{"id":91574,"date":"2020-08-14T19:42:27","date_gmt":"2020-08-14T17:42:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec"},"modified":"2020-08-14T19:42:27","modified_gmt":"2020-08-14T17:42:27","slug":"skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","title":{"rendered":"Skryt\u00fd hack hesiel pomocou Smbexec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Skryt\u00fd
\n
\nPravidelne p\u00ed\u0161eme o tom, ako hackeri \u010dasto vyu\u017e\u00edvaj\u00fa met\u00f3dy hackovania bez \u0161kodliv\u00e9ho k\u00f3du<\/a><\/noindex>, aby sa vyhli odhaleniu. Doslova \u201epre\u017e\u00edvaj\u00fa na podporn\u00fdch prostriedkoch\u201c<\/a><\/noindex>, pou\u017e\u00edvaj\u00fac \u0161tandardn\u00e9 n\u00e1stroje Windows, \u010d\u00edm obch\u00e1dzaj\u00fa antiv\u00edrusy a in\u00e9 n\u00e1stroje na zis\u0165ovanie \u0161kodlivej aktivity. My, ako obhajcovia, sa teraz mus\u00edme vyrovn\u00e1va\u0165 s trpk\u00fdmi n\u00e1sledkami tak\u00fdchto mazan\u00fdch techn\u00edk hackovania: dobre umiestnen\u00fd zamestnanec m\u00f4\u017ee pou\u017ei\u0165 rovnak\u00fd pr\u00edstup na skryt\u00fa kr\u00e1de\u017e \u00fadajov (du\u0161evn\u00e9ho vlastn\u00edctva spolo\u010dnosti, \u010d\u00edsel kreditn\u00fdch kariet). A ak sa nebude pon\u00e1h\u013ea\u0165, ale pracova\u0165 pomaly a nen\u00e1padne, bude extr\u00e9mne \u0165a\u017ek\u00e9 \u2014 ale st\u00e1le mo\u017en\u00e9, ak sa pou\u017eije spr\u00e1vny pr\u00edstup a pr\u00edslu\u0161n\u00e9 n\u00e1stroje<\/a><\/noindex>, \u2014 identifikova\u0165 tak\u00fa \u010dinnos\u0165.<\/p>\n

Na druhej strane, nechcel by som d\u00e9monizova\u0165 zamestnancov, preto\u017ee nikto si nechce robi\u0165 svoju pr\u00e1cu v podnikate\u013eskom prostred\u00ed priamo z \u201e1984\u201c Orwella. Na\u0161\u0165astie existuje rad praktick\u00fdch krokov a tipov, ktor\u00e9 m\u00f4\u017eu v\u00fdrazne s\u0165a\u017ei\u0165 \u017eivot insiderom. Presk\u00famame skryt\u00e9 met\u00f3dy \u00fatoku<\/strong>, ktor\u00e9 pou\u017e\u00edvaj\u00fa hackeri zamestnanci s ur\u010dit\u00fdm technick\u00fdm z\u00e1zem\u00edm. A o chv\u00ed\u013eu sa pozrieme na sp\u00f4soby, ako zn\u00ed\u017ei\u0165 tak\u00e9to rizik\u00e1 \u2013 presk\u00famame ako technick\u00e9, tak organiza\u010dn\u00e9 pr\u00edstupy.
\n<\/a><\/noindex><\/p>\n

\u010co je zl\u00e9 na PsExec?<\/h2>\n

\nEdward Snowden, \u010di u\u017e spravodlivo alebo nie, sa stal synonymom insiderovej kr\u00e1de\u017ee \u00fadajov. Mimochodom, nezabudnite sa pozrie\u0165 na tento \u010dl\u00e1nok <\/a><\/noindex>o in\u00fdch insideroch, ktor\u00ed si tie\u017e zasl\u00fa\u017eia ur\u010dit\u00fd status notoriety. Je potrebn\u00e9 zd\u00f4razni\u0165 jeden d\u00f4le\u017eit\u00fd bod o met\u00f3dach, ktor\u00e9 pou\u017e\u00edval Snowden \u2014 pokia\u013e vieme, on nenain\u0161taloval <\/em>\u017eiadny extern\u00fd \u0161kodliv\u00fd softv\u00e9r!<\/p>\n

