Ok so, in this follow-up tutorial
We are gonna be doing this same thing as we did before
However, we are going to do it in a windows machine
And be honest with you, most likely you will be doing this in a windows machine
As a post Linux machine is primarily
Because when Linux users forget their passwords
That is quite ware
Primarily because they have to type it in over and over and over again to utilize to use varies things
Where is on windows it's not default feature it can be setup that way
But it is not by default, that you need to type in your administrator password for things
Rather instead, you can just click yes and go through it
Which is a bit stupid in my opinion
And opinion for a lot of people out there
But as well there is definitely a feature where you can enable but i really think that it should enabled by default
Anyway, what i seen people do lately, is ... not lately but they have doing this for a while
They take passwords they take hash passwords of windows and then they crack them else where
Once they crack them, they billing on what sort of protocol they have setup on that machine
They able to gain remote access or something of a kind
For example, in class rooms, in internet cafes
You can really access that machine from outside world
It’s cool facility or corporate building or something of a kind
If you have a password for that machine, if you have the authentication credentials
If you manage to get in the same lan , you can actually connect with that machine
Specially you have a lot of shared folders, disks, and so on and so forth
That can be very problematic
The biggest danger of that happening is , well probably you have heard about support guys
People misrepresenting themselves, that static support
but really the biggest danger are they employees them selves
and sometimes responsible behavior and sometimes deliberate actions
primarily , as i said in internet cafes , schools and in corporate buildings
it can be pretty bad because i have seen people utilize like 100 or 200 schools computers
and they become their broad spaces basically they control them
for a central point
or as they have these days , they have decentralize broads
and then those computers stand to do all those things for them
which is really bad for that university because all traces all clues will end up to [unheard] to wards
them for whatever activity that person has conducted
and that is why that sort of attack is useful will be able to recreate steps of such people
and steal the hashes and then they are very sub reaction for those hashes
what you can do , where you can apply them , how you can utilize them
i mean it's , i can't even possible count them all here , but it's really doesn't matter
i just want to give you brief intro of what people actually use these hashes for
on windows machines
and they are also crackable primarily because people for windows they don't put any sort of complex passwords
most of the time , so they are crackable more than less
anyway , but that further with you , let's just go ahead and jump in to it
open up your browser , i have internet explorer here
i have been trying it out lately and
they have remold it quite well but i still don't like its security wise
anyway , this is my virtual machine , i don't really have a lot of stuff installed here so i just use the default internet explorer and that’s it
anyway , you need to go to this website www.openworld.com
and you can navigate to this link , if you wish , if not , you can immediately type in this link
where you can actually navigate to it in the website , it is pretty simple , they are in tiny problems
anyway, you need to scroll down and what you need if you're
ops , where is it, where is it, where is it , come on there we go
so that's , PwDump 7 , and i want you to download that one
there is 6 there is 5 and so on and so forth , but you see 6 is Windows 2000
XP/2003/Vista, and nothing further , Pwdump5 is NT/2000/XP/2003 nothing further
that's why you don't need Pwdump7
there's a question mark after vista , pretty sure that's like for everything that came afterwards as well
and Quarks PwDumps something’s , i don't know what is this [unheard]
ok i guess you can download the bottom one's as well , but it doesn't really matter
i realize that PwDumps7 actually does work without any sort of problem , so what's ever
On windows 8.1 Ultimate with all upgrades done
that maybe not all of them but i think i didn't make my upgrades for this week or this half of the month or something like that
anyway, it does work with windows 8.1 , you don't have to worry about that
you just go ahead and click on ( Download local copy of pwdump7 )
save as
it's going to go ahead and save it into your downloads folder , go ahead and click on save
i already have it , " Do you want to replace it " , Sure why not
running security scan , i wonder what sort of security scan is internet explorer doing
has completed , Excellent , so i need a
this is a zip file so i need a definitely something to open it
i would recommend using 7zip , but 99.99% sure all of you out there have some sort of zipping and unzipping software for
whether it's a , whether it's , property one or free version like mine which is 7zip
i am pretty sure that you all have it out there , that's why i am not going to include it in that tutorial
primarily , because pretty much already has it
is somebody needs , is somebody needs instructions on how to download and install 7zip or unzipping files
just leave it in the discussion i will be more than happy to help you out there
anyway navigate over to your downloads folder
no not here , ah yea right
Users/Creator/Downloads
so got a lot of things here , actually i don't need to be here , i need to open 7zip
sorry about that
let me just go ahead and find it , 7-zip
File Manager , Excellent
So i open it by 7-zip and you need to find pwdump7
and then you need to download John the Ripper as well
just download John The Ripper 1.7.9 (Windows binaries ZIP ) and download the latest official free versions
but go further down below where it says ( Download the latest community-enhanced version)
and then download the latest one here
after that is down , go back to your , just click just click on that link and it will download
go back to you extraction software using 7-zip
find the file here , where ever it maybe
so it's pwdump7zip and i need one more , i need john179j5w.zip
Excellent
click on extract and i don't need this folder , i am gonna go ahead and open my command line
and i have taken the liberty of actually reconfiguring the command line for windows a bit for mine
all need some purposes , i can like it this way , so just go ahead and , ops
navigate back to your root directory , the root directory here is actually C , just a drive
unlike Linux you will notice that the command is so slightly different and i have no idea
why that Microsoft actually use backslash instead of slash
