1

I'm a junior penetration tester, working in a place that does not give much guidance and I kind of just had to dive in. I'm pretty good, in that I can normally still obtain domain admin on networks I audit, as well as numerous other vulnerabilities. There is still a lot I don't know, that I am trying to learn to be a better tester.

One thing in particular is, what good are user credentials if I can't log on to other machines via remote desktop?

I had thought logging on to other machines to try and get local admin to access hashes and other such stuff is a big part of the process. But if remote desktop is not enabled or logins restricted to certain users, how can you use user credentials to still do this?

  • 1
    If you gain access through other means, then you can pivot? – schroeder Sep 12 '18 at 19:28
  • @schroeder That's my question I guess, elaborate on 'other means'? At the moment I stick to looking to machines I can use founds credentials to log on to. – Jake Rankin Sep 12 '18 at 19:30
  • 1
    I'm not sure how to answer that. You have the entire spectrum of exposed services that each could provide potential access. Or soceng your way in, or drop a rogue device on the network, or ... – schroeder Sep 12 '18 at 19:35
  • I'm not talking about socenging or anything like that. Specifically, what ways are there to access a workstation machine with RDP disabled? No special services, network services etc, just default Windows workstation/desktop services. psexec? – Jake Rankin Sep 12 '18 at 19:40
  • From an external network or from inside the same network? – schroeder Sep 12 '18 at 19:46
2

In addition to remote desktop (and PowerShell remoting, as @JoeM mentioned), credentials can be used for lots of things.

  • Accessing network shares or other resources over SMB
  • Access other services that are protected by Windows authentication (for example, internal web apps, SharePoint, etc.)
  • Logging into a user's mailbox (for example, on Exchange) to access the user's email and messaging
  • Using Windows remote management apps (may Windows command-line apps, such as schtasks.exe will accept a machine name and credentials)
  • Using Management Console snapins (many of the "Computer Management" tools can connect to remote machines)
  • Using Sysinternals psexec.exe tool
  • Using WMI (Windows Management Infrastructure)
  • Using SSH (if it has been enabled)
  • Logging into a VPN (if only Windows creds are required or you can access the other creds needed)
  • I don't remember the detail (I've been meaning to ask this question for a while) but I remember psexec failing last time I tried. Does it have to be explicitly enabled? WMI, management console and windows remote management apps are stuff I have to look into more, thanks! – Jake Rankin Sep 13 '18 at 14:43
  • SMBMap across all the hosts you have using the credentials you have. Do any of the credentials have access to $Admin on these machines? If yes then you can use psexec on it. – McMatty Sep 13 '18 at 23:06
  • Psexec will fail on windows 7 because machines need to have specific entries in their registry – Tryna Learn Somethin Oct 13 '18 at 9:00
  • Also, if you know creds, you can do what psexsc do manually. First you use net use to mount share, then you upload file to that share, make a service with that file and wait for connection or whatever you wanna do – Tryna Learn Somethin Oct 13 '18 at 9:02
0

You could do a nmap scan of the host, find what ports are listening and try to authenticate to those services (provided they allow authentication).

If you are lucky, for example you discover port 1433 is open, then you attempt to use a MS SQL Server client to authenticate.

Maybe 5985 and 5986 are open, this allows for remote PowerShell commands to be run.

This follows the basic recon, then attack method.

  • In practice I have not found any useful services listening on the workstations themselves. Shares did not have anything interesting or were open without requiring auth anyway, no remote powershell etc...just remote desktop with user logins disabled. I remember trying psexec and it failing...does it need to be enabled, i.e. is it disabled by default? – Jake Rankin Sep 13 '18 at 14:42
  • 1
    Hey Jake - That is good and bad :) Sounds like you have been finding some environments with decent security. But where I find things like that are in large enterprises that have been around a while. They may have purchased an appliance from a vendor, or had professional services install a stack of services, never to revisit and secure. Or past admins turned features on to automate, but never secured them. Good luck! – Joe M Sep 13 '18 at 14:54
-3

Social engineering:

Send an email with "here are your credentials. I will tell your boss that you are a vulnerability to the company unless you follow the instructions in the attached document". And the document is an infected .doc or .pdf.

  • 1
    In this example, the credentials are not necessary or important. It might be far more interesting if the infected document leveraged the credentials to gain access to the device or network. But from a pentesting perspective, intentionally infecting machines tends to be out of scope. – schroeder Nov 12 '18 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.