Naopak, Snowden pou\u017eil trochu soci\u00e1lneho in\u017einierstva a vyu\u017eil svoju poz\u00edciu syst\u00e9mov\u00e9ho administr\u00e1tora na zbieranie hesiel a vytv\u00e1ranie \u00fa\u010dtov. Ni\u010d zlo\u017eit\u00e9 \u2013 \u017eiadne mimikatz<\/a><\/noindex>, \u00fatoky man-in-the-middle <\/a><\/noindex>alebo metasploit<\/a><\/noindex>. <\/p>\n

Zamestnanci organiz\u00e1ci\u00ed nie s\u00fa v\u017edy v jedine\u010dnej poz\u00edcii ako Snowden, ale z konceptu \u201epre\u017eitia na podporn\u00fdch prostriedkoch\u201c je mo\u017en\u00e9 vy\u0165a\u017ei\u0165 nieko\u013eko lekci\u00ed, ktor\u00e9 je dobr\u00e9 ma\u0165 na pam\u00e4ti \u2014 nevykon\u00e1va\u0165 \u017eiadne \u0161kodliv\u00e9 \u010dinnosti, ktor\u00e9 je mo\u017en\u00e9 odhali\u0165, a obzvl\u00e1\u0161\u0165 starostlivo pou\u017e\u00edva\u0165 prihlasovacie \u00fadaje. Zapam\u00e4tajte si t\u00fato my\u0161lienku.<\/p>\n

Psexec<\/a><\/noindex> a jeho bratranec crackmapexec <\/a><\/noindex>zanechali dojem na nespo\u010detn\u00fdch pentesteroch, hackerov a blogerov v oblasti informa\u010dnej bezpe\u010dnosti. V kombin\u00e1cii s mimikatz, psexec umo\u017e\u0148uje \u00fato\u010dn\u00edkom pohybova\u0165 sa v sieti bez toho, aby museli pozna\u0165 heslo v otvorenej forme. <\/p>\n

Mimikatz zachyt\u00e1va NTLM hash z procesu LSASS, a n\u00e1sledne pren\u00e1\u0161a token alebo \u00fadaje o \u00fa\u010dte \u2013 tzv. \u201epass the hash\u201c \u00fatok<\/strong> \u2013 v psexec, \u010do umo\u017e\u0148uje \u00fato\u010dn\u00edkovi prihl\u00e1si\u0165 sa na in\u00fd server v mene in\u00e9ho <\/em>pou\u017e\u00edvate\u013ea. A s ka\u017ed\u00fdm \u010fal\u0161\u00edm presunom na nov\u00fd server \u00fato\u010dn\u00edk zbiera \u010fal\u0161ie \u00fadaje o \u00fa\u010dtoch, \u010d\u00edm roz\u0161iruje svoj dosah v h\u013eadan\u00ed dostupn\u00e9ho obsahu.<\/p>\n

Ke\u010f som prv\u00fdkr\u00e1t za\u010dal pracova\u0165 s psexec, zdalo sa mi to len magick\u00e9 \u2013 \u010fakujem Markovi Russinovichovi<\/a><\/noindex>, geni\u00e1lnemu v\u00fdvoj\u00e1rovi psexec, \u2013 ale viem tie\u017e o jeho hlasit\u00fdch <\/em>komponentoch. Nie je \u017eiadnym sp\u00f4sobom skryt\u00fd! <\/p>\n

