatz to place one of the retrieved hashes in his/her
local [Link] process and then uses the hash to log on to any system (domain
controller) with the same credentials.
 The hacker extracts all the hashes from the Active Directory database and can now
compromise any account in the domain.

 Passive Online Attacks: The attacker performs password cracking without

communicating with the authorizing party.

 Wire Sniffing: --->>>

 Attackers run packet sniffer tools on the local area network (LAN) to
access and record the raw network traffic.
 The captured data may include sensitive information such as
passwords (FTP, rlogin sessions, etc.) and emails.
 Sniffed credentials are used to gain unauthorized access to the target
system

 As sniffers gather packets at the data link layer, they can grab all the
packets on the LAN of the machine running the sniffer program.
 The majority of sniffer tools are ideally suited to sniff data in a hub
environment.

 Man-in-the-Middle Attack**: --->>>

 In an MITM attack, the attacker acquires access to the communication

channels between the victim and the server to extract the information
needed.
 When two parties are communicating, a man-in-the-middle (MITM)
attack can take place, in which a third party intercepts a
communication between the two parties without their knowledge. The
third party eavesdrops on the traffic and then passes it along. To do
this, the “man in the middle” has to sniff from both sides of the
connection simultaneously.
 In an MITM attack, the attacker acquires access to the communication
channels between the victim and server to extract the information.
 In a replay attack, packets and authentication tokens are captured
using a sniffer. After the relevant information is extracted, the tokens
are placed back on the network to gain access.
 Relatively hard to perpetrate.
 Must be trusted by one or both sides.
 Can sometimes be broken by invalidating traffic.

 Replay Attack: --->>>

 In a replay attack, packets and authentication tokens are captured

using a sniffer.
  After the relevant info is extracted, the tokens are placed back on the
network to gain access.
 The attacker uses this type of attack to replay bank transactions or
similar types of data transfer, in the hope of replicating and/or altering
activities, such as banking deposits or transfers.

 Offline Attacks: --->>>

The attacker copies the target’s password file and then tries to crack
passwords on his own system at a different location.

-**Rainbow Table Attack (Pre-Computed Hashes) **: --->>>

A rainbow table attack uses the cryptanalytic time–memory trade-off

technique, which requires less time than other techniques.

It uses already-calculated information stored in memory to crack the

encryption.

In the rainbow table attack, the attacker creates a table of all the possible
passwords and their respective hash values, known as a rainbow table, in
advance.

 Rainbow Table: A rainbow table is a precomputed table that contains

word lists like dictionary files and brute-force lists and their hash
values. It is a lookup table specially used in recovering a plaintext
password from a ciphertext. The attacker uses this table to look for the
password and tries to recover it from password hashes.
 Computed Hashes: An attacker computes the hash for a list of
possible passwords and compares it to the pre-computed hash table
(rainbow table). If attackers find a match, they can crack the password.

 Compare the Hashes: An attacker captures the hash of a password

and compares it with the precomputed hash table. If a match is found,
then the password is cracked. It is easy to recover passwords by
comparing captured password hashes to the pre-computed tables.

♦ Tool to create rainbow tables: rtgen

 Password Recovery Tools: --->>>

 Elcomsoft Distributed Password Recovery
 Password Recovery Toolkit
 Hashcat
 Windows Password Recovery Tool
 PCUnlocker

 Tools to Extract the Password Hashes: --->>>

 Pwdump7
 Mimikatz
 LaZAgne
 Powershell Empire
 Ntdsxtract
 CrackMapExec
  Password-Cracking Tools: --->>>
 L0phtCrack
 Ophcrack
 RainbowCrack
 John the Ripper
 Hashcat
 THC-Hydra
 Medusa

 Vulnerability Exploitation: --->>>

Vulnerability exploitation involves the execution of multiple complex, interrelated steps to gain
access to a remote system. The steps involved are as follows:

1. Identify the vulnerability

2. Determine the capability of the vulnerability

3. Determine the risk associated with the vulnerability

4. Develop the exploit

5. Generate and deliver the payload

6. Select the method for delivering – local or remote

7. Gain remote access

-**Exploit Sites**: --->>>

 Exploit Database
 VulDB
 Vulners
 MITRE CVE
-**Buffer Overflow**: --->>>

A buffer overflow happens when a program tries to store more data in a buffer than it can hold.
The extra data overflows into adjacent memory locations and corrupts or overwrites the data in
those locations. This can cause the program to crash or behave unexpectedly. Hackers can
exploit this vulnerability to execute malicious code and gain unauthorized access to a system.

