We start out this first demonstration with using
Mimikatz to perform a pass‑the‑hash attack.
When you don't have a user's password, a stolen hash can be used
to authenticate instead. Considering that sometimes it's
difficult to obtain clear text passwords,
this is very important, and Mimikatz makes it easy.
This attack does require that you have local administrative
privileges on the systems that you're attacking from. The lab
for this demonstration is fairly simple.
For most of the situations we have here, I'm only going to need two systems.
One is a domain controller,
which is running Windows 2016 and it's fully patched, and
then I've also got a Windows 10 system,
which is the one we're going to log in to right here.
My user is Olaf Jackson.
Olaf is a local administrator on the system. As we're going to
be demonstrating the pass‑the‑hash attack with Mimikatz, let's
go ahead and give us a nice,
juicy hash to pass. So I will start out with pressing Shift,
Run as a different user, and log in as the Globomantics administrator.
Now obviously you're probably not going to have this occur very often,
but for the sake of this demonstration, and to keep things clear,
this does make it easier.
This creates an active session for the administrator of the Globomantics domain.
So we're going to minimize this,
and we're going to open up another command prompt as Olaf and
demonstrate that he is not currently able to enter a PSSession on
DC01, which is our domain controller.
Okay,
so we did powershell ‑ep bypass for execution policy
bypass, and now we're going to simply Enter‑PSSession,
auto complete that, ComputerName, and then DC01, which is our domain controller.
As expected, this has failed, so let's open up Mimikatz after minimizing this
window. So we're going to open up Mimikatz as administrator, and we'll maximize
this. And many of the commands in Mimikatz do require you to have debug
privileges, so it's always good practice to go ahead and start out with
privilege::debug to verify that you get a 20 OK. Let's take a look at who the
user is with token::whoami. We can see here that we're running as olaf.jackson,
Globomantics domain.
Now,
the next commands we're going to have, there's a lot of outputs, so
we're going to go ahead and select log and then mimilog.txt, which
will place a log of all of the output into the folder that we're
currently in, and we're going to get to business and go ahead and pull
the hashes out of memory.
We can do that with sekurlsa, secure lsa, logonpasswords.
As you can see, there's quite a bit here.
And then if I minimize this here,
we can look at our mimilog and we have the administrator for
the Globomantics domain, and here is their hash. And this is
really what we're after here.
All right, so now we're going to use sekurlsa, pass the hash,
pth /user:administrator /domain:globomantics.lab1, and ntlm
where we paste our administrator hash.
There we go. And it opens us up a new command shell, and let's try that
command that we used earlier to see if we made any progress.
So first, let's look at who we are, and I'm still being listed as Olaf Jackson.
We'll go back in to PowerShell again, Enter‑PSSession
‑ComputerName dc01 again, and it let us right in.
So, let's do a couple of commands here, globomantics\administrator,
hostname DC01, and we'll go ahead and exit out of here.
Now what about something that might be a little bit more useful?
I mean, we've got a domain administrator account right now,
and we've got a user on this system that is just a
standard user with local admin rights.
So, let's create a new account. We'll do net user evil.hacker and a
password that meets the password complexity requirements, /ADD and
/DOMAIN, then we're going to have to maximize this screen to make
it a little easier to read.
And this time we'll do net group and we'll select Domain Admins evil.hacker
/ADD /DOMAIN, and the command completed successfully.
And this time we're going to actually go to the command prompt and we're
going to run as a different user by pressing Shift.
We're going to run this as evil.hacker with our password that we just
created, whoami, and let's take a look at the groups here. And there we
have it, everything is working as it should be.
This is an account that was created on the domain.
It is part of the domain admins, and now I can use it for
pretty much anything I needed to as long as a domain admin
has the rights to log on.