Would you like to learn how attackers are able to pull clear
text passwords of users with active login sessions directly from
memory or how to search and find passwords that a browser might
have stored on a system?
Hi, and welcome to Credential Access with Mimikatz. My name is Lee,
and in this course, I will provide you with explanations and hands‑on
demonstrations of how Mimikatz can be leveraged towards finding clear
text passwords on compromised systems.
Before we dive into the demonstrations,
I'm going to talk just a moment about what Mimikatz is,
who created it, and where you can find it.
Mimikatz was created by French researcher, Benjamin Delpy,
also known by the handle, gentilkiwi.
He has described Mimikatz as a little tool he has made to learn
C and to experiment with Windows security.
Benjamin Delpy is very well known for his continual and
courageous contributions to the security community.
Among other capabilities, Mimikatz can be used to extract plain text passwords,
hashes, Kerberos tickets, and PIN codes from memory.
In addition, Mimikatz can also be used to pass the hash,
pass the ticket or create golden and silver tickets.
Mimikatz is best known for its credential dumping capabilities.
It allows you to pull clear text credentials or password
hashes from the memory of a Windows system.
There are, of course,
certain dependencies involved such as requiring administrative rights for
the account that you're running Mimikatz from. Over time, many additional
capabilities have been added to Mimikatz.
Many of these may not be as well known as others.
For instance,
did you know that you're able to use Mimikatz to retrieve credentials
that have been stored or cached by certain browsers or that it can be
used to temporarily set a computer to be a domain controller on your
network? You can find downloadable, pre‑compiled binaries, and the
source code at GitHub.
The build instructions are is pretty straightforward,
and I encourage you to try your hand at building your own executables.
Keep in mind that, as with any hacking tool,
you should only use this on systems that you personally
own or have explicit permission to test.
Mimikatz is licensed under the Creative Commons BY 4.0. Mimikatz has been
used by hackers across the planet to ensure that environments are properly
secured and in some form or another by over 25 known threat groups such as
Oil Rig and Threat Group‑3390.
Due to the prolific use of this tool for both good and evil,
odds are pretty high that you may need to bypass your own antivirus and other
security controls when attempting to download the pre‑compiled binaries or
when attempting to even run Mimikatz on a system.
Let's take a look at the kill chain and see just where Mimikatz fits in.
Well, it could be used anywhere between the escalation stage with
capabilities such as credential dumping and setting up persistence.
It could also be used for lateral movement,
using techniques such as pass the hash.
There are also some features of Mimikatz that assist you in evading
defense mechanisms using functionalities such as DCShadow.
So if you take a look at the MITRE ATT&CK framework,
which provides security professionals with a comprehensive
matrix of tactics and techniques based on data that was
collected about real‑world attacks, we can determine where Mimikatz fits in.
To start, the use of Mimikatz falls into credential access,
which is focused on techniques that attackers use to
gain access to credential sets.
As Mimikatz has functionality far beyond simply dumping clear
text credentials, MITRE has also noted that it's been used by
adversaries towards persistence, defensive Asian, and lateral movement efforts.
This course is focused specifically on two of these
tactics, persistence and credential access.
The persistence tactic includes techniques such as T1098: Account Manipulation,
which, among other things,
will allow an attacker to change or reset user passwords or
change the permissions and groups of a user.
It also includes T1547.005: Security Support Provider,
which the MITRE ATT&CK framework describes as DLLs that
are loaded into the Local Security Authority, LSA, process
when the system is started.
This, then provides access to stored passwords that
have been used to log into the system.
In the Credential Access tactic, we have T1003: OS Credential Dumping,
which covers a lot of stuff, but will also involve getting access to NTLM
hashes and clear text passwords that are being stored in memory any time
that an active session exists. In this course,
we cover three OS credential dumping subtechniques.
First off, Mimikatz can be used towards T1003.001 LSASS Memory.
It can also be used for T1003.002 Security Account Manager and
T1003.004, which is the LSA Secrets subtechnique.
By the time Mimikatz is leveraged by an attacker,
there has usually already been some sort of compromise of a
system through something like phishing,
physical access or some other type of activity that lets an
attacker log into a victim's machine.
Mimikatz can then be used to gather credentials and
hashes from the victim's machine.
Let's assume that Joe from HR is using a system that
has been compromised by an attacker.
Once the attacker is able to log into the machine,
they may be able to leverage Mimikatz to gather the credentials of all
users that have active sessions on that machine.
In addition,
the attacker might be able to find credentials that are stored in
files or be able to use other capabilities such as the Mimikatz MemSSP
functionality to have any future logon passwords collected in clear
text and then written into a file.
As this course is focused on credential access and persistence,
we will not discuss the additional capabilities that Mimikatz provides.
Some of these would allow for activities that would enable the
attacker to perform actions such as pass the hash or creating
golden tickets to further compromise the networks that the
compromised system has access to.