Post Compromise Attacks
PRACTICE ! PRACTICE ! PRACTICE !
Last updated
PRACTICE ! PRACTICE ! PRACTICE !
Last updated
If we crack a potential password and or can dump the SAM hashes, either ways we can use both of these to move laterally into the network !
Do not spray the potential passwords on domain accounts because for an example there are 50 machines in a network, the username is still valid but the password isn't and if the suppose the tool which authenticates the domain accounts, fails continously - High chances are there for the domain account to get locked ( due to lockout policy of the user accounts on the domain )
Let's dump some hashes using secretsdump
Whenever we dump the SAM file, we have a (uid : rid : lmhash : nthash)
Upon cracking the nthash, Administrator account doesn't give anything => It's been disabled ( shows nothing, a blank field), whereas Frank Castle's hash returns => Password1
We can pass NTLM hashes around the network but we cannot pass NTLMv2 hashes
Now let's pass the hash instead of providing the password :)
We can even pass the hash via impacket's psexec and gain a shell on the machine !
Hard to prevent it completely, but we can make it more difficult for an attacker to attack !
Limit account re-use
- Avoid re-using local admin password
- Disable guest and administrator accounts
- Limit who is a local administrator
Utilize Strong Passwords
- The Longer the better ( above 14 characters )
- Avoid using common words, instead use long sentences
Privilege Access Management (PAM)
- Check out/in for sensitive accounts when needed
- Automatically rotate passwords on check-out and check-in
- Limits pass attacks as hash/password is strong and constantly rotated
