Now here I have an active shell after exploiting a vulnerable service on a
target inside the Globomantics corporation. Listing the privileges shows that we
have an admin with Medium Mandatory Level. Now let's start the privilege
escalation process by downloading our executables to the victim's machine,
downloading Akagi and Mimikatz. And then, I'll create a batch file containing a
one‑liner Mimikatz dump command.
The parameters are as follows. Log file name and path, going into debug
mode, dumping the password hashes, and then exiting so that the user on
that exploited machine won't see the command prompt that will pop up
when running this batch file.
And now I run the batch using Akagi in order to elevate the privileges and
bypass the Windows User Account Control consent box.
It has finished executing.
Let's bring the dump file to the screen. And here we go, we
have the hashes for the logged in user.
From here you can take it and brute force the
hashes or look up precomputed ones.