In this demonstration, we will use Mimikatz for a pass‑the‑ticket attack.
Basically,
you're extracting a Kerberos ticket granting ticket from LSASS with Mimikatz,
and then using that to access other systems on the network.
This will then allow you to impersonate users on your domain.
Keep in mind,
the attack does require that you have local administrator
privileges on the system that you are attacking from.
For this pass‑the‑ticket demonstration,
we're going to start out logged in as Olaf Jackson on a
Windows 10 machine that has been fully patched,
and I will give us something to look for here by running
this as domain administrator again.
So we're just trying to establish an active session.
This could have been through RDP or various other ways that someone
could have gotten their credentials into your memory of your system
that you're a local administrator for.
Then I will minimize this, start this as administrator,
and then so let's go ahead and change directory here to mimikatz.
I need to be in the x64 directory, and then run Mimikatz.
As usual,
we're going to do our privilege::debug and get our 20 OK. Now what
we need to run is the sekurlsa::tickets /export.
And as you can see, there are a lot of different tickets that were collected.
It probably would be easiest just to look at the folder, so we'll take a
look at mimikatz_trunk here in the x64, and we've got quite a few tickets
here. And I could have just changed directories in Mimikatz, but I'm
going to take these and copy them, minimize this, and just paste this in here.
And the ticket that we're interested in is this one right here.
So let's go ahead and copy this.
We're going to need that.
We'll go back into Mimikatz. So let's go ahead and exit out of Mimikatz for
just a moment and go back into PowerShell, and then we're going to try
Enter‑PSSession for DC01 to see what the result is,
and as expected, our access was denied.
So let's go back into Mimikatz and actually make sure
that we go into Mimikatz itself.
There we go.
We'll clear the screen and make sure that we have the right
permissions, and then simply kerberos, pass the ticket, and then the
full path of where our ticket is. There we go.
So we've got the full path of where this ticket is. And we'll
exit, take a look at klist. We can see that we've got the
Administrator@GLOBOMANTICS.LAB1 ticket.
Let's go back into Enter‑PSSession again, ‑ComputerName
dc01, and this time we were successful.
And there we go.
We can see the whoami/all, that we are part of the Domain Admins
and we have lots and lots of privileges. We are remoted into DC01
and we're going to close this out now.