‫So let's go get some hash dumps to use in the further Hands-On experiment.
‫Go to Colly, hack a Windows system and Atash file.
‫Keep it fast, because we've seen these steps several times.
‫Open a terminal screen, start MSF console.
‫I'll use Exact to open an interpreter session on the victim search for the exploit module.
‫Now I'll set an appropriate payload.
‫So the options.
‫Set our host as my Windows XP pvm to zero seven and almost as my colleague to TA to.
‫Remember, the user is the administrator and the password is one, two, three, four, QQQ uppercase.
‫Q But please don't mind this.
‫It's just an intermediate step that we need to retrieve the hash file.
‫Now we're ready to run the export.
‫Interpretive sessions, open use, hash dump command to get the hashes and here they are.
‫So let's copy them all and place them into a text file, which will be our hash file.
‫I'll use the nano ed for this purpose.
‫I'll open a new text file named Hash, expe that text.
‫Right, click and paste.
‫Control exit to exit wider, to save changes and hit enter to, say, the file that we named at the
‫beginning.
‫Now look at the upper left corner.
‫Now we have a hash file on the desktop.
‫So now I want to get the hash file of my Windows eight VM as well.
‫I said the current interpretor session to the background, I'll use Pesek once more for Windows eight
‫PVM.
‫This time our host is two to three.
‫Username is a Meydan, suppose that we collect this data in the exploitation phase and run the exploit.
‫Now I have an interpreter session on Windows eight VM, so run hash to collect the hashes, huh?
‫It failed.
‫Will it stop us?
‫I don't think so.
‫Remember, we have another hashed out method.
‫Run post windows, gather hash dump and hit enter.
‫This method runs in a different way from the previous hashed dump method.
‫And here's the hash down for Windows eight, VM again, open a text editor and create a new text file
‫to keep these hashes.
‫So let's just for fun, have one more Hassidim, this time from Oleynik system.
‫I send the second interpreter session to the background.
‫Now, I remember that my Métis voidable Linux VM has Java, RMI, server insecure default config vulnerability.
‫So that's what I search for, Java RMI keywords.
‫And let's pick this one.
‫Show payloads to select an appropriate one, I'll set Java Interpretor, reverse TCP show options and
‫set the option.
‫Our host as Métis voidable Lennix to zero six host his colleague to to to leave the ports with the default
‫values and run the XPoint.
‫More than one session open, so I use sessions I to interact with one of them, for example, session
‫three and I have a session on Métis Voidable Linux VM.
‫Interpretor has no Hasheem function for Linux systems by default, so I'll use a post module type run
‫post Linux hash dump and hit enter.
‫And once again, we have the dump, the password hashes of the victim, so let's create a third hash
‫file for Métis, voidable to VM, same method, copy the hashes, open a text editor, paste them and
‫save the file.
‫So at the end, we have three hash files for three of our victims.