Prv\u00fd zauj\u00edmav\u00fd fakt o psexec je, \u017ee vyu\u017e\u00edva mimoriadne zlo\u017eit\u00fd sie\u0165ov\u00fd s\u00faborov\u00fd protokol SMB <\/strong>od Microsoftu. Pomocou SMB psexec pren\u00e1\u0161a mal\u00e9 bin\u00e1rne <\/em>s\u00fabory na cie\u013eov\u00fd syst\u00e9m, umiest\u0148uj\u00face ich do prie\u010dinka C:Windows.<\/p>\n

N\u00e1sledne psexec vytv\u00e1ra slu\u017ebu Windows pomocou skop\u00edrovan\u00e9ho bin\u00e1rneho s\u00faboru a sp\u00fa\u0161\u0165a ju pod mimoriadne \u201eprekvapiv\u00fdm\u201c menom PSEXECSVC. M\u00f4\u017eete toto v\u0161etko naozaj vidie\u0165, tak ako ja, sledovan\u00edm vzdialen\u00e9ho zariadenia (vi\u010f ni\u017e\u0161ie).<\/p>\n

\"Skryt\u00fd<\/p>\n

Vizitka Psexec: slu\u017eba \u201ePSEXECSVC\u201c. Sp\u00fa\u0161\u0165a bin\u00e1rny s\u00fabor, ktor\u00fd bol umiestnen\u00fd cez SMB do prie\u010dinka C:Windows.<\/em><\/p>\n

\nAko fin\u00e1lny krok, skop\u00edrovan\u00fd bin\u00e1rny s\u00fabor otv\u00e1ra RPC pripojenie<\/em> na cie\u013eov\u00fd server a n\u00e1sledne prij\u00edma ovl\u00e1dacie pr\u00edkazy (predvolene \u2013 cez cmd shell Windows), sp\u00fa\u0161\u0165a ich a presmerov\u00e1va vstup a v\u00fdstup na dom\u00e1ce zariadenie \u00fato\u010dn\u00edka. \u00dato\u010dn\u00edk tak vid\u00ed z\u00e1kladn\u00fd pr\u00edkazov\u00fd riadok \u2013 akoby bol pripojen\u00fd priamo. <\/p>\n

Mno\u017estvo komponentov a ve\u013emi hlu\u010dn\u00fd proces!<\/p>\n

Zlo\u017eit\u00fd mechanizmus vn\u00fatorn\u00fdch procesov psexec vysvet\u013euje spr\u00e1vu, ktor\u00e1 ma zm\u00e4tla po\u010das mojich prv\u00fdch testov pred nieko\u013ek\u00fdmi rokmi: \u201eStarting PSEXECSVC \u2026\u201c a n\u00e1sledn\u00e1 pausa pred zobrazen\u00edm pr\u00edkazov\u00e9ho riadku. <\/p>\n

\"Skryt\u00fd<\/p>\n

Psexec od Impacket v skuto\u010dnosti ukazuje, \u010do sa deje \u201epod kapotou\u201c.<\/em><\/p>\n

\nNie je divu, \u017ee psexec vykon\u00e1val obrovsk\u00e9 mno\u017estvo pr\u00e1ce \u201epod kapotou\u201c. Ak v\u00e1s zauj\u00edma podrobnej\u0161ie vysvetlenie, pozrite sa na tento <\/a><\/noindex>\u00fa\u017easn\u00fd popis.<\/p>\n

Je zrejm\u00e9, \u017ee pri pou\u017e\u00edvan\u00ed ako n\u00e1stroj na spr\u00e1vu syst\u00e9mov, \u010do bolo p\u00f4vodn\u00fdm \u00fa\u010delom <\/em>psexec, nie je ni\u010d\u00edm hrozn\u00fdm \u201ebzu\u010danie\u201c v\u0161etk\u00fdch t\u00fdchto mechanizmov Windows. Pre \u00fato\u010dn\u00edka v\u0161ak psexec vytvor\u00ed komplik\u00e1cie, a pre opatrn\u00e9ho a pref\u00edkan\u00e9ho insidera, ako je Snowden, bude psexec alebo podobn\u00fd n\u00e1stroj pr\u00edli\u0161 ve\u013ek\u00fdm rizikom.<\/p>\n

