Skip to content

Phishing For Remote LogOn Credentials

Jump to bottom
pedro ubuntu edited this page Jul 19, 2020 · 39 revisions

Description

This Module allows attackers to Lock Target WorkStation and request for a valid UserAccount password to UnLock it. While in background it stores the credentials captured to a logfile (remote) under $env:tmp folder for later review, only then it will UnLock target WorkStation ..[url] enigma0x3 - phishing for credentials

Remark

  • NewPhish.ps1 It keeps checking valid credentials againt the DC unless the process its stoped
  • CredsPhish.ps1 will run (loop) when exec in a machine that does not have LogOn password set
  • ALL the Modules Used in this article does not require the Client to be executed with Admin Privs

Article Quick Jump List


Phish for Credentials

1º - Sellect meterpeter 'PostExploit' Module 1

2º - Sellect meterpeter 'CredPhi' Module fg

3º - Sellect meterpeter 'OldBox' OR NewBox Module
fg


This Module allow attacker to Lock Target WorkStation and request for a valid UserAccount password to UnLock it, While in background it stores the credentials captured to a logfile (remote) under $env:tmp folder for later review, only then it will UnLock target WorkStation ..

Old Credentials MsgBox (windows <7) - PostExploit -> CredPhi -> OldBox
4 New Credentials MsgBox (windows >7) - PostExploit -> CredPhi -> NewBox
new

  • Remark:

    • The meterpeter (Server) remains frozen While a valid credential its not enter remotely (???).
    • The credentials enter will be validated (or not) against the DomainControler or LocalMachine.
    • CredsPhish.ps1 will run in infinite loop when executed in a machine that does not have
      the logon password set by default. (its set to run 1000000000 times before exit execution).

      count
    • NewPhish.ps1 It keeps checking credentials againts the DC unless the process its stoped

  • Jump To Top


Read remote logfile

1º - Sellect meterpeter 'ReadLog' Module
5

  • Remark:

    • meterpeter will try to delete all related Scripts/Files left behind after ReadLog execution.

  • Jump To Top

Clone this wiki locally