{"id":91574,"date":"2020-08-14T19:42:27","date_gmt":"2020-08-14T17:42:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec"},"modified":"2020-08-14T19:42:27","modified_gmt":"2020-08-14T17:42:27","slug":"skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","title":{"rendered":"Skryt\u00fd hacking hesel pomoc\u00ed Smbexec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Skryt\u00fd
\n
\nPravideln\u011b p\u00ed\u0161eme o tom, jak hacke\u0159i \u010dasto pou\u017e\u00edvaj\u00ed metody hackov\u00e1n\u00ed bez \u0161kodliv\u00e9ho k\u00f3du<\/a><\/noindex>, aby se vyhnuli odhalen\u00ed. Doslova \u201ep\u0159e\u017e\u00edvaj\u00ed na drobc\u00edch\u201c<\/a><\/noindex>, vyu\u017e\u00edvaj\u00ed standardn\u00ed n\u00e1stroje Windows, \u010d\u00edm\u017e obejdou antiviry a dal\u0161\u00ed utility pro odhalen\u00ed \u0161kodliv\u00e9 aktivity. Jako obr\u00e1nci nyn\u00ed mus\u00edme \u010delit smutn\u00fdm d\u016fsledk\u016fm t\u011bchto mazan\u00fdch hackersk\u00fdch technik: dob\u0159e um\u00edst\u011bn\u00fd zam\u011bstnanec m\u016f\u017ee pou\u017e\u00edt stejn\u00fd p\u0159\u00edstup k tajn\u00e9 kr\u00e1de\u017ei dat (du\u0161evn\u00edho vlastnictv\u00ed spole\u010dnosti, \u010d\u00edsla kreditn\u00edch karet). A pokud si ned\u00e1 na \u010das, ale bude pracovat pomalu a nen\u00e1padn\u011b, bude extr\u00e9mn\u011b obt\u00ed\u017en\u00e9 \u2014 ale i tak mo\u017en\u00e9, pokud se pou\u017eije spr\u00e1vn\u00fd p\u0159\u00edstup a odpov\u00eddaj\u00edc\u00ed n\u00e1stroje<\/a><\/noindex>, \u2014 odhalit takovou aktivitu.<\/p>\n

Na druhou stranu, nerad bych d\u00e9monizoval zam\u011bstnance, proto\u017ee nikdo nechce pracovat v obchodn\u00edm prost\u0159ed\u00ed p\u0159\u00edmo z \u201e1984\u201c Orwella. Na\u0161t\u011bst\u00ed existuje \u0159ada praktick\u00fdch krok\u016f a tip\u016f, kter\u00e9 mohou v\u00fdrazn\u011b komplikovat \u017eivot insider\u016fm. Pod\u00edv\u00e1me se na skryt\u00e9 metody \u00fatok\u016f<\/strong>, kter\u00e9 pou\u017e\u00edvaj\u00ed hacke\u0159i zam\u011bstnanci s ur\u010ditou technickou znalost\u00ed. A brzy si probereme mo\u017enosti, jak takov\u00e1 rizika sn\u00ed\u017eit \u2013 prozkoum\u00e1me jak technick\u00e9, tak organiza\u010dn\u00ed postupy.
\n<\/a><\/noindex><\/p>\n

Co je na PsExec \u0161patn\u00e9ho?<\/h2>\n

\nEdward Snowden se spravedliv\u011b nebo nespravedliv\u011b stal synonymem insiderov\u00e9 kr\u00e1de\u017ee dat. Mimochodem, nezapome\u0148te se pod\u00edvat na tenhle \u010dl\u00e1nek <\/a><\/noindex>o dal\u0161\u00edch insiderech, kte\u0159\u00ed si rovn\u011b\u017e zaslou\u017e\u00ed ur\u010dit\u00fd stupe\u0148 proslulosti. Je t\u0159eba zd\u016fraznit jeden d\u016fle\u017eit\u00fd bod o metod\u00e1ch, kter\u00e9 pou\u017e\u00edval Snowden \u2014 jak v\u00edme, on nenainstaloval <\/em>\u017e\u00e1dn\u00fd extern\u00ed \u0161kodliv\u00fd software!<\/p>\n

