1. 4.1.3 Manual Password Cracking
1.1. Default passwords
1.1.1. -a password which is set by a manufacterer or provider -Such passwords are usually extremely easy to guess, or are otherwise known by those seeking to take advantage of individuals or entities that don't bother to change them.
1.1.2. - CIRT.net | Suspicion Breeds Confidence - http://default-password.info - www.defaultpassword.us - www.passwordsdatabase.com
1.2. Guessing passwords
1.2.1. -attacker knows a login (from email/web page etc
1.2.2. -attempts to guess password for it
1.2.2.1. -try default passwords shipped with system -try all short passwords -search dictionaries of common words
2. 4.1.4 Attacks that can be used to gain password
2.1. Redirecting SMB Logon to attacker
2.1.1. Eavesdropping on LM responses becomes much easier if the attacker can trick the victim to attempt Windows authentication of the attacker's choice.
2.1.2. Basic trick is to send an message to the victim with an embedded hyperlink to a fraudulent SMB server.
2.1.3. When the hyperlink is clicked, the user unwittingly sends his credentials over the network.
2.2. SMB relay MITM
2.2.1. SMBRelay is essentially a SMB server that can capture usernames and password hashes from incoming SMB traffic.
2.2.2. It can also perform man-in-the-middle (MITM) attacks.
2.3. NetBIOS DOS attack
2.3.1. Sending a 'NetBIOS Name Release' message to the NetBIOS Name Service (NBNS, UDP 137) on a target NT/2000 machine forces it to place its name in conflict so that the system will no longer will be able to use it.
2.3.2. This will block the client from participating in the NetBIOS network.
2.3.3. Tool: nbname
2.3.4. NBName can disable entire LANs and prevent machines from rejoining them.
2.3.5. Nodes on a NetBIOS network infected by the tool will think that their names already are being used by other machines.
3. 4.1.5 Password cracking attacks using tool such as Hydra
3.1. How To Crack Passwords Using THC Hydra ? | HACKEROYALE
3.2. Bruteforcing with Hydra - Kali Linux
4. 4.2.1 Privilege escalation
4.1. -A privilege escalation attack is a type of network intrusion that takes advantage of programming errors or design flaws to grant the attacker elevated access to the network and its associated data and applications.
4.2. -There are two kinds of privilege escalation: vertical and horizontal.
4.3. Types of Privilege escalation
4.3.1. Vertical Privilege escalation
4.3.1.1. -Requires granting higher privileges or higher level of access than administrator. -This is accomplished by doing kernel-level operations that permit to run unauthorized code
4.3.2. Horizontal Privilege escalation
4.3.2.1. -Requires using same privileges or higher level of access that already has been granted but assuming the identity of another user with similar privileges.
5. 4.3 Perform system attack
5.1. 4.3.1 Hiding files purpose and the techniques.
5.1.1. -Personal, Private Data. -Sensitive Data. -Confidential Data, Trade Secrets. -To avoid Misuse of Data. -Unintentional damage to data, human error, accidental deletion. -Monetary, Blackmail Purposes. -Hide Traces of a crime.
5.1.2. There are two ways to hide files in Windows. The first is to use the attrib command.
5.2. 4.3.2 NTFS file streaming
5.2.1. -The second way to hide a file in Windows is with NTFS alternate data streaming.
5.2.2. NTFS file systems used by Windows NT, 2000, and XP have a feature called alternate data streams that allow data to be stored in hidden files linked to a normal, visible file.
5.3. 4.3.3 NTFS countermeasures
5.3.1. Deleting a stream file involves copying the 'front' file to a FAT partition, then copying back to NTFS.
5.3.2. Streams are lost when the file is moved to FAT Partition.
5.3.3. LNS.exe from (http://nt security.nu/cgi-bin/download/lns.exe.pl) can detect streams.
5.4. 4.3.4 Steganography technologies
5.4.1. The process of hiding data in images is called Steganography.
5.4.2. The most popular method for hiding data in files is to utilize graphic images as hiding place.
5.4.3. Attackers can embed information such as:
5.4.4. 1.Source code for hacking tool
5.4.5. 2.List of compromised servers
5.4.6. 3.Plans for future attacks
5.4.7. 4..your grandma/s secret cookie recipe
5.5. 4.3.5 Buffer overflow attack
5.5.1. -A buffer overrun is when a program allocates a block of memory of a certain length and then tries to stuff too much data into the buffer, with extra overflowing and overwriting possibly critical information crucial to the normal execution of the program.
6. 4.1.1 Rules of Password
6.1. -A password is designed to be something an individual can remember easily but at the same time not something that can be easily guessed or broken.
6.2. example of passwords that lend themselves to cracking:
6.2.1. -password that use only numbers / only letters -password that are all upper- or lowercase