3

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash.

I am attempting this with metasploit and metasploits psexec module.

I have LHOST set to my local IP, rhost set to the target IP, SMBUser is set to 'Administrator' and SMBPass is set with the hash.

However, I get an access denied error, which..surely should not be the case? Target is a Windows 7 machine.

I do this regularly as part of penetration tests and have not run into this error before, wondering what the cause could be?

  • 2
    Is the SMBDomain settings correct? Are you able to run auxiliary/scanner/smb/smb_version on this machine? – void_in Jun 24 '16 at 4:04
  • 1
    Ensure that the hash you have is really for the RID 500 account. It could be possible that IT renamed a different account to Administrator. If you have the hash of a user in the local admin group (but this user is not RID 500) you may be running into UAC remote restrictions with Windows Vista and newer (see support.microsoft.com/en-us/kb/951016 ). – Hugo Ideler Aug 15 '16 at 21:15
  • Just in case - french versions of Windows name their administrative account Administrateur. – lorenzog Jun 19 '17 at 8:35
2

This could be two things.

If your account is in fact RID 500 then the registry key FilterAdministratorToken might be set to prevent SMB logins to built-in administrator having admin privileges.

If the account is not RID 500, then UAC or the LocalAccountTokenFilterPolicy registry key is filtering the token with the elevated privileges (so your account acts as a normal user without access to the service required for PSExec).

See http://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/ for more info.

1

What type of payload are you using, powershell, Python, etc? and what type of connection is being made, reverse shell or bind shell? Often times I run into errors when I use a reverse shell payload from an NAT virtual machine.

For what you are describing the powershell payload sounds best: Set payload Windows/meterpreter/bind_tcp

If the correct ports are open, the right network settings are used, the right payload is set, and the right creds are used you shouldn't have a problem.

Happy Hacking!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.