Naopak, Snowden pou\u017eil trochu soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed a vyu\u017eil sv\u00e9ho postaven\u00ed syst\u00e9mov\u00e9ho administr\u00e1tora k shroma\u017e\u010fov\u00e1n\u00ed hesel a vytv\u00e1\u0159en\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f. Nic slo\u017eit\u00e9ho \u2014 \u017e\u00e1dn\u00e9 mimikatz<\/a><\/noindex>, \u00fatoky man-in-the-middle <\/a><\/noindex>nebo metasploit<\/a><\/noindex>. <\/p>\n

Zam\u011bstnanci organizac\u00ed nejsou v\u017edy v unik\u00e1tn\u00ed pozici jako Snowden, ale z konceptu \u201ep\u0159e\u017e\u00edv\u00e1n\u00ed na drobc\u00edch\u201c lze vyt\u00e1hnout \u0159adu lekc\u00ed, o kter\u00fdch je dobr\u00e9 v\u011bd\u011bt \u2013 nevykon\u00e1vat \u017e\u00e1dn\u00e9 \u0161kodliv\u00e9 akce, kter\u00e9 by mohly b\u00fdt odhaleny, a obzvl\u00e1\u0161\u0165 opatrn\u011b zach\u00e1zet s p\u0159ihla\u0161ovac\u00edmi \u00fadaji. Pamatujte na tuto my\u0161lenku.<\/p>\n

Psexec<\/a><\/noindex> a jeho bratranec crackmapexec <\/a><\/noindex>ud\u011blaly dojem na nespo\u010det penetra\u010dn\u00edch tester\u016f, hacker\u016f a bloger\u016f zab\u00fdvaj\u00edc\u00edch se kybernetickou bezpe\u010dnost\u00ed. Kombinovan\u00e9 s mimikatz, psexec umo\u017e\u0148uje \u00fato\u010dn\u00edk\u016fm pohybovat se uvnit\u0159 s\u00edt\u011b, ani\u017e by museli zn\u00e1t heslo v otev\u0159en\u00e9 podob\u011b. <\/p>\n

Mimikatz zachycuje NTLM hash z procesu LSASS a pot\u00e9 p\u0159ed\u00e1v\u00e1 token nebo p\u0159ihla\u0161ovac\u00ed \u00fadaje \u2013 tzv. \u00fatok \"pass the hash\"<\/strong> \u2013 v psexec, co\u017e umo\u017e\u0148uje \u00fato\u010dn\u00edkovi p\u0159ihl\u00e1sit se na jin\u00fd server jako jin\u00fd <\/em>u\u017eivatel. A s ka\u017ed\u00fdm dal\u0161\u00edm p\u0159esunem na nov\u00fd server \u00fato\u010dn\u00edk shroma\u017e\u010fuje dal\u0161\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje, \u010d\u00edm\u017e roz\u0161i\u0159uje sv\u00e9 mo\u017enosti v hled\u00e1n\u00ed dostupn\u00e9ho obsahu.<\/p>\n

Kdy\u017e jsem poprv\u00e9 za\u010dal pracovat s psexec, zd\u00e1l se mi opravdu kouzeln\u00fd \u2013 d\u00edky Marku Russinovichovi<\/a><\/noindex>, geni\u00e1ln\u00edmu v\u00fdvoj\u00e1\u0159i psexec, \u2013 ale tak\u00e9 v\u00edm o jeho objemn\u00fdch <\/em>komponentech. Nen\u00ed v\u016fbec nen\u00e1padn\u00fd! <\/p>\n