A tu prich\u00e1dza Smbexec<\/h2>\n

\nSMB je zru\u010dn\u00fd a diskr\u00e9tny sp\u00f4sob prenosu s\u00faborov medzi servermi a hackeri sa nap\u00e1jaj\u00fa priamo do SMB u\u017e odprad\u00e1vna. Mysl\u00edm, \u017ee v\u0161etci u\u017e vedia, \u017ee netreba otv\u00e1ra\u0165 <\/a><\/noindex>SMB porty 445 a 139 na internet, \u017ee?<\/p>\n

V roku 2013 na Defcone Erik Milman (brav0hax<\/a><\/noindex>) predstavil smbexec<\/a><\/noindex>, aby penetra\u010dn\u00ed tester mohli vysk\u00fa\u0161a\u0165 diskr\u00e9tne hackovanie SMB. Nezn\u00e1m cel\u00fa hist\u00f3riu, ale nesk\u00f4r Impacket \u010falej vylep\u0161il smbexec. V skuto\u010dnosti, na svoje testovanie som stiahol pr\u00e1ve skripty od Impacket v Pythone z Github<\/a><\/noindex>.<\/p>\n

Na rozdiel od psexec, smbexec vyh\u00fdba <\/em>prenosu potenci\u00e1lne detekovate\u013en\u00e9ho bin\u00e1rneho s\u00faboru na cie\u013eov\u00fd stroj. Namiesto toho n\u00e1stroj plne \u017eije z \u201epodno\u017en\u00e9ho krmiva\u201c cez spustenie miestneho<\/em> pr\u00edkazov\u00e9ho riadku Windows.<\/p>\n

Tu je, \u010do rob\u00ed: pren\u00e1\u0161a pr\u00edkaz z \u00fato\u010dnej stanice cez SMB do \u0161peci\u00e1lneho prich\u00e1dzaj\u00faceho s\u00faboru, a potom vytvor\u00ed a spust\u00ed zlo\u017eit\u00fd pr\u00edkazov\u00fd riadok (ako slu\u017eba Windows), ktor\u00fd sa bude zda\u0165 zn\u00e1mym linux\u00e1rom. Stru\u010dne povedan\u00e9: sp\u00fa\u0161\u0165a nat\u00edvny Windows-shell cmd, presmeruje v\u00fdstup do in\u00e9ho s\u00faboru a potom ho cez SMB odosiela sp\u00e4\u0165 na stroj \u00fato\u010dn\u00edka. <\/p>\n

Najlep\u0161\u00edm sp\u00f4sobom, ako to pochopi\u0165, bude presk\u00famanie pr\u00edkazov\u00e9ho riadku, ktor\u00fd som dok\u00e1zal z\u00edska\u0165 z denn\u00edka udalost\u00ed (pozri ni\u017e\u0161ie).<\/p>\n

\"Skryt\u00fd<\/p>\n

Nie je to najlep\u0161\u00ed sp\u00f4sob presmerovania vstupu\/v\u00fdstupu? Mimochodom, vytvorenie slu\u017eby m\u00e1 identifik\u00e1tor udalosti 7045.<\/em><\/p>\n

\nRovnako ako psexec, vytv\u00e1ra tie\u017e slu\u017ebu, ktor\u00e1 vykon\u00e1va cel\u00fa pr\u00e1cu, ale slu\u017eba sa potom odstr\u00e1ni<\/em> \u2013 pou\u017e\u00edva sa len raz na spustenie pr\u00edkazu a potom zmizne! Zamestnanec informa\u010dnej bezpe\u010dnosti, ktor\u00fd sleduje stroj obete, nebude schopn\u00fd odhali\u0165 \u017eiadne evidentn\u00e9 <\/em>indik\u00e1torov \u00fatoku: \u017eiadny \u0161kodliv\u00fd sp\u00fa\u0161\u0165an\u00fd s\u00fabor, \u017eiadna trval\u00e1 slu\u017eba nie je nain\u0161talovan\u00e1 a nie s\u00fa \u017eiadne d\u00f4kazy o pou\u017eit\u00ed RPC, ke\u010f\u017ee SMB je jedin\u00fdm prostriedkom prenosu \u00fadajov. Genialita!<\/p>\n

Z poh\u013eadu \u00fato\u010dn\u00edka je k dispoz\u00edcii \u201epseudo-shell\u201c so oneskoren\u00edm medzi zaslan\u00edm pr\u00edkazu a prijat\u00edm odpovede. Ale to je \u00faplne dostato\u010dn\u00e9 pre \u00fato\u010dn\u00edka \u2013 \u010di u\u017e ide o insidera alebo extern\u00e9ho hackera, ktor\u00fd u\u017e m\u00e1 v\u00fdchodisko \u2013 na za\u010datie h\u013eadania zauj\u00edmav\u00e9ho obsahu.<\/p>\n

\"Skryt\u00fd
\n
\nNa pren\u00e1\u0161anie \u00fadajov sp\u00e4\u0165 z cie\u013eov\u00e9ho zariadenia na zariadenie \u00fato\u010dn\u00edka sa pou\u017e\u00edva smbclient<\/a><\/noindex>. \u00c1no, to je t\u00e1 ist\u00e1 Samba n\u00e1stroj<\/a><\/noindex>, ale len prepracovan\u00fd na Python skript od Impacket. Fakticky, smbclient v\u00e1m umo\u017e\u0148uje diskr\u00e9tne organizova\u0165 prenos FTP cez SMB.<\/p>\n

Po\u010fme sa na chv\u00ed\u013eu zamyslie\u0165, \u010do to m\u00f4\u017ee znamena\u0165 pre zamestnanca. Vo mojom fikt\u00edvnom scen\u00e1ri, povedzme, blogerke, finan\u010dnej analytikovi alebo vysoko platen\u00e9mu bezpe\u010dnostn\u00e9mu poradcovi, je povolen\u00e9 pou\u017e\u00edva\u0165 osobn\u00fd prenosn\u00fd po\u010d\u00edta\u010d na pr\u00e1ci. V d\u00f4sledku nejak\u00e9ho magick\u00e9ho procesu sa uraz\u00ed na spolo\u010dnos\u0165 a \u201espust\u00ed sa na dr\u00e1hu\u201c. V z\u00e1vislosti od opera\u010dn\u00e9ho syst\u00e9mu prenosn\u00e9ho po\u010d\u00edta\u010da bu\u010f pou\u017eije Python verziu od Impact, alebo Windows verziu smbexec alebo smbclient vo forme .exe s\u00faboru.<\/p>\n

Rovnako ako Snowden, zist\u00ed heslo in\u00e9ho pou\u017e\u00edvate\u013ea bu\u010f tak, \u017ee ho pozoruje cez plece, alebo m\u00e1 \u0161\u0165astie a naraz\u00ed na textov\u00fd s\u00fabor s heslom. A pomocou t\u00fdchto pr\u00edstupov\u00fdch \u00fadajov za\u010dne sk\u00fama\u0165 syst\u00e9m na novej \u00farovni privil\u00e9gi\u00ed. <\/p>\n

