Module006SystemHacking Flashcards
Disctionary attack is applicable under two situations
-
Methods to improve the success of a dictionary attack
-
What is cryptanalysis
Cryptanalysis is a brute-force attack on an encryption employing a search of the keyspace.
What is Brute Force attack
-
What is Rule based attack
Attackers use this type of attack when they obtain some information about the password. This is a more powerful attack than the dictionary and brute-force attacks, because the cracker knows the password type. For example, if the attacker knows that the password contains a two-or three-digit number, he or she will use some specific techniques to extract the password quickly.
What is Hybrid attack ?
Brute force + dictionary
Syllable Attack
Hackers use this cracking technique when passwords are not known words. Attackers use the dictionary and other methods to crack them, as well as all possible combinations of them.
Combination of brute force and dictionary attack
Password Guessing
The attacker creates a list of all possible passwords from the information collected through social engineering or any other way and tries them manually on the victim’s machine to crack the passwords
- Find a valid user
- Create a list of possible passwords
- Rank passwords from high probability to low
- Key in each password, until correct password is discovered
Manual Password-Cracking Algorithm
FOR loop thing
Default Passwords
- A default password is a password supplied by the manufacturer with new equipment (e.g. switches, hubs, routers) that is password protected
- Attackers use default passwords present in the list of words or dictionary that they use to perform password guessing attack
Active Online Attack: Trojan/Spyware/Keylogger
Attacker installs Trojan/Spyware/Keylogger on victim’s machine to collect victim’s user names and passwords Trojan/Spyware/Keylogger runs in the background and sends back all user credentials to the attacker
What is Trojan
A Trojan is a program that masks itself as a benign application. The software initially appears to perform a desirable or benign function but instead steals information or harms the system. With a Trojan, attackers can gain remote access and perform various operations limited by user privileges on the target computer.
What is Spyware
Spyware is a type of malware that attackers install on a computer to secretly gather information about its users without their knowledge. Spyware hides itself from the user and can be difficult to detect.
What is keylogger
A keylogger is a program that records all user keystrokes without the user’s knowledge. Keyloggers ship the log of user keystrokes to an attacker machine or hide it in the victim’s machine for later retrieval. The attacker then scrutinizes them carefully for finding passwords or other useful information that could compromise the system.
Active Online Attack Using USB Drive
- You need to download PassView, a password hacking tool.
- Copy the downloaded .exe PassView file to the USB drive.
- Create a Notepad document, and put the following content or code in the notepad: [autorun] en=launch.bat
After writing this content into Notepad, save the document as autorun.inf and copy this file to the USB drive.
- Open Notepad, and write the following content: start pspv.exe/stext pspv.txt After that, save file as launch.bat and copy this file to the USB drive.
- Insert the USB drive and the autorun window pop-up appears (if enabled).
- PassView (or other password-hacking tool) runs in the background and stores the passwords in the .txt files on the USB drive.
Active Online Attack: Hash Injection Attack
This type of attack is possible when the target system uses a hash function as part of the authentication process to authenticate its users. Generally, the system stores hash values of the credentials in the SAM database/file on a Windows computer. In such cases, the server computes the hash value of the user-submitted credentials or allows user to input the hash value directly. The server then checks it against the stored hash value for authentication. Attackers take advantage of such authentication mechanisms and first exploit the target server to retrieve the hashes from the SAM databases. They then input the hashes acquired directly into the authentication mechanism to authenticate with stolen user’s pre-computed hashes. Thus, in a hash injection attack, the attackers inject a compromised hash into a local session and then use the hash to authenticate to the network resources.
LLMNR, NBT-NS
LLMNR (Link Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service)
Active Online Attack: LLMNR/NBT-NS Poisoning
-
LLMNR port
-
NBT-NS port
-
Steps in LLMNR/NBT-NS
- User sends a request to connect to the data sharing system, \DataServer which she mistakenly typed as \DtaServr.
- The \DataServer responds to the user saying that it does not know the host named \DtaServr.
- The user then performs LLMNR/NBT-NS broadcast to find out if anyone in the network knows the host name\DtaServr.
- The attacker replies to the user saying that it is \DataServer and accepts user NTLMv2 hash and responds to the user with an error.
LLMNR/NBT-NS Poisoning Tools
Responder.py
Passive Online Attack: Wire Sniffing
-
Passive Online Attacks: Man-in-the-Middle and Replay Attack
In a MITM attack, the attacker acquires access to the communication channels between victim and server to extract the information.
In a replay attack, packets and authentication tokens are captured using a sniffer. After the relevant info is extracted, the tokens are placed back on the network to gain access.