Prvn\u00ed zaj\u00edmav\u00fd fakt o psexec je, \u017ee pou\u017e\u00edv\u00e1 velmi slo\u017eit\u00fd s\u00ed\u0165ov\u00fd souborov\u00fd protokol SMB <\/strong>od Microsoftu. Pomoc\u00ed SMB psexec p\u0159en\u00e1\u0161\u00ed mal\u00e9 bin\u00e1rn\u00ed <\/em>souborov\u00e9 do c\u00edlov\u00e9ho syst\u00e9mu, umis\u0165uje je do slo\u017eky C:Windows.<\/p>\n

D\u00e1le psexec vytv\u00e1\u0159\u00ed slu\u017ebu Windows pomoc\u00ed zkop\u00edrovan\u00e9ho bin\u00e1rn\u00edho souboru a spou\u0161t\u00ed ji pod velmi \"ne\u010dekan\u00fdm\" n\u00e1zvem PSEXECSVC. M\u016f\u017eete to vid\u011bt na d\u00e1lkov\u00e9m stroji (viz n\u00ed\u017ee).<\/p>\n

\"Skryt\u00fd<\/p>\n

Vizitka Psexec: slu\u017eba \u201ePSEXECSVC\u201c. Spou\u0161t\u00ed bin\u00e1rn\u00ed soubor, kter\u00fd byl um\u00edst\u011bn p\u0159es SMB do slo\u017eky C:Windows.<\/em><\/p>\n

\nJako posledn\u00ed f\u00e1ze, zkop\u00edrovan\u00fd bin\u00e1rn\u00ed soubor otev\u00edr\u00e1 RPC p\u0159ipojen\u00ed<\/em> k c\u00edlov\u00e9mu serveru a pot\u00e9 p\u0159ij\u00edm\u00e1 \u0159\u00eddic\u00ed p\u0159\u00edkazy (v\u00fdchoz\u00ed \u2013 p\u0159es cmd shell Windows), spou\u0161t\u00ed je a p\u0159esm\u011brov\u00e1v\u00e1 vstup a v\u00fdstup na dom\u00e1c\u00ed stroj \u00fato\u010dn\u00edka. \u00dato\u010dn\u00edk tak vid\u00ed z\u00e1kladn\u00ed p\u0159\u00edkazov\u00fd \u0159\u00e1dek \u2013 stejn\u011b, jako by byl p\u0159ipojen p\u0159\u00edmo. <\/p>\n

Mnoho komponent\u016f a velmi hlu\u010dn\u00fd proces!<\/p>\n

Slo\u017eit\u00fd mechanismus vnit\u0159n\u00edch proces\u016f psexec vysv\u011btluje zpr\u00e1vu, kter\u00e1 m\u011b zm\u00e1tla b\u011bhem m\u00fdch prvn\u00edch test\u016f p\u0159ed n\u011bkolika lety: \u201eSpou\u0161t\u00edm PSEXECSVC ...\u201c a n\u00e1sleduj\u00edc\u00ed pauzu p\u0159ed zobrazen\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku. <\/p>\n

\"Skryt\u00fd<\/p>\n

Psexec z Impacket ve skute\u010dnosti ukazuje, co se d\u011bje \u201epod kapotou\u201c.<\/em><\/p>\n

\nNen\u00ed p\u0159ekvapen\u00edm, \u017ee psexec vykon\u00e1val obrovsk\u00e9 mno\u017estv\u00ed pr\u00e1ce \"pod kapotou\". Pokud m\u00e1te z\u00e1jem o podrobn\u011bj\u0161\u00ed vysv\u011btlen\u00ed, pod\u00edvejte se na toto <\/a><\/noindex>v\u00fdznamn\u00e9 shrnut\u00ed.<\/p>\n

Je z\u0159ejm\u00e9, \u017ee p\u0159i pou\u017eit\u00ed jako n\u00e1stroje pro syst\u00e9movou administraci, co\u017e bylo p\u016fvodn\u00edm \u00fa\u010delem <\/em>psexec, nen\u00ed nic \u0161patn\u00e9ho na \"bzu\u010den\u00ed\" v\u0161ech t\u011bchto mechanism\u016f Windows. Pro \u00fato\u010dn\u00edka v\u0161ak psexec vytvo\u0159\u00ed komplikace a pro obez\u0159etn\u00e9ho a mazan\u00e9ho insidera, jako je Snowden, bude psexec nebo podobn\u00fd n\u00e1stroj p\u0159\u00edli\u0161 velk\u00fdm rizikem.<\/p>\n

