Password Attacks and Credential Access
Password Attacks and Credential Access
This domain tests credential discovery, capture, and cracking while respecting lockout and noise constraints. CPTS expects you to distinguish online guessing from offline cracking and to choose the right hash mode.
Core rules
- Harvest first: config files, Git history, environment variables, browser stores, SAM/LSA secrets, NTDS.dit, and Kerberos tickets. Check shares and home directories.
- Capture network auth with Responder or ntlmrelayx only when poisoning or relay is in scope. NetNTLMv2 is not an NTLM hash; it must be cracked or relayed.
- Offline cracking: identify the hash with hashid or hashcat --example-hashes, then use the correct mode (NTLM 1000, NetNTLMv2 5600, Kerberoast 13100, AS-REP 18200). Use rules such as best64.rule and target-specific masks.
- Online attacks: password spraying with a small, policy-compliant list, one password across many users, with delays. Check lockout policy first.
- Validate recovered creds against multiple services and note where they are local vs domain.
Worked example
You run Responder on an internal interface and capture a NetNTLMv2 challenge from a file server. hashcat -m 5600 hash.txt rockyou.txt -r rules/best64.rule recovers Summer2024!. You test it with nxc smb 10.10.10.0/24 -u jdoe -p Summer2024! and find it works on three hosts, including a local admin account. The reasoning is: capture only in scope, identify the protocol, crack offline, then validate access without spraying.
Traps
Locking out accounts with a spray, using mode 1000 for NetNTLMv2, ignoring password policy, cracking in the wrong hashcat format, and assuming a recovered password is domain admin. Also: not checking for credentials in files because 'the shell is enough'.