In this video, I'm gonna hack Michael's password on his Windows computer,
and I'm gonna show you how it will involve grabbing his password hash and
cracking it with tools from Callie Lennox.
So we're gonna wait for him to go to the bathroom.
He normally lays his computer unlocked, which is really bad. Don't do that.
So we're gonna wait and watch and then we're gonna rush in there. All right,
there he goes. Let's go to the bathroom. All right, this is our window. Come on,
come on, come on, let's go. I forgot about coming. Okay. Okay, now we can hack.
Almost built it. Wait, what now?
Disclaimer,
what I'm about to show you is a real hacking technique and should only be used
ethically.
Meaning you have explicit permission and you're following all the rules.
And in this situation, I'm Michael's boss, so I make the rules.
So right now I do have full access to Michael's desktop, but only for a moment.
If I want to have it forever, I need to find his password.
But there is one problem though. Windows doesn't just store his password.
Plain text on the system. It's stored inside a hash,
like most modern systems in the applications that when you set up a password,
they don't store that password the way you see it like this. No,
they don't do that. They take it and they put it through a hashing algorithm.
And in the case of Microsoft, it's the MD four hashing algorithm.
So they hashed it up to where it will look something like this.
And that's what they store as your password. It's not your password,
it's a hashed version of it. And when you try to log in,
they put that back through their little calculation algorithm thing, their hash,
and if it spits out the same hash that they have stored, you're in,
we want that hash, we need it.
And while it won't immediately tell us his password, it will we'll crack it.
And actually later I'll show you how we can just use the hash itself to do some
pretty gnarly things. It's kind of crazy.
Now to get his hash it's found in his systems registry is in two places.
Let's get it real quick. I'll go to my search bar and search for reg edit.
There it is right there. Notice I am getting a UAC prompt.
I do have to be administrator. Good news is Michael is an administrator here.
We're looking at the H key local machine and we want the SAM and system keys.
Now I could export them here, but we don't have time. We have to hurry up.
So we're gonna do it via command live.
I'm gonna launch my terminal as administrator and with one command I can grab
them. There'll be Reg Save, specify the key hq,
L M Sam, and then I'll specify where to save it. I'll just put it right here.
sam.save. Got it. Same thing for the system. We'll grab system,
save at the system, save. And we got it. Wait, is that him?
All right, I gotta be quick, give you back at any time.
But I have to tell you how you can protect yourself from bad passwords with
Dashlane.
Dashlane is my password manager of choice and the sponsor of this video. Now,
I really hope that Michael has been using Dashlane for his Windows password.
Actually, I kind of hope he has it.
It's gonna make my job so much harder to hack it.
Now I love Dashlane because they make it really easy to create complicated,
hard to hack passwords for all your services.
And I'll tell you if it's not a good password,
and I'll make sure you have a unique password for everything.
That's probably the main reason people get hacked.
I'm really curious what Michael's password is. We're gonna find out. Now,
honestly,
I should already know if Michael is using code passwords because I forced all of
my employees to use Dashlane because I use it for my business,
I can look at their password scores, make sure they're healthy,
and make sure their passwords aren't compromised on the dark web.
So check it out, link below dashlane.com/network. Chuck 50,
or you can use Code Network. Chuck 50 and you'll get 50% off.
Don't be like Michael, don't get hacked. Okay, he's, he's coming back soon.
Okay, let's look at, get this going.
Now all you gotta do is put this on a flash drive,
which I'm just not realizing I don't have. I'll be right back. Let's go.
There's a flash.
Drive. Uh, crap.
Crap crap, crap crap.
Got one. Okay, go, go, go, go, go.
No.
Okay. Alright. Okay.
I'll open up my finder right here. Copy these two files,
save them to our flash drive, our external hard drive and we're good to go.
All right, I.
Think, I think I hear.
Him coming. Get it.
He doesn't even know what a sucker.