that's so weird
i wish they would change that and make my life so much easier
anyway , what i wanted to do here is do "dir" for directory listing
you can actually use this command in Linux as well
dir and it will list them
so i have created a file here , i think it called pass
so , just type in "mkdir" like in Linux , space , pass , i am gonna name mine pass , you can name this folder whatever you want
this folder name can be anything , you can just smash the keyboard , here we go
and once you have the name of the folder , just press enter
[unheard] for me it says "are you save directory file pass already exists"
Primarily because it does already exists, you can actually see it here
but doesn't matter for you , i will created it
and one more thing is necessary i need to close this terminal , i completely forgot about this
you need to actually run " as administrator " on the terminal
you will need it for the creation of the folder but you do need it for [unheard] about to do
anyway , we are now , the extraction select pass , it will be ... local drive C
the folder that you have created mine is "pass" just click Ok , that will extracted there
that will extract both of the files there , you can see that i have already have them extracted , both are already there
anyway, i am just gonna ahead cancel this , close this , doesn't matter
if you encounter any problems with file extraction or if you need help in installing 7-zip for file extraction
you can use any other software that can unzip file weather if property or free or open source
well maybe it can be property or open source in any case , if it property or for free
doesn't really matter , as long as it can do the job feel free to do it without software
if you , again if you failed to do this , just post in discussion section and i will be more than happy to tell you how to unzip it
anyway let's just go back here, one more, one more , Excellent
so we will back and see , let's change directory to what we created folder
dir for listing , i am gonna have one extra folder here , it's pwdump3v2
i have just forgot that , there's previous attepmts to see and test out versions , will they work or not
so they don't pwdump7 works
anyway what we are about to do , is actually dump the password files , so go ahead and type in
go ahead and enter pwdump, nope pwdump7
Excellent , so dir , just a few files here there's an exe file you need , the exe file so type in
Pw , pretty show the windows is case insensitive , unlike Linux
but i am just gonna be , just gonna play it safe here
and i wish to create a file , same with Linux , i am gonna name it test.txt
Press Enter, opss , what is it ? it is ...
Dump is some passwords , have you done that
dir
now you haven't .. why not ? why ? what is the matter ?
ahh , ok , so
no , it's not the case for this dump system passwords
why ? why not ?
come on , come on , don't do this to me
it's dump system passwords
Excellent , so like this , oh i see what the problem was
of course , of course , i need to redirect the standard output
into a file
so you see a better of very stupid mistake in my part there , take away sometimes
but doesn't matter , i decided not get it out
just showing this things can happen , and i do have a time for not cut out my mistake from this tutorial
just so you can learn from them , all there is much you can learn from this other things to see that i am
that i can be rather stupid from time to time
anyway you don't need to upgrade to their sign in between this commands
because you want dump the output of pwdump7.exe into test.txt not to exe
if you don't do that , it's just gonna print out these things , out to this screen
and you can't really utilize them , you just printing out there standard output
unless you have replace it in file or something of a kind
it's completely useless to you
So Press Enter , this is happened , dir , do i have text out exe
no, fantastic , i have a text.txt and if i type in "notepad text.txt"
Press Enter, there we go , we have pretty much the same information that we have printed out
on the standard output
anyway, when not really interesting in looking on that file
to closely , but one good thing is , you can actually get the usernames which is fantastic
so all the usernames are here and you can use them as you choose and please all you need is passwords
but when you once have the usernames you can even preform some sort of brut force attack
on FTP or mail server or whatever
i showed you how to do that with hydra on webserver
the procedure is a pretty much too same for any other service , you just type in the parameters
just change the parameters a little bit , and that's it
probably most complex attack is on webs , web log , and service
on websites that we have log in service on them
everything else like attacking on FTP or [unheard] or something like that
is peace of cakes setup with hydra , but depending on the password string can take a while
anyway, just go ahead and close this file
now i need to go back , and go into , actually no i am gonna do this with anther way around
pwdump7 , there and now i am gonna need to type in
back, i am gonna go back once , that's going to send me into pass
and then i am gonna need to go into , john and john again and dot , i need , run , sorry
oh come on , where is it
i am just missed it , john.exe
and to this i am gonna to pass the file test.txt
Excellent, so we have loaded to password hashes with no different souls
administrator , creator , ahh ok so i need to actually expand this
ok so that's doesn't really matter , you can see everything that you need to see here , see a less
and , show souls port, where is it ? come on help me out here ..
show , ok , show eq... , aha ok so i see i see i see
ok course, i need "test.txt" i need --show space
i need to give it the file from which to read of course, i can't just expected figured it out
that is a bit stupid again from my part, and my part , but press Enter, and there you go
now by default i can selecting this here whichs very annoying , i need to go into edit and click on mark
and i can select things , amazing system
anyway, it says "Administrator : NO PASSWORD"
"Creator : Test" so i have a password for my user "creator"
its "test" , i have found it , and now i can use it for whole sources of generally wrong things
what you can use them for and how you to actually compromise
how to attempt to compromise systems , and what you can actually do
how you can explore them , should i say
we will explore a bond that further in the chapter on matesployed
and reverse shells, but on time being , i am just want to show you how you can acquire this passwords
how you can crack them
and later on , we will actually utilize them
but this is very useful skill to have to figure out how to get these passwords
anyway , i bid you all farewell , and i hope to see you in the next tutorial