When you choose to save your credentials for websites
when using certain browsers like Chrome,
it will then store them in a file that is leveraging the
data protection API to encrypt that data.
Mimikatz has functionality that allows you to decrypt these
files and view the credentials in clear text.
In this demonstration, we start out by saving our credential in Chrome,
and then using Mimikatz to unprotect and read that credential.
We then move on to changing an account password for a user account.
And last but not least,
we leverage the MemSSP tool to abuse the extensibility of LSA,
so that we can then inject a custom security provider that allows us to force a
clear text login credential to be stored within a text file.
This will work until the system has been rebooted.
So for this demonstration,
imagine you have a situation to where you've managed to get
administrative access to a user system,
and you go to see C:\Users in their AppData folder,
Local,
and you look for things like Chrome to see if they have any user data there.
There's a possibility that the user may have stored
their WebApp credentials in Chrome.
Well, if you take a look at the file here,
Login Data, and choosing Open With, and then just Notepad,
okay, and you see that you do have some data here,
but it's not readable in clear text.
So let's go ahead and exit out of this, and we'll take this information here,
and we'll open up Mimikatz,
and I've already got privilege::debug and Privilege '20' OK.
And in this case, maximize this,
we're going to leverage dpapi::chrome /unprotect /in:.
We'll paste our information there, \, put the file name in,
we'll press Enter,
and Mimikatz will identify that an encrypted key was
found in the local state file, and that it seems to be protected by dpapi,
and it will then decrypt that information,
and we have the URL here, the username, and the password all in clear text.
And sometimes you might run into a situation to where
you've gained access to a system and you don't have the
clear text credentials for a user.
So although you're on the system,
you still need to somehow know what those are so that you can perform
other activities that do require clear text credentials.
So Mimikatz can help with that.
We're going to go ahead and load up Mimikatz here,
run as administrator, maximize this privilege::debug,
and then we're going to create a log file,
there we go,
and we're going to dump all of the creds that we currently can have access to.
Let's go ahead and minimize Mimikatz, and take a look at the log file here,
here we go.
We're going to grab the NTLM hash, copy that,
minimize this, and jump back over into Mimkatz.
Let's clear the screen.
So changentlm provides the ability to change a user's password if you
have the current password or the NTLM password hash.
And then the other command that we're going to use here is setntlm,
which provides you with the capability to reset a user's password,
but it does require you to have password reset rights for the
account that you're trying to change that on.
So let's go ahead and give this a try with changentlm,
and that's part of the lsadump module.
We'll need lsadump::changentlm /server, which is our login server,
dc01.globomantics.lab1 /user,
which in this case is going to be administrator /old.
We'll paste that hash there /newpassword:NewPassword1!. We'll give that a try.
You can see here that you've got the OLD NTLM,
and then you've got the NEW NTLM, Target server,
the Target user, which was administrator,
and User RID, which is 500.
So password change is successful.
We can test that out if we want to.
Let's try to run this as a different user.
We'll use administrator, and then leverage the new password that we've created.
Give that a try, okay, and do whoamI,
we're globomantics\administrator with our new password.
Alright, so now let's see how we can do the same thing again,
but using a different technique, the setntlm.
So let's go ahead and do a quick password dump so we can grab a new hash,
and take a look at mimilog1, which is where I just had it write this,
and we'll search for amy.
There we go.
We'll grab her hash, minimize that, clear the screen, and maximize.
This time we're going to use lsadump::setntlm,
put our server in there, dc01.globomantics.lab1,
our /user:amy.miles, and in this case you just choose password,
you don't even need the hash for this.
We'll make the new password,Password!, and we'll give that a try now.
Use the new password, and let's see who we are,
whoamI, globomantics\amy.miles, and that's it.
Okay, in this demonstration,
we're going to look at MemSSP to allow you to store
future local accounts in clear text.
So let's go ahead and open up Mimikatz, run it as administrator.
We'll maximize this, use our privilege::debug,
and then we're going to use misc, and then memssp.
Now, this injected a custom security package into LSA,
and now we're going to have a file that will have all of our passwords in there.
And by default that will be located at Windows,
System32, and the file name will be mimilsa,
so let's go ahead and take a look at that.
And here we go, lots of clear text credentials.
Keep in mind that once the system is rebooted,
this functionality will no longer exist and you will
not receive any of the new logins.