1

Purpose: test if PtH (Pass the hash) is feasible against Unix box

Scenario:

  • Windows host (Windows Server 2008) vulnerable to eternalblue

  • got Administration hash as part of the post-exploitation process (meterpreter hashdump command)

    Administrator:500:aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360:::

  • through metasploit module scanner/smb/smb_login I checked if the same password (in this case hash) it had been used more than once within the entire subnet Interesting output:

    +] 192.168.92.80:445 - 192.168.92.80:445 - Success: '.\Administrator:aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360'

    192.168.92.80: NAS (Unix O.S)

My questions:

  1. With regard to Metasploit how can it tell if the hash grabbed during the post-exploitation phase is actually correct and eventually might grant access to the host
  2. I tried PSExec (Metasploit) and also pth-winexe with the same hash above, but to no avail (all attempts failed)

Is PtH possible, if the target is a Unix host? If my reasoning is wrong, what should I do in order to accomplish my objective

any help will be highly appreciated

1 Answer 1

1

This can happen when a Samba file share has authentication disabled or accepts any credentials. To validate this, try doing a smb_login with random credentials (say admin:admin) and see if accepts those credentials too.

To check if the server accepts NTLM authentication, try performing a nmap target -A -p 445 on the target. If it returns details such as internal domain name (NetBios,FQDN,etc.) of the target organisation. If it does, then you should be able to pass the hash to the Samba share.

5
  • I'll let you know if it works..thanks a lot
    – t5j
    Commented Oct 26, 2020 at 6:39
  • module scanner/smb/smb_login: 192.168.92.80:445 - Success: '.\admin:admin' nmap output: 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: Branch32) Then I tried pth-winexe ./pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360 //192.168.92.80 whoami but I get the following output: ERROR: Cannot open control pipe - NT_STATUS_ACCESS_DENIED I'm actually stucked thanks a lot
    – t5j
    Commented Oct 26, 2020 at 9:44
  • Maybe I found a solution I tried smbclient (Impacket) python smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360 [email protected] ..it seems to be working I get the following output (info command) Type help for list of commands # info Version Major: 4 Version Minor: 9 Server Name: CORE1 Server Comment: DNS-325 Server UserPath: C:\ Simultaneous Users: 4294967295 Now my question is: what should I do in order to do a more in depth analysis (as far as I can see help command shows just a few actions available) thanks a lot
    – t5j
    Commented Oct 26, 2020 at 11:07
  • You cannot execute commands on a Samba share, it's not a Windows machine and there won't be any administrator. Commented Oct 26, 2020 at 12:49
  • thanks so according to what I stated above I cannot say that a PtH technique is actually feasible? the fact that I was able to get Server name...etc I suppose it means that those creds (username\hash) are valid..is that correct?
    – t5j
    Commented Oct 26, 2020 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .