Siege T.V.

Dumping Hashes Using CrackMapExec

August 10, 2023

CrackMapExec (CME) is a powerful post-exploitation tool commonly used by penetration testers and red teamers to assess the security of Windows networks. One of its key functionalities is the ability to dump password hashes from compromised systems. Here’s a summary of dumping hashes using CrackMapExec:

1. Tool Overview: CrackMapExec is a post-exploitation tool that automates various tasks in a Windows network penetration test or red team engagement. It is designed to be used after an initial foothold has been gained within the network.
2. Dumping Password Hashes: One of the core capabilities of CrackMapExec is the ability to extract password hashes (often NTLM hashes) from Windows systems that the attacker has compromised.
3. Steps to Dump Hashes:
   • Initial Compromise: To use CME for hash dumping, the attacker must first gain initial access to a Windows machine within the network. This can be achieved through techniques like exploitation or social engineering.
   • Executing CME: Once access is established, the attacker can use CrackMapExec on the compromised system. CME provides a range of commands and options for various post-exploitation tasks, including hash dumping.
   • Hash Extraction: Using the appropriate CME command, the attacker can instruct the compromised system to extract and provide the password hashes of local and domain accounts. These hashes are typically stored in memory or on the system itself.
   • Exfiltration: After obtaining the hashes, the attacker may choose to exfiltrate them for offline cracking. This can be done using various methods, such as saving the hashes to a file or transmitting them to a remote server.
4. Hash Cracking: Once the password hashes are extracted, attackers can use offline cracking tools like John the Ripper or Hashcat to attempt to recover the plaintext passwords. The goal is to gain access to additional accounts and escalate privileges within the network.
5. Mitigation and Prevention: Organisations can take several measures to defend against hash dumping attacks:
   • Patch and Update: Keep systems and software up to date to address vulnerabilities that attackers might exploit.
   • Least Privilege: Implement the principle of least privilege to restrict users’ access to resources they need for their roles.
   • Monitoring: Employ network monitoring and intrusion detection systems to detect suspicious activity, including hash dumping attempts.
   • Regular Password Changes: Encourage users to change passwords regularly, reducing the usefulness of compromised hashes.

In conclusion, CrackMapExec is a versatile tool that attackers can use to automate the process of dumping password hashes from compromised Windows systems. Defending against such attacks involves a combination of security best practices, including regular patching, monitoring, and user education on password hygiene.

Related reading: Pass-The-Hash (PtH) Attack · Kerberoasting Attack · NTLMv2 Password Cracking · What is Social Engineering

What this technique depends on, and how to take it away

Credential material can only be collected from a host if an attacker already has administrative rights on that host, and it is only useful if the same credential works somewhere else. Both halves of that sentence are things you can control.

Make local administrator passwords unique per machine. This is the highest-value control on the list. A shared local administrator password across a fleet means one compromised workstation is functionally all of them. Windows LAPS randomises and rotates the local administrator password per device, and it is included with Windows rather than being a separate purchase.

Deny network logon for local accounts. Even with a valid local credential, blocking its use across the network removes the lateral movement it enables.

Tier administrative accounts. Server administrators should not log on to workstations and domain administrators should authenticate only to domain controllers. Tiering means credential material harvested from a workstation is confined to the workstation tier.

Enable Credential Guard on supported systems so credential material is isolated and cannot be read from memory in the usual way.

Reduce standing privilege. Just-in-time administration means there is less credential material sitting in memory at any given moment.

How to detect it

• Monitor for processes reading LSASS memory. This is one of the highest-fidelity alerts a modern endpoint detection platform produces, and it is worth ensuring it is enabled and monitored rather than simply licensed.
• Alert on remote service creation and on new services appearing on multiple hosts in a short period, which is the usual mechanism for remote execution.
• Watch for a single account making administrative connections to an unusual number of hosts, especially outside its normal pattern.
• Look for shadow copy creation and access to the registry hives that store credential material, which is a common alternative to reading memory.
• Alert on NTLM authentication where Kerberos is expected, which frequently accompanies credential reuse.

Detection here depends almost entirely on having endpoint telemetry that someone is actually watching. An endpoint detection product with nobody reviewing the alerts is a licence, not a control, and this is the technique that exposes the difference.

Siege Cyber is a CREST-accredited provider of penetration testing across Australia. Get a Fixed-Price Quote.