System Hacking and Password Cracking

System Hacking Overview

• System hacking includes gaining access, escalating privileges, executing applications, hiding files, and covering tracks
• Goals consist of bypassing access controls, acquiring user rights, creating remote access, concealing malicious activities, and hiding compromise evidence

Password Cracking

• Password cracking recovers passwords from computer systems without authorization
• Weak passwords increase the success of cracking attempts

Types of Password Attacks

• Non-electronic attacks don't require technical expertise
  • Examples: Shoulder surfing, social engineering, and dumpster diving
• Active online attacks crack passwords by directly communicating with the victim machine
  • Methods include dictionary attacks, brute force attacks, hash injection, phishing, the use of trojans/spyware/keyloggers, and password guessing
• Passive online attacks crack passwords without communicating with the authorizing party
  • Techniques include wire sniffing, man-in-the-middle attacks, and replay attacks
• Offline attacks copy the target's password file to crack passwords on another system
  • Rainbow table attacks and distributed network attacks are types of offline attacks

Password Guessing

• Password guessing involves creating a list of possible passwords and manually attempting them on the victim's machine
  • This involves finding a valid user, creating a password list, ranking passwords by probability, and attempting each one
• Default passwords are those supplied by the manufacturer with new equipment and are often targeted
  • Many online sites provide lists of default passwords
• A Trojan/Spyware/Keylogger attack involves installing malware to collect usernames and passwords
  • The program runs in the background, relaying credentials to attackers

Active Online attack

• An active online attack can be performed using a USB drive to extract passwords
  • This involves downloading password tools, copying them to the drive, creating an autorun file, and inserting the drive

Hash Injection Attack

• A hash injection attack injects a compromised hash into a local session to validate network access
• This involves finding and extracting a logged-on domain admin account hash and using it to log on to the domain controller

Passive Online Attack

• Wire Sniffing involves using packet sniffers on a local network to capture raw network traffic
  • Captured data may include passwords, FTP, rlogin sessions, and email content

Gaining Unauthorized Access

• Sniffed credentials can be used to gain unauthorized system access

Man-in-the-Middle Attack

• This attack intercepts communication between a victim and a server to extract information

Replay Attack

• This attack captures packets and authentication tokens using a sniffer
• Tokens are placed back on the network to gain access after extracting relevant info

Offline Attack

• A rainbow table attack uses a precomputed table with wordlists and hash values
• Password hashes are captured and compared with the rainbow table to find a match, cracking the password
• It's easy to recover passwords by comparing captured hashes to the precomputed table

Password Storage

• Windows stores password hashes in this file: C:\windows\system32\config\SAM
• Information stored: Username, User ID, LM Hash, and NTLM Hash

NTLM Authentication Process

• User types password, and Windows uses a hash algorithm
• The computer sends login request to the Domain Controller
• The Windows Domain Controller has a stored, hashed password copy
• The Domain Controller sends a logon challenge, and the computer sends a response
• The DC compares the computer's response with its own hash and grants access if they match

Kerberos Authentication

• Kerberos uses symmetric-key cryptography with a Key Distribution Center to verify user identities.
• The KDC has a ticket-granting server that connects the user with a service server
• It maintains a database of verified user credentials
• Password salting adds a random string of characters to passwords before hashing
  • Salting makes it more difficult to reverse hashes and prevents pre-computed hash attacks

Password Hash Tools:

• Pwdump7.exe extracts LM and NTLM password hashes
• Fgdump.exe also extracts cached credentials, permitting remote network execution
• Command: fgdump.exe -h <ip> -u Administrator -p hacker to dump a remote machine hash

Password Cracking Protection

• Enable information security audits
• Rotate Passwords Regularly
• Never share passwords
• Disallow dictionary words as passwords
• Use strong encryption (not cleartext protocols)
• Enforce a password change policy, such as every 30 days
• Store passwords securely
• Avoid any system's default password

Privilege Escalation

• Privilege escalation is when an attacker gains higher-level permissions than originally allowed

Horizontal Escalation

• This involves the same privilege level, but in a different user account

Vertical Escalation

• This involves higher-level privileges than the attacker initially possessed

Types of Privilege Escalation

• Exploiting vulnerabilities
• Weak configurations
• Using malicious software like rootkits
• Compromising user accounts
• Social Engineering

Privilege Escalation Prevention

• DLL hijacking: Preventing malicious DLL injection by restricting the interactive logon privileges
• User encryption
• Run users and applications with least privileges
• Reduce code runs with that privilege
• Multi-factor authentication
• Debugging using bounds checkers and stress tests
• Run services non-privileged
• Testing all coding errors
• Patch and update kernel regularly

Executing Applications

• Attackers can execute malicious apps to "own" a system such as gather info, unauthorized access or crackpasswords

Common examples of Executing Applications

• Keyloggers
• Spyware
• Backdoors
• Crackers

RemoteExec

• RemoteExec installs applications, executes program/scripts, and updates data files
• Attackers have the ability to modify the registry, disable local passwords/accounts, update files/folders

Executing Application Tools

• PDQ Deploy : https://www.pdq.com
• Psexec: https://docs.mircrosoft.com
• TheFatRat: https://github.com

Keyloggers

• These programs or hardware devices monitor keystrokes
• Keystroke loggers have legitimate uses such as monitor employee activity or parental monitoring of children
• Keyloggers lets gathers a victim’s email, password, bank data, chat etc

Hardware Keyloggers

• PC/BIOS Embedded
• Keyboard Keylogger
• External Keylogger
  • PS/2 and USB keylogger
  • Acoustic/CAM keylogger
  • Bluetooth keylogger
  • Wifi Keylogger

Software Keyloggers

• Application Kernel
• Kernel Keylogger
• Hypervisor based keylogger
• Form grabbing based keylogger

Spyware

• Programs that record user interactions secretly and send the data to remote attackers
• Spyware hides processes, files, data, etc. in order to avoid detection
• Spyware gathers email addresses, logins, passwords, credit card data, back data
• Spyware: spytech spyagent and powerspy

Spyware agents

• Spytech spy agent: Monitors everything users do on a computer.
• Power spy: Monitors data activities secretly.

Spyware tools

• Netvizor
• Activity monitor
• Usb analyzer
• Spy voice recorder

Rootkits

• Programs that hide themselves and malicious activities
• Gaining full access to the system
• Rootkits replace operating system calls which will cause many malicious functions to be executed, undermining security
• Rootkits comprise backdoor programs, DDoS, packet sniffing, log-wiping and irc bots.

Rootkit Distribution

• Attackers can:
• Scanning a system for vulnerabilities on the web
• Wrapping it with a package like games
• Installing in corporate or public computers

Rootkits Types

• Hypervisor Level Rootkit
• Hardware/Firmware Rootkit
• Kernel Level Rootkit
• Bootloader Level Rootkit
• Application Level Rootkit
• Library Level Rootkits

Higher level of Rootkits

• Hypervisor Level modifies the boot sequence
• Hardware/firmware hides in the hardware

Kernel level Rootkit

• Malware codes add malicious code to the original

Boot Loader Level Rootkit

• Remote attackers have full range

Application Level Rootkit

• Binary files modify behaviors

Library Level Rootkits

• System calls hide info on attacker

Steganography

Hides data.

Types of Steganography

• Image Steganography
• Document Steganography
• Folder Steganography
• Video Steganography
• Audio Steganography
• Web Steganography
• Spam/Email Steganography
• Hidden os Steganography
• Source Code Steganography
• white space steganography

Whitespace Steganography

• ASCII text hides endline message

Image Steganography

• Image files in .png or .jpg are hidden
• Tool: https://www.pelock.com/products/steganography-online-codec

Document Steganography

• Adding codes to transferred documents
• Tool :snow

Video Steganography

• This has secret info, hiding on a video file

tool :stegostick

Audio Steganography

• Hides audio files

tool stegostick

Folder Steganography

• Files code and hide on apps

Email Steganography

• Secret messages in email

Covering Tracks

• Covering Tracks prevents getting caught

Common attack track to stop

• Disable Auditing- disable features
• Clearing Logs- clear system log
• Manipulating Logs- prevent people from catching hackers
• Windows- delete log events
• Linux- remove this
• export HISTSIZE=0
• history -c # clear all history
• S
• Cat /dev/null > ~.bash_history && history -c && exit