Hi, and welcome to Lateral Movement with Mimikatz.
My name is Lee, and in this course,
you are going to be provided with explanations and hands‑on
demonstrations of how Mimikatz can be used towards lateral
movement once a system has been compromised.
Mimikatz was created and is maintained by French researcher Benjamin
Delpy, who's also known by the handle gentilkiwi.
He has described Mimikatz as a little tool that he's made to
learn C and to experiment with Windows security.
I would like to take a moment and thank him for this and other tools that
he's created and released to the security community.
These tools make our jobs so much easier,
and in the long run, our systems so much more secure.
Thanks, Benjamin.
Among its other capabilities,
Mimikatz can be used to pass the hash so that you can
authenticate without the need of a password.
It can also be used to authenticate with Kerberos tickets using pass the ticket.
In addition,
you can use Mimikatz to create golden and silver tickets or to
push changes to legitimate domain controllers.
Mimikatz is best known for its credential dumping capabilities.
It allows you to pull clear text credentials or password hashes from
memory, and these capabilities are all described in Pluralsight's
Credential Access with Mimikatz course.
This course is focused primarily on the lateral movement
capabilities that Mimikatz provides. In other words,
the activity of moving from system to system once a
foothold has been established.
In addition to lateral movement,
Mimikatz can also be used towards defense evasion with tools like
DCShadow. Mimikatz is open source software,
and you can find instructions and downloadable precompiled binaries, as
well as the source code that GitHub. Mimikatz is licensed under the
Creative Commons BY 4.0. Keep in mind that you must always obtain
permission from system owners before you use tools like Mimikatz on
their systems and their networks.
Let's take a look at the kill chain and see where Mimikatz fits in.
Mimikatz can be used anywhere between the escalation stage, with
capabilities such as credential dumping and setting up persistence.
It is also used for lateral movement, using techniques such as pass the hash.
In addition,
there are also some features of Mimikatz that assist you with evading
defense mechanisms using functionalities such as DCShadow.
So, taking a closer look at the MITRE ATT&CK framework,
which provides security professionals with a comprehensive
matrix of tactics and techniques that are all based on data
collected about real‑world attacks, we can determine where Mimikatz fits in.
This specific course is focused on two of these tactics,
defense evasion and lateral movement.
The MITRE ATT&CK framework has T1207: Rogue Domain
Controller listed as a defense evasion technique. With the
Mimikatz DCShadow functionality,
you can register a rogue domain controller that you control.
This domain controller can then push data to legitimate AD
controllers. Taking a look at lateral movement, it includes
technique T1550: Use Alternate Authentication Material,
which in turn includes two sub‑techniques that we are going to cover,
the first of which is T1550.002, Pass the Hash,
which provides an attacker with the capability to authenticate to a system
without actually having to know what the password is.
Basically,
you get to access the password hash and then use that as your authentication.
The second sub‑technique,
T1550.003, Pass the Ticket, involves using a valid
Kerberos ticket to authenticate.
Once again,
you are not going to need to have a user's clear text
credentials to perform this attack.
This course also covers T1558, Steal or Forge Kerberos Tickets, by
diving into sub‑techniques T1558.1, Golden Ticket,
where we leverage Mimikatz to compromise an entire
domain, and T1558.002, Silver Ticket,
where Mimikatz is used to forge ticket‑granting service
tickets to enable access to specific resources.
So how is Mimikatz used in lateral movement?
Let's assume that an attacker was able to gain access to a system on a network.
In this case,
the attacker has compromised Sarah's system and begins
reconnaissance to see if their goals can be achieved. So the
attacker must get access to a system where a domain
administrator has an active session established.
After getting local admin access,
the attacker dumps the credentials out of the memory
of the system that Sarah's on,
and the attacker obtains the password hash for the Jessie account.
The attacker then authenticates to another system using the
password hash for the Jessie account. Now authenticated to
the next system as Jessie,
the attacker performs further reconnaissance and identifies a machine
where the Mario account has an active connection.
The Mario account is a domain administrator.
The attacker uses credential access techniques to find an account that
has access to the machine where Mario is logged in.
Once connected to Mario's desktop,
the attacker dumps the credentials for the Mario account and now has the
domain admin rights needed to accomplish their goals,
which could include things such as creation of golden
tickets or other attacks, like DCShadow.