hello everyone this is Irfan from ehacking.net and in this video i will uncover a technique
that hackers use to hack windows passwords make sure that this video is for educational and
demonstration purpose only so test this technique only in the lab environment let's get started
in the previous video i have discussed how hackers use fake logon screen to hack windows
password now today i will create a malicious pdf to steal the ntlm hash from the target machine
let's review the concept first so the ntlm is a challenge response authentication
that windows uses to verify or authenticate the client or the users whenever a user wants to
access a file or resource on the windows network or server he goes through the ntlm process let's
say you want to access a resource maybe a file or a document or you just want to log in what happens
understand this challenge response scenario here the client being a client or a user
you send a username to the host which is called the authentication request
it goes to the host or host if you are if you're trying to log in in your machine or to the server
if you are trying to access a file or login to a server all right and the next step what happens
the uh host or the server responds with a random number this is the challenge it goes to the client
the client then convert this particular number into the hash format it converts into the hash
format if you are not sure what is hashing and how it works then you should check this video so
what happened as i said that the client generate the hash value of this number and mix it with the
password since you have to enter the password you uh whenever you enter the password it converts a
into the hash value and then it's sent so that random number along with the password
uh comes becomes this response and it goes to the ch to the host or the server if both values since
your server or your host or your computer already knows your password and it has the hash value of
all the passwords all the user's password so what happens it matches with the incoming password in
in form of the hash value if both values match the authenticity of the client is confirmed
and network access is granted if there is no match between the values the client will
be denied access all right so based upon this hash it either approved or
denied the request so this is how the ntlm process works is a it is a challenge and response
protocol since the server or the host already has the list of the hashes or already know the
password of all the users what if i if i being an attacker get access to this particular hash
and what if i convert back it into the plain text now i know the parser of the client or
the user so this is what we will do now in order to get the ntlm hash i will use a bad pdf file
this utility generates a malicious pdf document to capture the ntlm hashes from the windows systems
it does so by exploiting a loophole discovered by the checkpoint so the steps are pretty simple
you just need to clone it so in order to do this i will be using the git clone command so use the get
clone and then paste the url that we have copied from the github website enter it it will clone
this particular utility let's see the root directory it's there perfect now let's get
into this directory okay and then let's see so we have a python script that we need to run make
sure if you are not logged in as a root user you should use the sudo command since i have already
logged in as a root user i don't need to use the sudo command but if you are not logged in and if
you are using a standard user then make sure to use a pseudo command otherwise it will not work
anyway so python that pdf dot py since it is a python python script
just run it so it says that you need to provide the host ip which is the attacker ip in this case
uh what you can do since i'm trying to i'm i'm testing this tool in a in a local lab environment
if you want to uh launch this attack or if you want to test a remote server or a remote pc
what you can do you can use the uh and g-rock or n-n-grog some people call it
ng-rog and some call it and grog so you will get a dynamic ip that you can use on
on the van on the internet rather than the land environment for this demonstration purpose only
i'm using the lab environment so it is my lan and that's that is why i'm copying my local ip
my private ip so provide the ip here perfect and then you need to mention the file name for example
important file or or whatever that you want to do imp work file and then the pdf so this is
a pdf file and then you need to mention your interface as well if you are using a wireless
interface then you have to mention your wireless information interface that is wlan0 or wln1 n1
since i'm using the ethernet here and my interface is at 0 so i will i will be mentioning this
at 0 here ok so there you can see that it says that this particular file has been created
and the list the listener is start listening for the event we can cross check if you want batch pdf
and let's see the file is there okay now the next job is to transfer this file or is to send this
file to the target or to the victim there are various ways to do this you can upload it on the
file sharing server or and then share it with the with the target or what you can do you can simply
email this particular file to the target so whatever means you will use you have to use some
social engineering technique if you are trying to implement this this strategy in a real-world
environment otherwise in the lab environment what i will do i will simply host this particular file
uh on the local server whatever means you will use you just need to transfer this file so i'm already
transferred i have already transferred this file using the my my local server here if you
want i'll show you the steps uh this the steps are pretty simple what you can do you can just
uh copy this particular file and upload it in your apache i've already i have used this technique in
so many videos before even when i was discussing the android hacking i have used this technique uh
to transfer this file locally so go to the html folder and paste this file here all right now
there you can see that it's generating it's it's fetching the information of the of this particular
target or this particular victim there you can see that the file modular information and this
is the ntlm hash value so this is the username and this is the domain name or the pc name
and this is the hash value of the credential or of the password of this particular user
now i have the hash value the next step is to convert it into the plain text i still don't know
what is the password since i have to enter the password i cannot enter this hashed value into
at the login screen however i can use this hash value into pass the hash and other related attacks
but since i am interested to know the plain text password so the next step is to crack
it and in order to crack this particular hash we can use john the ripper or we can also use
cat alright so for this demonstration i will be using john the ripper so if you already know or
understand the posture cracking you might know that john the ripper use various techniques to
crack the the hash password it uses the word file it also use the uh you know incremental technique
where it increment value uh but let's not get into this you know discussion let's just try to focus
on this on cracking the password so for uh so one thing that i would like to mention
if i get into the uh john i will show you the what list okay john there you can see
all right so in order to to correct the password successfully your password or
this particular hash password should be into the default uh what list of this uh john the ripper
how if it is not present what you can do you can download the common password list from the
internet or you can use uh other word list if you have so this is the default word list that john
john the ripper uses so there you can see that i have already placed some
password here uh some common password here that we will be trying to crack based on these things
all right so what's the next step the next the next step is to copy this particular hash and
paste it into our text file so if you if you if you will not copy the entire hash then the john
the ripper will not understand what sort of uh hashing algorithm it is and then it will try
uh using multiple let me just show you give you the demonstration here for example if i
let me check my desktop or i don't have any so what i will do i will use a text editor and what
if i just paste it here and save it let's say desktop and this is a hash all right so this is
a hash text file and what if i'll do um if i just use john to crack this hash let me show you uh
sorry i'm in the root directory i need to locate to the desktop first where this file is stored
all right john and then hash
so there you can see that since it doesn't know what kind of it is it says that lm detected
lm detected and then trying to uh use this lm since the ntlm the combination it uses the lm
uh for uh protocol at the start and there you can see that it's it's using this
particular password list and it's trying to perform the brute forcing anyway so i'm just
aborting this one because i will mention or i will copy the complete
there you can see what i will do now i'll copy this one with the username all right and then i
will go there paste it here save it now the john the ripper will will detect that it is an and it
is a ltlm hash so if i just say this one so there you can see that it's it's it's detected that
loaded one password hash which is an ntlm hash or maybe mp4 anyway so it's using this particular
word list let's say what will it get meanwhile what i can do i can use another file i can just
create another file for this purpose only and let me do this okay so what i did here now i have uh
created an another text file which is called the known pass i've created this file and this file
contains the list of unknown password it is my exclusive file and what i will do now instead of
using the default possible a password list i will be using this one all right so let me mention the
word list known pass since this particular file is is also on this desktop location
let me just execute this one all right so there we go you can see that the username ehacking and
the password is password 0 1 with exclamation mark so there you can see the hashes as well so we have
we now have the plain text password we have the hash value we have the plain text password
pretty simple pretty simple technique so this is how the hackers
use since the hackers have so many techniques to fetch this particular hash they can adopt they
can use fake lock on screen they can use the the responder and similarly they can use this
bad pdf it's a malicious pdf so this is it this is this was the concept and this is the technique
that you can also use in your lab environment to practice the hash cracking and to practice
how to fetch or retrieve the hash from the target machine so this is it take care bye