A tady p\u0159ich\u00e1z\u00ed Smbexec<\/h2>\n

\nSMB je dovedn\u00fd a skryt\u00fd zp\u016fsob p\u0159enosu soubor\u016f mezi servery a hacke\u0159i se vkl\u00e1dali p\u0159\u00edmo do SMB ji\u017e odprad\u00e1vna. P\u0159edpokl\u00e1d\u00e1m, \u017ee v\u0161ichni v\u00edte, \u017ee nen\u00ed dobr\u00e9 otev\u00edrat <\/a><\/noindex>SMB porty 445 a 139 na internetu, \u017ee?<\/p>\n

Na Defconu v roce 2013 Eric Milman (brav0hax<\/a><\/noindex>) p\u0159edstavil smbexec<\/a><\/noindex>, aby si penetra\u010dn\u00ed teste\u0159i mohli vyzkou\u0161et skryt\u00fd pr\u016fnik do SMB. Nezn\u00e1m celou historii, ale pot\u00e9 Impacket d\u00e1le vylep\u0161il smbexec. Opravdu jsem pro sv\u00e9 testov\u00e1n\u00ed st\u00e1hl pr\u00e1v\u011b skripty od Impacket v Pythonu z Github<\/a><\/noindex>.<\/p>\n

Na rozd\u00edl od psexec, smbexec se vyh\u00fdb\u00e1 <\/em>p\u0159en\u00e1\u0161en\u00ed potenci\u00e1ln\u011b detekovateln\u00e9ho bin\u00e1rn\u00edho souboru na c\u00edlov\u00fd stroj. M\u00edsto toho n\u00e1stroj \u017eije z \"podpory\" prost\u0159ednictv\u00edm spu\u0161t\u011bn\u00ed m\u00edstn\u00ed<\/em> p\u0159\u00edkazov\u00e9 \u0159\u00e1dky Windows.<\/p>\n

Co to d\u011bl\u00e1: p\u0159en\u00e1\u0161\u00ed p\u0159\u00edkaz z \u00fato\u010dn\u00e9 ma\u0161iny p\u0159es SMB do speci\u00e1ln\u00edho p\u0159\u00edchoz\u00edho souboru a pot\u00e9 vytv\u00e1\u0159\u00ed a spou\u0161t\u00ed slo\u017eitou p\u0159\u00edkazovou \u0159\u00e1dku (jako slu\u017eba Windows), kter\u00e1 se zd\u00e1 b\u00fdt zn\u00e1m\u00e1 u\u017eivatel\u016fm Linuxu. Stru\u010dn\u011b \u0159e\u010deno: spou\u0161t\u00ed nativn\u00ed Windows shell cmd, p\u0159esm\u011brov\u00e1v\u00e1 v\u00fdstup do jin\u00e9ho souboru a pot\u00e9 ho pos\u00edl\u00e1 p\u0159es SMB zp\u011bt na po\u010d\u00edta\u010d \u00fato\u010dn\u00edka. <\/p>\n

Nejlep\u0161\u00ed zp\u016fsob, jak to pochopit, je prostudovat p\u0159\u00edkazovou \u0159\u00e1dku, kterou jsem z\u00edskal z protokolu ud\u00e1lost\u00ed (viz n\u00ed\u017ee).<\/p>\n

\"Skryt\u00fd<\/p>\n

Nen\u00ed to nejlep\u0161\u00ed zp\u016fsob p\u0159esm\u011brov\u00e1n\u00ed vstupu\/v\u00fdstupu? Mimochodem, vytvo\u0159en\u00ed slu\u017eby m\u00e1 identifik\u00e1tor ud\u00e1losti 7045.<\/em><\/p>\n

\nStejn\u011b jako psexec tak\u00e9 vytv\u00e1\u0159\u00ed slu\u017ebu, kter\u00e1 vykon\u00e1v\u00e1 ve\u0161kerou pr\u00e1ci, ale slu\u017eba po tom je smaz\u00e1na<\/em> \u2013 pou\u017e\u00edv\u00e1 se pouze jednou k proveden\u00ed p\u0159\u00edkazu a pak zmiz\u00ed! Zam\u011bstnanec informa\u010dn\u00ed bezpe\u010dnosti, kter\u00fd sleduje stroj ob\u011bti, nebude schopen odhalit zjevn\u00e9 <\/em>indik\u00e1tor\u016f \u00fatoku: \u017e\u00e1dn\u00fd spou\u0161t\u011bn\u00fd \u0161kodliv\u00fd soubor, \u017e\u00e1dn\u00e1 trval\u00e1 slu\u017eba nen\u00ed nastavena a nen\u00ed d\u016fkaz o pou\u017eit\u00ed RPC, jeliko\u017e SMB je jedin\u00fdm prost\u0159edkem p\u0159enosu dat. Skv\u011bl\u00e9!<\/p>\n

\u00dato\u010dn\u00edk m\u00e1 k dispozici \"pseudo-shell\" s prodlevami mezi odesl\u00e1n\u00edm p\u0159\u00edkazu a p\u0159ijet\u00edm odpov\u011bdi. Ale to je zcela dostate\u010dn\u00e9 pro pr\u00e1ci \u00fato\u010dn\u00edka \u2013 a\u0165 u\u017e intern\u00edho nebo extern\u00edho hackera, kter\u00fd u\u017e m\u00e1 z\u00e1kladnu \u2013 aby za\u010dal hledat zaj\u00edmav\u00fd obsah.<\/p>\n

\"Skryt\u00fd
\n
\nPro zp\u011btn\u00fd p\u0159enos dat z c\u00edlov\u00e9ho stroje na stroj \u00fato\u010dn\u00edka se pou\u017e\u00edv\u00e1 smbclient<\/a><\/noindex>. Ano, to je ta sam\u00e1 Samba utilita<\/a><\/noindex>, ale p\u0159etvo\u0159en\u00e1 na Python skript pomoc\u00ed Impacket. V podstat\u011b smbclient umo\u017e\u0148uje diskr\u00e9tn\u011b organizovat p\u0159enos FTP p\u0159es SMB.<\/p>\n

Poj\u010fme ud\u011blat krok zp\u011bt a p\u0159em\u00fd\u0161let o tom, co to m\u016f\u017ee znamenat pro zam\u011bstnance. V moj\u00ed fiktivn\u00ed sc\u00e9n\u00e1\u0159i, dejme tomu, blogerce, finan\u010dn\u00ed analytikovi nebo vysoce placen\u00e9mu bezpe\u010dnostn\u00edmu konzultantovi, je povoleno pou\u017e\u00edvat osobn\u00ed notebook k pr\u00e1ci. V d\u016fsledku jist\u00e9ho magick\u00e9ho procesu se na firmu uraz\u00ed a \"pou\u0161t\u00ed se do v\u0161eho mo\u017en\u00e9ho\". V z\u00e1vislosti na opera\u010dn\u00edm syst\u00e9mu notebooku bu\u010f pou\u017e\u00edv\u00e1 verzi Pythonu od Impact, nebo Windows verzi smbexec nebo smbclient ve form\u011b .exe souboru.<\/p>\n

Stejn\u011b jako Snowden, zjist\u00ed heslo jin\u00e9ho u\u017eivatele bu\u010f tak, \u017ee mu nahl\u00e9dne p\u0159es rameno, nebo m\u00e1 \u0161t\u011bst\u00ed a naraz\u00ed na textov\u00fd soubor s heslem. A s t\u011bmito \u00fadaji za\u010dne zkoumat syst\u00e9m na nov\u00e9 \u00farovni opr\u00e1vn\u011bn\u00ed. <\/p>\n

Hacking DCC: nepot\u0159ebujeme \u017e\u00e1dn\u00fd \"hloup\u00fd\" Mimikatz<\/h2>\n

\nVe sv\u00fdch p\u0159edchoz\u00edch p\u0159\u00edsp\u011bvc\u00edch zam\u011b\u0159en\u00fdch na pentest jsem velmi \u010dasto pou\u017e\u00edval mimikatz. Je to skv\u011bl\u00fd n\u00e1stroj pro zachycen\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f \u2013 NTLM hash\u016f a dokonce i hesel v otev\u0159en\u00e9 podob\u011b, skr\u00fdvaj\u00edc\u00edch se uvnit\u0159 notebook\u016f a \u010dekaj\u00edc\u00edch, a\u017e jimi budou pou\u017eity.
\n\u010casy se zm\u011bnily. N\u00e1stroje monitorov\u00e1n\u00ed se zlep\u0161ily v detekci a blokov\u00e1n\u00ed mimikatz. Administr\u00e1to\u0159i informa\u010dn\u00ed bezpe\u010dnosti maj\u00ed tak\u00e9 v\u00edce mo\u017enost\u00ed, jak sn\u00ed\u017eit rizika spojen\u00e1 s \u00fatoky typu \"pass the hash\" (d\u00e1le jen PtH).
\nCo by tedy m\u011bl ud\u011blat chytr\u00fd zam\u011bstnanec, aby z\u00edskal dal\u0161\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje bez pou\u017eit\u00ed mimikatz?<\/p>\n

V bal\u00ed\u010dku od Impacket je n\u00e1stroj nazvan\u00fd secretsdump<\/a><\/noindex>, kter\u00e1 extrahuje p\u0159ihla\u0161ovac\u00ed \u00fadaje z ke\u0161e Domain Credential Cache, nebo stru\u010dn\u011b DCC. Jak ch\u00e1pu, pokud dom\u00e9nov\u00fd u\u017eivatel vstupuje na server, ale \u0159adi\u010d dom\u00e9ny nen\u00ed k dispozici, DCC umo\u017e\u0148uje serveru autentifikovat u\u017eivatele. Tak \u010di onak, secretsdump v\u00e1m umo\u017e\u0148uje st\u00e1hnout v\u0161echny tyto hashe, pokud jsou dostupn\u00e9.<\/p>\n

DCC-hashe jsou ne NTLM-hashe <\/em> a nelze je pou\u017e\u00edt pro \u00fatok PtH<\/em>.<\/p>\n

No, m\u016f\u017eete se pokusit je prolomit, abyste z\u00edskali p\u016fvodn\u00ed heslo. Microsoft se v\u0161ak stal chyt\u0159ej\u0161\u00edm v pr\u00e1ci s DCC a prolomit DCC-hashe je extr\u00e9mn\u011b obt\u00ed\u017en\u00e9. Ano, existuje hashcat<\/a><\/noindex>, \"nejrychlej\u0161\u00ed online gener\u00e1tor hesel na sv\u011bt\u011b\", ale vy\u017eaduje k efektivn\u00edmu fungov\u00e1n\u00ed GPU.<\/p>\n

M\u00edsto toho se pokusme uva\u017eovat jako Snowden. Zam\u011bstnanec m\u016f\u017ee prov\u00e9st osobn\u00ed soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed a mo\u017en\u00e1 zjistit n\u011bjak\u00e9 informace o osob\u011b, jej\u00ed\u017e heslo se sna\u017e\u00ed prolomit. Nap\u0159\u00edklad zjistit, zda byla kdykoli prolomena online-\u00fa\u010dty t\u00e9to osoby a prostudovat jejich heslo v otev\u0159en\u00e9 podob\u011b na p\u0159\u00edtomnost jak\u00fdchkoli indici\u00ed. <\/p>\n