Relatively hard to perpetrate
Must be trusted by one or both sides
Can sometimes be broken by invalidating traffic
Why its not easy to implement mitm attacks
This type of attack is often used in telnet and wireless technologies. It is not easy to implement such attacks because of the TCP sequence numbers and the speed of the communication. This method is relatively hard to perpetrate and can sometimes be broken by invalidating the traffic.
Which attack is used to replay back transactions
Reply Attack.
What is a rainbow attack
A rainbow table attack uses the cryptanalytic time-memory trade-off technique, which requires less time than some other techniques. It uses already-calculated information stored in memory to crack the cryptography. In the rainbow table attack, the attacker creates a table of all the possible passwords and their respective hash values, known as a rainbow table, in advance.
What is contained in Rainbow table
Dictionary files brute force lists and their hashes
Rainbow attack is time consuming ?
Yes
Why rainbow attack can be successful
Due to thier smaller keyspace and shorter length
How rainbow attacks can be prevented
Keystreching and random salting
Tools to create Rainbow tables: rtgen and Winrtgen
rtgen The rtgen program needs several parameters to generate a rainbow table. Syntax for the command line is http://project-rainbowcrack.com
rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index
Winrtgen is a graphical rainbow table generator that supports LM, FastLM, NTLM, LMCHALL, HalfLMCHALL, NTLMCHALL, MSCACHE, MD2, MD4, MD5, SHA1, RIPEMD160, MySQL323, MySQLSHA1, CiscoPIX, ORACLE, SHA-2 (256), SHA-2 (384), and SHA-2 (512) hashes
http://www.oxid.it
What hashes Winrtgen supports
Winrtgen supports LM, FastLM, NTLM, LMCHALL, HalfLMCHALL, NTLMCHALL, MSCACHE, MD2, MD4, MD5, SHA1, RIPEMD160, MySQL323, MySQLSHA1, CiscoPIX, ORACLE, SHA-2 (256), SHA-2 (384), and SHA-2 (512) hashes.
What is Offline Attack: Distributed Network Attack
A Distributed Network Attack (DNA) is a technique used for recovering password-protected files that utilizes the unused processing power of machines across the network to decrypt passwords.
Features of Distributed Network Attack
- Reads statistics and graphs easily
- Adds user dictionaries to crack the password
- Optimizes password attacks for specific languages
- Modifies the user dictionaries
- Comprises the stealth client installation functionality
- Automatically updates client while updating the DNA server
Security Accounts Manager (SAM) Database
- Windows uses the Security Accounts Manager (SAM) database or Active Directory Database to manage user accounts and passwords in the hashed format (one-way hash
- The system implements SAM database as a registry file, and the Windows kernel obtains and keeps an exclusive file system lock on the SAM file.
NTLM
NTLM (NT LAN Manager) is a default authentication scheme that performs authentication using a challenge/response strategy. Because it does not rely on any official protocol specification, there is no guarantee that it works correctly in every situation. It has been on some Windows installations, where it worked successfully. NTLM authentication consists of two protocols: NTLM authentication protocol and LM authentication protocol. These protocols use different hash methodology to store users’ passwords in the SAM database.
does ntml use SAM datbase
-
two protocols used in ntlm
-
Kerberos Authentication
- secret-key cryptography
- mutual authentication
- KDC trusted 3rd party => AS, TGS
- Stronger for client server authentication than NTLM
If you have to protect against reply attacks and eves dropping which authentication protocol will you use ?
kerberos
How Hash Passwords Are Stored in Windows SAM?
-
NTLM LM hashes in various versions of windows
NTLM supersedes the LM hash, which is susceptible to cracking. New versions of Windows still support LM hashes for backward compatibility; however, Vista and later Windows versions disable LM hash by default.
when is it not possible to capture LM hashes ?
It is not possible to calculate LM hashes for passwords exceeding 14 characters in length.
NTLM 3 methods of challenge-response
LM, NTLMv1, NTLMv2
In NTLM authentication, the client and server negotiate an authentication protocol. This is accomplished through the Microsoft negotiated Security Support Provider (SSP).
SSP
-
NTLM diagram
-
“nonce”
-
Kerberos Authentication Diagram
-
Autherization in Kerberos
- The authorization mechanism of Kerberos provides the user with a Ticket Granting Ticket (TGT) that serves post-authentication for later access to specific services, Single Sign-On by which the user need not re-enter the password again for accessing any authorized services.
- It is important to note that there is no direct communication between the application servers and Key Distribution Center (KDC); the service tickets, even if packed by TGS, reach the service only through the client willing to access them.
What is password salting
Password salting is a technique where random string of characters are added to the password before calculating their hashes
Advantage: Salting makes it more difficult to reverse the hashes and defeat pre-computed hash attacks
Are Windows password hashes are salted ???
