1

I. Password CrackingLogon Windows Server 2003 and create 2 User: admin/Aa123, Admin/Aa1234User command “net user” to check

On menu bar, Click choose “+”

2

Check “Import Hash from local system”After importing, we have the result:Now, we will crack password of admin (Bruce force)

The same, we will crack password of u3 (Bruce force)

3

Log on Windows Server 2003, change username “administrator” to “duy” and create userwith username is “administrator” and password “321bca”. How to identify Administratorwhen Username is changed.

4

And now, we will concentrate to crack account “duy”

II. Escalating PrivilegesUser u1 belong to Users GroupBrowse “Supper_XP.iso” to CD/DVDBoot Virtual Machine (Windows Server 2003) from “Supper_XP”Change “C:\WINDOWS\system32\cmd.exe” “C:\WINDOWS\system32\secthc_.exe”Change “C:\WINDOWS\system32\sethc.exe” “C:\WINDOWS\system32\cmd.exe”Reset Virtual Machine, at stop logon you press “Shift” 5 times and cmd.exe will beexecute.Type “net localgroup administrators u1 /add”

5

Check u1 in Administrators GroupFinish

III. Scan Target to get vulnerability and exploitUse “Nessus & Retina Network Security Scanner” to identify vulnerability

6

7

When Scanning is complete. You can see a lot of vulnerabilities. In this case, I choose “Microsoft Windows Server Service Crafted RPC” to exploitNow, we use Metasploit tool to exploit:

Step 1: Search info of this vulnerability

Step 2: the result

Step 3: Set target IP to exploit

Step 4: Exploit

Step 5: - Remote to Victim to create User

8

User “exploit” command to create session to victimWhen logon “meterpreter” mode, we will create channel toInteract with victim through the channel has established:Now, we will create User:

IV. Hide File (Student research)Step 1: In the Command Prompt we use cd command to access disk in target

host.

9

Step 2: User Dir command to view list of files and folders in C.

Step 3: Use CD command to access to Data Folder. And DIR command to view list of files and folder.

Step 4: Use COPY /b command to bind file data.txt and contracts.txt to

images.jpg

10

Step 5: Result.