A to je ten sc\u00e9n\u00e1\u0159, kter\u00fdm jsem se rozhodl \u0159\u00eddit. P\u0159edstavme si, \u017ee insider zjistil, \u017ee jej\u00ed nad\u0159\u00edzen\u00e1 Cruella byla n\u011bkolikr\u00e1t prolomena na r\u016fzn\u00fdch webov\u00fdch str\u00e1nk\u00e1ch. Po anal\u00fdze n\u011bkolika z t\u011bchto hesel si uv\u011bdomuje, \u017ee Cruella up\u0159ednost\u0148uje pou\u017e\u00edvat form\u00e1t n\u00e1zvu baseballov\u00e9ho t\u00fdmu \u201eYankees\u201c a aktu\u00e1ln\u00ed rok za n\u00edm \u2013 \u201eYankees2015\u201c.<\/p>\n

Pokud se te\u010f sna\u017e\u00edte to reprodukovat ve sv\u00fdch dom\u00e1c\u00edch podm\u00ednk\u00e1ch, m\u016f\u017eete st\u00e1hnout mal\u00fd, \u201eC\u201c k\u00f3d<\/a><\/noindex>, implementuj\u00edc\u00ed algoritmus hashov\u00e1n\u00ed DCC, a zkompilovat jej. John the Ripper<\/a><\/noindex>, mimochodem, p\u0159idal podporu DCC, tak\u017ee jej tak\u00e9 m\u016f\u017eete pou\u017e\u00edt. P\u0159edstavme si, \u017ee insider nechce ztr\u00e1cet \u010das studiem John the Ripper a preferuje spou\u0161t\u011bn\u00ed \u201egcc\u201c na zastaral\u00e9m C k\u00f3du.<\/p>\n

Ztv\u00e1r\u0148uj\u00edc\u00ed roli insidera, spustil jsem n\u011bkolik r\u016fzn\u00fdch kombinac\u00ed a nakonec jsem zjistil, \u017ee heslo Cruelly je \u201eYankees2019\u201c (viz n\u00ed\u017ee). Mise spln\u011bna!<\/p>\n

\"Skryt\u00fd<\/p>\n

Trochu soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed, \u0161petka h\u00e1d\u00e1n\u00ed a \u0161petka Maltego \u2013 a u\u017e jste na cest\u011b k prolomen\u00ed hashe DCC.<\/em><\/p>\n

Navrhuji t\u00edmto skon\u010dit. K t\u00e9to ot\u00e1zce se vr\u00e1t\u00edme v dal\u0161\u00edch publikac\u00edch a prozkoum\u00e1me je\u0161t\u011b v\u00edce pomal\u00fdch a skryt\u00fdch metod \u00fatoku, p\u0159i \u010dem\u017e budeme i nad\u00e1le stav\u011bt na vynikaj\u00edc\u00edm souboru utilit od Impacket.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0431\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0438 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u00ab\u0432\u044b\u0436\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u043f\u043e\u0434\u043d\u043e\u0436\u043d\u043e\u043c \u043a\u043e\u0440\u043c\u0443\u00bb, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Windows, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043e\u0431\u0445\u043e\u0434\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u041c\u044b, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u044b \u0438\u043c\u0435\u0442\u044c \u0434\u0435\u043b\u043e \u0441 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\u043c\u0438 \u0442\u0430\u043a\u0438\u0445 \u0445\u0438\u0442\u0440\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430: \u0443\u0434\u0430\u0447\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skryt\u00fd hack hesel pomoc\u00ed Smbexec | ProHoster","description":"Pravideln\u011b p\u00ed\u0161eme o tom, jak \u010dasto hacke\u0159i \u00fato\u010d\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u0437\u043b\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Smbexec | ProHoster","og:description":"\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-14T17:42:27+00:00","article:modified_time":"2020-08-14T17:42:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:25:22","updated":"2022-09-28 07:05:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=91574"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91574\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/91575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=91574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=91574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=91574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}