Hack DCC: nepotrebujeme \u017eiadny \u201ehl\u00fapy\u201c Mimikatz<\/h2>\n

\nVo svojich predch\u00e1dzaj\u00facich pr\u00edspevkoch zameran\u00fdch na pentesting som ve\u013emi \u010dasto pou\u017e\u00edval mimikatz. Je to fantastick\u00fd n\u00e1stroj na zachyt\u00e1vanie pr\u00edstupov\u00fdch \u00fadajov \u2013 NTLM hashov a dokonca hesiel v otvorenej forme, skryt\u00fdch vo vn\u00fatri prenosn\u00fdch po\u010d\u00edta\u010dov a \u010dakaj\u00facich na to, aby ich niekto pou\u017eil.
\n\u010casy sa zmenili. N\u00e1stroje na monitorovanie sa zlep\u0161ili v detekcii a blokovan\u00ed mimikatz. Spr\u00e1vcovia informa\u010dnej bezpe\u010dnosti maj\u00fa teraz k dispoz\u00edcii viac mo\u017enost\u00ed na zn\u00ed\u017eenie rizika spojen\u00e9ho s \u00fatokmi typu \u201epass the hash\u201c (\u010falej \u2013 PtH).
\n\u010co by teda mal urobi\u0165 m\u00fadry zamestnanec, aby z\u00edskal \u010fal\u0161ie pr\u00edstupov\u00e9 \u00fadaje bez pou\u017eitia mimikatz?<\/p>\n

V s\u00faprave od Impacket je n\u00e1stroj s n\u00e1zvom secretsdump<\/a><\/noindex>, ktor\u00e1 extrahuje poverenia z cache Domain Credential Cache, alebo skr\u00e1tene DCC. Pokia\u013e viem, ak sa dom\u00e9nov\u00fd pou\u017e\u00edvate\u013e prihl\u00e1si na server, ale ovl\u00e1dac\u00ed server dom\u00e9ny nie je dostupn\u00fd, DCC umo\u017e\u0148uje serveru overi\u0165 pou\u017e\u00edvate\u013ea. Tak \u010di onak, secretsdump v\u00e1m umo\u017e\u0148uje vydumpova\u0165 v\u0161etky tieto hash-e, ak s\u00fa dostupn\u00e9.<\/p>\n

DCC-hashe s\u00fa nie NTML-hashe <\/em> a nem\u00f4\u017eu sa pou\u017ei\u0165 na \u00fatok PtH Samozrejme, m\u00f4\u017eete sa pok\u00fasi\u0165 ich prelomi\u0165, aby ste z\u00edskali p\u00f4vodn\u00e9 heslo. Av\u0161ak Microsoft sa stal m\u00fadrej\u0161\u00edm pri pr\u00e1ci s DCC a prelomi\u0165 DCC-hashe sa stalo mimoriadne \u0165a\u017ek\u00fdm. \u00c1no, existuje<\/em>.<\/p>\n

, \u201enajr\u00fdchlej\u0161\u00ed gener\u00e1tor hesiel na svete\u201c, ale vy\u017eaduje GPU na efekt\u00edvnu \u010dinnos\u0165. hashcat<\/a><\/noindex>Namiesto toho sa po\u010fme zamyslie\u0165 ako Snowden. Zamestnanec m\u00f4\u017ee vykona\u0165 o\u010dn\u00fa soci\u00e1lnu in\u017einieriu a mo\u017eno sa dozvedie\u0165 nejak\u00e9 inform\u00e1cie o osobe, ktorej heslo chce prelomi\u0165. Napr\u00edklad zisti\u0165, \u010di bola niekedy napadnut\u00e1 online \u00fa\u010det tejto osoby a presk\u00fama\u0165 jeho heslo v otvorenej forme na pr\u00edtomnos\u0165 nejak\u00fdch n\u00e1poved.<\/p>\n

