3

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash.

I am attempting this with metasploit and metasploits psexec module.

I have LHOST set to my local IP, rhost set to the target IP, SMBUser is set to 'Administrator' and SMBPass is set with the hash.

However, I get an access denied error, which..surely should not be the case? Target is a Windows 7 machine.

I do this regularly as part of penetration tests and have not run into this error before, wondering what the cause could be?

Improve this question
3
  • 2
    Is the SMBDomain settings correct? Are you able to run auxiliary/scanner/smb/smb_version on this machine?
    – void_in
    Jun 24, 2016 at 4:04
  • 1
    Ensure that the hash you have is really for the RID 500 account. It could be possible that IT renamed a different account to Administrator. If you have the hash of a user in the local admin group (but this user is not RID 500) you may be running into UAC remote restrictions with Windows Vista and newer (see support.microsoft.com/en-us/kb/951016 ).
    – Hugo Ideler
    Aug 15, 2016 at 21:15
  • Just in case - french versions of Windows name their administrative account Administrateur.
    – lorenzog
    Jun 19, 2017 at 8:35

2 Answers 2

Reset to default
2

This could be two things.

If your account is in fact RID 500 then the registry key FilterAdministratorToken might be set to prevent SMB logins to built-in administrator having admin privileges.

If the account is not RID 500, then UAC or the LocalAccountTokenFilterPolicy registry key is filtering the token with the elevated privileges (so your account acts as a normal user without access to the service required for PSExec).

See http://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/ for more info.

Improve this answer
1

What type of payload are you using, powershell, Python, etc? and what type of connection is being made, reverse shell or bind shell? Often times I run into errors when I use a reverse shell payload from an NAT virtual machine.

For what you are describing the powershell payload sounds best: Set payload Windows/meterpreter/bind_tcp

If the correct ports are open, the right network settings are used, the right payload is set, and the right creds are used you shouldn't have a problem.

Happy Hacking!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .