GetNPUsers.py to get AS-REP | Related with pre-authentication disabled | Wireshark | CTF | getting users password

https://www.secureauth.com/labs/open-source-tools/impacket/

 

C:\>getnpusers.py scrm.local/ -dc-ip 192.168.0.79 -request

So what make the account vulnerable? 

If you enable the Do not require Kerberos preauthentication just like the above screenshot, then the account will be vulnerable. GetNPUsers.py NP means non preauth. This tool will try to harvest non preauth AS-REP responses from the list of given users that we provide. Non preauth means kerberos pre authentication is not required. By enabling this option you are actually disabling this options. 
 

If you enable the Do not require Kerberos preauthentication by giving tick mark on the box, then the above script will return AS-REP encrypted data of that user. Because it will not check timestamp then. Check the username and give back the TGT. Even in wireshark packet capture, in the asrep packet the encrypted data will also be shown. Now hashcat will help to crack further. In AS-REQ and AS-REP the data is encrypted with users ntlm password hash also AS-REP contains TGT for the user as per user request and the TGT is signed by krbtgt account of KDC. So if we able to crack that (the encrypted data which is encrypted using users password) then we can get users password. And using that password of that user account, attacker can initiate the whole request from the beginning just like a legitimate user does for example, attacker will encrypt the timestamp of that user using users password and send to KDC. KDC will decrypt the data using users password because attacker use the same password that KDC also have. Then KDC issue TGT so on.

$23$ means encryption type (etype) RC4

C:\HTB\hashcat510>hashcat64 -m 18200 -a 0 "encrypted data or hash value"

 

Now if you disable this, (by default this is disabled and recommended to disable this feature) then you will get an error in wireshark capture and the python script will not bring you any encrypted data. Because server is expecting from you that you should encrypt your current timestamp with your password. As we are initiating this request using python script so server accept the request and try to decrypt it using corresponding users password. But at the time of decryption this fails because original user never encrypt his/her timestamp using his/her password.

When you have multiple users then you can save those users in a text file then follow the below image command line:

 users.lst file contains three users. audit2020, support and svc_backup

You can also run a for loop. bash scripting will help in that case. 

 

for user in $(cat users.txt); do GetNPUsers.py BLACKFIELD.local/${user} - no-pass -outputfile hash_${user} -format john -dc-ip 10.10.10.192 2>/dev/null | grep -v impacket; done

john --wordlist=/usr/share/wordlists/rockyou.txt support_hash

solving sauna hackthebox - ippsec - another thing we could do:

give a entry on sudo vi /etc/hosts/ 

10.10.10.175 EGOTISTICAL-BANK.local sauna sauna.EGOTISTICAL-BANK.local

parrot machine:

GetNPUsers.py EGOTISTICAL-BANK.LOCAL/administrator

GetNPUsers.py EGOTISTICAL-BANK.LOCAL/fsmith

from parrot or kali:

root@kali: /usr/share/doc/python3-impacket/examples# ./GetNPUsers.py -dc-ip 10.10.10.161 -request htb.local/ -format hashcat