A to je ten scen\u00e1r, ktor\u00fdm som sa rozhodol \u00eds\u0165. Predpokladajme, \u017ee insider zistil, \u017ee jeho nadriaden\u00e1, Cruella, bola nieko\u013ekokr\u00e1t napadnut\u00e1 na r\u00f4znych webov\u00fdch str\u00e1nkach. Po anal\u00fdze nieko\u013ek\u00fdch z t\u00fdchto hesiel si uvedomuje, \u017ee Cruella preferuje pou\u017e\u00edva\u0165 form\u00e1t n\u00e1zvu baseballov\u00e9ho t\u00edmu \u201eYankees\u201c a aktu\u00e1lny rok za n\u00edm \u2013 \u201eYankees2015.\u201c <\/p>\n

Ak sa teraz pok\u00fa\u0161ate reprodukova\u0165 to u v\u00e1s doma, m\u00f4\u017eete si stiahnu\u0165 mal\u00fd, \u201eC\u201c<\/p>\n

, ktor\u00fd implementuje algoritmus hashovania DCC, a skompilova\u0165 ho. k\u00f3d<\/a><\/noindex>John the Ripper , mimochodom, prid\u00e1val podporu DCC, tak\u017ee ho tie\u017e m\u00f4\u017eete pou\u017ei\u0165. Predpokladajme, \u017ee insider nechce zaobera\u0165 \u0161t\u00fadiom John the Ripper a r\u00e1d sp\u00fa\u0161\u0165a \u201egcc\u201c na zastaranom C-k\u00f3de.<\/a><\/noindex>Hraj\u00fac rolu insidera, som spustil nieko\u013eko r\u00f4znych kombin\u00e1ci\u00ed a nakoniec som dok\u00e1zal objavi\u0165, \u017ee Cruellin heslo je \u201eYankees2019\u201c (pozri ni\u017e\u0161ie). Misia splnen\u00e1!<\/p>\n

Tro\u0161ka soci\u00e1lnej in\u017einierie, \u0161tipka h\u00e1dania a tro\u0161ka Maltego \u2013 a u\u017e ste na ceste k prelomeniu DCC-hashe.<\/p>\n

\"Skryt\u00fd<\/p>\n

Navrhujem to tu skon\u010di\u0165. E\u0161te sa k tejto t\u00e9me vr\u00e1time v in\u00fdch publik\u00e1ci\u00e1ch a presk\u00famame e\u0161te viac pomal\u00fdch a skryt\u00fdch met\u00f3d \u00fatoku, pri\u010dom budeme \u010falej vych\u00e1dza\u0165 z vynikaj\u00faceho s\u00faboru n\u00e1strojov od Impacket.<\/em><\/p>\n

Navrhujem na tom skon\u010di\u0165. E\u0161te sa k tejto t\u00e9me vr\u00e1time v in\u00fdch publik\u00e1ci\u00e1ch a presk\u00famame e\u0161te viac pomal\u00fdch a skryt\u00fdch met\u00f3d \u00fatoku, pri\u010dom budeme pokra\u010dova\u0165 v opieran\u00ed sa o vynikaj\u00faci s\u00fabor n\u00e1strojov od Impacket.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0431\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0438 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u00ab\u0432\u044b\u0436\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u043f\u043e\u0434\u043d\u043e\u0436\u043d\u043e\u043c \u043a\u043e\u0440\u043c\u0443\u00bb, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Windows, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043e\u0431\u0445\u043e\u0434\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u041c\u044b, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u044b \u0438\u043c\u0435\u0442\u044c \u0434\u0435\u043b\u043e \u0441 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\u043c\u0438 \u0442\u0430\u043a\u0438\u0445 \u0445\u0438\u0442\u0440\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430: \u0443\u0434\u0430\u0447\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skryt\u00fd hack hesiel pomocou Smbexec | ProHoster","description":"Pravidelne p\u00ed\u0161eme o tom, ako hackers \u010dasto.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u0437\u043b\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Smbexec | ProHoster","og:description":"\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-14T17:42:27+00:00","article:modified_time":"2020-08-14T17:42:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:25:22","updated":"2022-09-28 07:05:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=91574"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91574\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/91575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=91574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=91574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=91574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}