Windows password hashes are not salted
More about salting
In cryptography, a “salt” consists of random data bits used as an input to a one-way function, the other being a password. Instead of passwords, the output of the one-way function can be stored and used to authenticate users. A salt combines with a password by a key derivation function to generate a key for use with a cipher or other cryptographic algorithm. This technique generates different hashes for the same password. This makes cracking the passwords difficult.
Tools to exract password hashes
- pwdump7 extracts LM and NTLM password hashes of local user accounts from the Security Account Manager (SAM) database
- gdump works like pwdump but also extracts cached credentials and allows remote network execution fgdump.exe -h 192.168.0.10 -u AnAdministrativeUser -p l4mep4ssw0rd Dumps a remote machine (192.168.0.10) using a specified user
Which types of password hashes and from where pwdump7 gets them
-
which password hash extraction tool extracts cached credentials and allows remote network execution ?
fgdump
Password Cracking Tools: L0phtCrack, ophcrack, Rainbowcrack
- Password cracking tools allow you to reset unknown or lost Windows local administrator, domain administrator, and other user account passwords.
- L0phtCrack : L0phtCrack is a password auditing and recovery application packed with features such as scheduling, hash extraction from 64-bit Windows versions, and networks monitoring and decoding
- ophcrack : ophcrack is a Windows password cracker based on rainbow tables. It comes with a Graphical User Interface and runs on multiple platforms
- RainbowCrack : RainbowCrack cracks hashes with rainbow tables. It uses time-memory tradeoff algorithm to crack hashes.
Other password cracking tools
Cain & Abel (http://www.oxid.it)
Windows Password Recovery Tool (https://www.windowspasswordsrecovery.com)
Windows Password Key (https://www.lostwindowspassword.com)
hashcat (https://hashcat.net)
Passware Kit Forensic (https://www.passware.com)
John the Ripper (http://www.openwall.com)
THC-Hydra (https://github.com)
InsidePro (http://www.insidepro.com)
HashKiller.co.uk (https://hashkiller.co.uk)
LSASecretsView (http://www.nirsoft.net)
Password Cracker (http://www.amlpages.com)
Windows Password Recovery (https://www.passcape.com)
Password Recovery Bundle (https://www.top-password.com)
JRecoverer Database Bundle(http://www.lcpsoft.com)
Hash Suite (http://hashsuite.openwall.net)
Medusa (http://foofus.net)
Password Unlocker Bundle (https://www.passwordunlocker.com)
Offline NT Password & Registry Editor (https://pogostick.net)
How to defend against Password Cracking
- Enable information security audit to monitor and track password attacks
- Do not use the same password during password change
- Do not share passwords
- Do not use passwords that can be found in a dictionary
- Do not use clear text protocols and protocols with weak encryption
- Set password change policy to 30 days
- Avoid storing passwords in an unsecured location
- Do not use any systems default passwords
- Make password guess hard by using 8 to 12 alpha numerical characters in combination of uppercase lowercase letters numbers and symbols
- Ensure that applications neither store passwords to memory nor write them to disk in their text
- Use random string salt as prefix or suffix in password before encrypting
- Use SYSKEY with strong password to encrypt and protect SAM database
- Never use passwords such as birth of date spouse of child’s or pets name
- Monitor server logs for brute force attack on user accounts
- Lockout an account subject to do many incorrect password guesses
How to Defend against LLMNR/NBT-NS Poisoning
Add image
DYLD_INSERT_LIBRARIES
OS X similar to windows is vulnerable to dynamic library attacks. OS X provides several legitimate methods such as setting the DYLD_INSERT_LIBRARIES environment variable, which are user specific. These methods force the loader to load malicious libraries automatically into a target running process. OS X allows loading of weak dylibs (dynamic library) dynamically, which allows an attacker to place a malicious dylib in the specified location. In many cases, the loader searches for dynamic libraries in multiple paths. This helps an attacker to inject a malicious dylib in one of the primary directories and simply load the malicious dylib at runtime. Attackers can take advantage of such methods to perform various malicious activities such as stealthy persistence, run-time process injection, bypassing security software, bypassing Gatekeeper, etc.
Privilege escalation
-
Privilege escalation using DLL hijacking
-
Privilege escalation by exploiting vulnerabilities
-
Privilege escalation using DYLIB hijacking
-
Privilege exclusion using Spectre and meltdown vulnerabilities
-
Other privilege escalation techniques
-
How to defend against privilege escalation
-
Access token manipulation
-
Application shipping
-
File system permission weakness
-
Parth interception
-
Scheduled task
-
