Pass the Hash & Unix

Question

Purpose: test if PtH (Pass the hash) is feasible against Unix box

Scenario:

• Windows host (Windows Server 2008) vulnerable to eternalblue

• got Administration hash as part of the post-exploitation process (meterpreter hashdump command)

  Administrator:500:aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360:::

• through metasploit module scanner/smb/smb_login I checked if the same password (in this case hash) it had been used more than once within the entire subnet Interesting output:

  +] 192.168.92.80:445 - 192.168.92.80:445 - Success: '.\Administrator:aad3b435b51404eeaad3b435b51404ee:3ab8988c5403e0a939927a7c70ee4360'

  192.168.92.80: NAS (Unix O.S)

My questions:

1. With regard to Metasploit how can it tell if the hash grabbed during the post-exploitation phase is actually correct and eventually might grant access to the host
2. I tried PSExec (Metasploit) and also pth-winexe with the same hash above, but to no avail (all attempts failed)

Is PtH possible, if the target is a Unix host? If my reasoning is wrong, what should I do in order to accomplish my objective

any help will be highly appreciated

Answer 1

This can happen when a Samba file share has authentication disabled or accepts any credentials. To validate this, try doing a smb_login with random credentials (say admin:admin) and see if accepts those credentials too.

To check if the server accepts NTLM authentication, try performing a nmap target -A -p 445 on the target. If it returns details such as internal domain name (NetBios,FQDN,etc.) of the target organisation. If it does, then you should be able to pass the hash to the Samba share.