In the previous video, we performed the AllChecks functionality
using Power Apps to discover the various types of privileged
escalation parts that exist on this target.
Now let's go ahead and actually run one of them.
So I'm going to move back to the INTERACT tab, and this time I'm going to
make use of a powershell/privesc module, but I'm going to make use of the
bypassuac_fodhelper. Within the options, I need to define a listener. I'm
going to make use of my OneDrive listener, and I'm going to go ahead and
ensure that obfuscation is enabled.
Now as soon as I hit SUBMIT, it'll leverage the
bypassuac_fodhelper, and it's going to spawn a high integrity
agent, which will get established via my OneDrive listener.
As I navigate back to the agents,
I now have a new agent that has checked in. This agent is a high
integrity agent, and we know this because it's depicted by the Elevated
Process icon. Let's go ahead and interact with the agent, and we're going
to use Mimikats to dump the credentials.
The beauty of using Mimikats within Empire is that it'll actually
run in memory and not on the disk, ultimately helping you to
evade detection to a certain degree.
And the module within Mimikats that we're going to use
specifically is the logonpasswords module.
This will help us to obtain any cached credentials that exist on this
endpoint. I'll go ahead and submit this, and then we'll take a look at the
tasks to see the results. As I scroll through the output,
we can see that Mimikats has dumped quite a bit of information.
We can see important information such as the various user
accounts along with the NTLM hashes.
Now these hashes can be used for lateral movement.
Empire will go one step further and actually store these credentials for
us in its credential database. Here, we have the ability to easily
reference the credentials, and we can also add additional credentials as
we discover them within the environment.
So now, we can go ahead and make use of a lateral movement attack.
Remember in our reconnaissance phase,
we discovered that the user account of RonHD is
actually part of a help desk group.
So we're going to attempt to leverage this user account to pivot to another
machine using a lateral movement attack within Empire.