-**Types of Buffer Overflow: --->>>

1. Stack-Based Buffer Overflow

2. Heap-Based Buffer Overflow

#02 Escalating Privileges: --->>>

 An attacker can gain access to the network using a non-admin user account and the next
step would be to gain administrative privileges.
 The attacker performs a privilege escalation attack that takes advantage of design flaws,
programming errors, bugs, and configuration oversights in the OS and software
application to gain administrative access to the network and its associated applications.
 These privileges allow the attacker to view critical/sensitive information, delete files, or
install malicious programs such as viruses, Trojans, or worms.

-**Types of Privilege Escalation**: --->>>

 Horizontal Privilege Escalation: Refers to acquiring the same privileges that have
already been granted, by assuming the identity of another user with the same privileges.
 Vertical Privilege Escalation: Refers to gaining higher privileges than those existing.
-**Privilege Escalation by Exploiting Vulnerabilities**: --->>>
 Attackers exploit software vulnerabilities by taking advantage of programming flaws in a
program, service, or within the operating system software or kernel, to execute
malicious code.
 Exploiting software vulnerabilities allows the attacker to execute a command or binary
on a target machine to gain higher privileges than those existing or to bypass security
mechanisms.
 Attackers using these exploits can access privileged user accounts and credentials.

-**Pivoting and Relaying to Hack External Machines**: --->>>

Pivoting
Pivoting and relaying are the techniques used to find detailed information about the target
network. These techniques are performed after successfully compromising a target system. The
compromised system is used to penetrate the target network to access other systems and
resources that are otherwise inaccessible from the attacking network.
Relaying
In the pivoting technique, only the systems accessible through the compromised systems are
exploited, whereas in the relaying technique, the resources accessible through the
compromised system are explored or accessed. Using pivoting, attackers can open a remote
shell on the target system tunneled through the initial shell on the compromised system. In
relaying, resources present on the other systems are accessed through a tunneled shell session
on the compromised system.
-** Privilege Escalation Tools **: --->>>

 BeRoot
 Linpostexp
 PowerSploit
 Windows Exploit Suggester
 PrivescCheck
 Juicy-patato (window)
 Rogue-Patato (window)

#03 Maintaining Access: --->>>

After gaining access and escalating privileges on the target system, now attackers try to
maintain their access for further exploitation of the target system or make the compromised
system a launchpad from which to attack other systems in the network.

-**Executing Applications**: --->>>

 When attackers execute malicious applications, it is called “owning” the system.

 The attacker executes malicious programs remotely in the victim’s machine to gather
the information that leads to exploitation or loss of privacy, gain unauthorized access to
system resources, crack the password, capture the screenshots, install backdoor to
maintain easy access, etc.
-**Keylogger**: --->>>

 Keystroke loggers are programs or hardware devices that monitor each keystroke as
the user types on a keyboard, logs onto a file, or transmits them to a remote location
 It allows the attacker to gather confidential information about the victim such as email
ID, passwords, banking details, chat room activity, IRC, and instant messages
 Physical keyloggers are placed between the keyboard hardware and the operating
system

- Types of Keystroke Loggers: ---

- Hardware Keyloggers: ---
-**Spyware**: --->>>

 Spyware is a stealthy program that records the user's interaction with the computer and
the Internet without the user's knowledge and sends the information to the remote
attackers.

Spyware hides its process, files, and other objects in order to avoid detection and removal.

 It is like a Trojan horse, which is usually bundled as a hidden component of freeware

programs that can be available on the Internet for download.
 It allows the attacker to gather information about a victim or organization such as email
addresses, user logins, passwords, credit card numbers, and banking credentials.

-**Rootkits**: --->>>
  Rootkits are programs that hide their presence as well as attacker’s malicious activities,
granting them full access to the server or host at that time, and in the future.
 Rootkits replace certain operating system calls and utilities with their own modified
versions of those routines that, in turn, undermine the security of the target system
causing malicious functions to be executed.
 A typical rootkit comprises of backdoor programs, DDoS programs, packet sniffers, log-
wiping utilities, IRC bots, etc.

What is Steganography?

