2

If the nmap scan returns the result of common ports being filtered/blocked on windows 7 domain, is it still possible to pass the hash to the PC that I have physical access to, without having to connect through port 445? Secondly, when doing a "live" brute force for example with hydra against a windows domain, do any ports actually have to be open if security policy allows infinite password attempts? After seeing that most ports on domain are blocked, is brute forcing/sniffing passwords a good starting direction for penetration test or are there more reliable ways to get control of a domain?

1

Ok so you've got a lot going on with this question. Let's break it down a little bit:

If the nmap scan returns the result of common ports being filtered/blocked on windows 7 domain, is it still possible to pass the hash to the PC that I have physical access to, without having to connect through port 445?

You can connect with SMB over TCP/139(legacy) or TCP/445. If nmap is showing that they are filtered, it means the port (read: destination) is accessible by your host but there is no service listening there.

Secondly, when doing a "live" brute force for example with hydra against a windows domain, do any ports actually have to be open if security policy allows infinite password attempts?

Hydra is protocol based. In other words the protocol you are attacking needs to be open. So if you are brute forcing RDP for example, then TCP/3389 needs to be open on the remote host. If it is running on a non-standard port, you can specify the port in Hydra with the -s <port> switch.

After seeing that most ports on domain are blocked, is brute forcing/sniffing passwords a good starting direction for penetration test or are there more reliable ways to get control of a domain?

This is a complicated question to answer as every environment is different, but typically password guessing attacks (against listening services obviously) can be an effective starting point -as a result of users notoriously having bad passwords. If you have internal network access: LLMNR/NBNS poisoning can be effective (if it's enabled in the environment -it's on by default) for capturing hashes for use in offline cracking or relaying (Google: Responder). SMB Relay attacks can also be effective if SMB Signing is disabled (again the default in Windows)(Google: SMBRelayX). Don't forget about password guessing on other services besides user accounts (e.g., SQL, Apache/Tomcat, etc.).

Happy Hacking

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.