Okay, I got 'em. I'm gonna go plug 'em in my computer's in my server room
And there it is. And there they are. Sam, save system, save.
I'm gonna take those copy and I'll paste them right here on my desktop. Bam.
There they are. I'll jump to my desktop and my terminal CD desktop.
There's my two files. Now to get the hash outta these guys,
we're gonna use a tool called Unpack It Secrets Dump. It's a weird name.
It's built in the Cali, let's try it out. And if you need to install it,
of course pseudo A P T.
Let's just do a search before unpack it and you can find it pretty easily.
Here's the command, unpack it, secrets dump. We'll do a dash sam,
which is where Windows actually stores these Ntlm Hashes.
Ntlm is their net logon manager. It's,
it manages the password stuff and we'll specify our files, Sam save.
And then we'll do dash system and specify our system.
Save and local because we're parsing local files right here.
And let's try it out. , do you see all that? There's a lot here.
Let me uh, make this more legible for you. We have the hashes by the way,
we got the administrator hash and there's Michael right there.
The hash is actually right here. This is what we need and we have it.
So I'm gonna grab this and save it. Create a file called hashes dot txt,
paste it in there, control xy, enter to save. We got it.
Now at this point we have the hash and we need to crack the password.
And if you see my password cracking video,
which if you haven't yet go check it out.
I detail a lot of what password cracking entails. This is what it normally is.
You have a password hash and now we have to guess what a password might be for
that. If you recall from our example earlier, we're kind of like Microsoft,
the Windows computer.
All we have is the hash and instead of waiting for a user to put the password in
and go, yep, that's it.
We're gonna try a bunch of passwords like a lot and try and
guess what the password.
Thankfully we have tools that can automate that and they'll be able to tell us
what the right password is. But we gotta do a few things to make it work.
First we'll need a list of passwords, that could be Michael's password.
And when I say a list, I mean like thousands, probably 20,000 passwords.
How do we do that? There's a tool for it. I'll show you here in a second.
But what we're doing here,
getting a list of passwords and trying them all with a tool that's called a
dictionary attack. And it's what most password crackers hackers use.
So when you hear about a data breach and people you know have their emails and
their passwords compromised, it's normally an email address and a password hash.
And these hackers will do what I'm doing right now,
get a bunch of well known passwords or randomly generated passwords and just
start going at it automated. Let's try it real quick. Now,
to generate our list of passwords, we're gonna use a tool called Cup,
which is really, really fun. Check it out. Let's see if I have it installed.
Nope, , do I wanna install it? Sure, yes. Cool, that was easy.
So what we'll do here is we'll type in cup dash I for interactive mode and what
this will do is ask us questions about our target name, date, birth date,
significant other hobbies, keywords.
And we'll use that information to generate a random list of passwords. Well,
not so random, so let's try it out. First name Michael surname,
wall nickname Michael, we wanna do birthday partner's. Name Amanda Panda.
Asher pet's name, Bree Company name Network Shock. Don want some keywords? Sure,
let's do um Beatles. He likes the Beatles.
Summer 2023 Monkeys Bible.
Jesus. Okay, I think we're good. Special characters. Sure, yeah,
let's do that leap mode. Dunno what that is saying. No. Okay, ,
do you see that? That was so fast.
It just generated 17,000 words and put it inside a file called Michael Txt.
Let's, um, let's cat that real quick. Cat Michael txt .
Look at all that possible passwords that he might have.
So now let's see if he has that password.
For this we're gonna use a very popular cracking tool,
password cracking tool called Hash Cat.
I go deeper into how to use this in my password hacking video.
So we'll start our command, we'll do a pseudo hash cat,
we'll do a dash m to specify our hash type. We're doing ntlm so it'll be 1000.
That's again what Windows uses. I know this from reading the man page.
Then we'll specify our hashes.
We created a hash file called hashes txt with Michael's hash in it.
And then finally our dictionary, our word list, Michael Txt.