1. Steganography is a technique of hiding a secret message within an ordinary message

and extracting it at the destination to maintain confidentiality of data.
2. Utilizing a graphic image as a cover is the most popular method to conceal the data in
files.
3. The attacker can use steganography to hide messages such as a list of the compromised
servers, source code for the hacking tool, or plans for future attacks.

For example, attackers can hide a keylogger inside a legitimate image; thus, when the victim
clicks on the image, the keylogger captures the victim’s keystrokes.

-**Types of Steganography**: --->>>

-** Image Steganography**: --->>>
In image steganography, the information is hidden in image files of different formats such
as .PNG, .JPG, and .BMP

Image steganography tools replace redundant bits of image data with the message in such a
way that the effect cannot be detected by the human eye

-**Image Steganography Tools**: --->>>

  OpenStego
 StegOnline
 QuickStego
 CryptaPix

-**Document Steganography Tools: --->>>

Document steganography tools help in hiding files within documents, such as text or html files,
using steganography methods.

 StegoStick
 StegJ
 SNOW
 Texto

-**Steganalysis**: --->>>
 Reverse Process of Steganography: ---

 Steganalysis is the art of discovering and rendering covert messages using

steganography.
 It detects hidden messages embedded in images, text, audio, and video.

#04 Clearing Logs: --->>>

-**Covering tracks**: ---

Once intruders have successfully gained administrative access to a system, they will try to cover
their tracks to avoid detection.
Attackers may not wish to delete an entire log to cover their tracks, as doing so may require
admin privileges. If attackers can delete only attack event logs, they will still be able to escape
detection.

-**Techniques Used for Covering Tracks**: --->>>

The main activities that an attacker performs toward removing his/her traces on a computer
are as follows:

 Disabling Auditing: An attacker disables auditing features of the target system.

 Clearing Logs: An attacker clears/deletes the system log entries corresponding to
his/her activities.
 Manipulating Logs: An attacker manipulates logs in such a way that he/she will not be
caught in legal action.
 Covering Tracks on the Network: An attacker uses techniques such as reverse HTTP
shells, reverse ICMP tunnels, DNS tunneling, and TCP parameters to cover tracks on the
network.
 Covering Tracks on the OS: An attacker uses NTFS streams to hide and cover malicious
files in the target system.
 Deleting Files: An attacker uses a command-line tool such as [Link] to delete the
data and prevent recovery of that data in future.
 Disabling Windows Functionality: An attacker disables Windows functionality such as
last access timestamp, hibernation, virtual memory, system restore points, etc. to cover
tracks

-**Manually Clearing Event Log**: ---

For Windows
 Navigate to Start
 Control Panel
 System and Security
 Administrative Tools
 double click Event Viewer
Delete the all the log entries logged while compromising the system

For Linux

 Navigate to /var/log directory on the Linux system

 Open the plain text file containing log messages with text editor /var/log/messages
 Delete all the log entries logged while compromising the system

What can attackers do to clear their online tracks?

 Use private browsing

 Delete history in the address field
 Disable stored history
 Delete private data
 Clear cookies on exit
 Clear cache on exit
 Delete downloads
 Disable password manager
 Clear data in the password manager
 Delete saved sessions
 Delete user JavaScript
 Set up multiple users
 Remove Most Recently Used (MRU)
 Clear toolbar data from browsers
 Turn off AutoComplete

-** Covering BASH Shell Tracks**: ---->>>

 Disabling history: This command disables the Bash shell from saving history. HISTSIZE
determines the number of commands to be saved, which is set to 0. After executing this
command, attackers lose their privilege to review the previously used commands.
 $ export HISTSIZE=0

Clearing the history:

This command is useful in clearing the stored history. It is an effective alternative to disabling
the history command as, in this command, an attacker has the convenience of rewriting or
reviewing the earlier used commands:

$ history –c

This command only deletes the history of the current shell, whereas the command history of
other shells remains unaffected:

$ history -w

Clearing the user’s complete history: This command deletes the complete command
history of the current and all other shells and exits the shell.

$ cat /dev/null > ~.bash_history && history –c && exit

-**Track-Covering Tools**: --->>>

Track-covering tools help the attacker to clean up all the tracks of computer and Internet
activities on the target computer. Track-covering tools free cache space, delete cookies, clear
Internet history and shared temporary files, delete logs, and discard junk.

 CCleaner
 DBAN
 Privacy Eraser
 Wipe
 BleachBit