Let's see how this works. Ready, set, go. 17,000 passwords. Let's try it. Okay,
there we go. Status cracked.
Let's do that same command and we'll do a dash dash show and it should output
for us the hash and the password in its database. Okay, there it is.
That should be his password. So we have his hash, we have his password.
Now what do we do? We hack him , we get in.
We can use tools like Evil dash win rm,
which is as fun as it sounds. We'll do a dash. I specify his IP address.
Now I do happen to know this because he's here at my office, right?
And I could've figured that out doing IP config while I was at his computer.
So that's his IP address. Do use your name,
Michael dash P I'll put in that password we found and let's see what happens.
Shell right there. Who am I? I'm Michael, I'm in his computer right now.
Yep, that's his IP address. That's a Windows machine. Pretty crazy, right?
We can do something better. Let me exit outta there. We can uh,
RDP with a tool X,
free rdp do a forward slash B for the computer slash u for the
user password.
And that should be all I need. Let's try it out. Seems to be working .
What heck got him?
How cool is that though? Now let me show you something crazier.
We cracked the password and I happen to know Michael so I could have generated
that list and, and you know, had a pretty good list of passwords,
but we don't need it. Check it out. Our same command before Evil WIN rm,
we could just do a dash h. Let me open up a new terminal and uh,
grab that real quick. We'll grab that hash.
Oh wait, that's not it. It's a capital H. Did you see that?
I logged in with the hash, not even the password. That's kind of crazy, right?
It's called pass the hash. And we can do the same thing with uh, rdp,
same command as before,
but instead of dash or slash p we'll do a PT for pass the hash paste the
hash there , there's a fly in here. Got here fly. But look, it worked.
How amazing is that? Oh, I lost it. Try it again back again. .
He's gotta be freaking out right now.
So what I just showed you is how you can get a hash from a Windows computer and
figure out the password from that hash or just use the hash itself to get access
to a bunch of stuff. It's kind of crazy. It's powerful, it's really fun.
But now let's move on to the defensive side of things.
Let's talk about mitigation.
And this is actually good news for security people because the method that I
used here is already documented pretty well in the Mitre meter framework OS
credential dumping with security account manager, sorry,
this flies driving me nuts. You'll notice that hey,
we're dumping the same keys that they're mentioning.
So it's documented and they're even saying the tools that we may have used.
secrets dump What?
But what's cool is they do offer mitigations disabling or restricting N tlm,
putting in password policies, user training,
and they also give you detection stuff like you actually detect when people are
doing stuff with their registry keys. So that's good news.
And also full disclosure,
we had to do a few things to Michael's PC to make this work,
disable certain security features that prevented us from doing things.
Now we did get the hash, no problem, we didn't have to do anything for that.
But in order for me to do the WIN RM command giving me a shell,
I had to disable his firewall, the Windows firewall,
in order for me to do the R dp. Same thing, firewall.
I also had to enable remote desktop and add Michael to the allowed users to
access remote desktop and had to disable a setting in the registry called
Disable restricted admin,
which was a flaw back in Windows eight that they had to fix.
So we did have to do a few things to make it work.
So if you try to do this yourself and you're like, uh,
I'll put some information down below how you can like do this yourself with your
own little lab, it's pretty fun.
But just know default security posture of windows, it's pretty good.
Now it doesn't mean that what I've done here cannot be done by a pretty good
hacker or that a user may just have a computer that's wide open.
So I hope in this video you saw another window into windows of how
vulnerable we kind of are, but also how secure we are as well.
And also I wanted to address something because back in my password hacking
video, now I talked about, oh we can, we can crack hashes, but you're,
the number one question I got was how do you get those hashes? Well,
in this video I showed you how you could get those hashes at least a potential
way. And by the way, I've only scratched the surface of what you can do here.
This is a very basic example, a basic demo. There's a whole big world to this.
That's all I got. I'll catch you guys later.