In this demonstration,
we're going to take a look at creating a golden ticket with Mimikatz.
Please note that this attack does require that you have domain
administrator privileges because you're going to need to get the hash
for the KRBTGT account for this attack to work.
This can be quite difficult for a variety of reasons.
The tickets that are created can last an extremely long time and
will continue to work until the password for this account has been
changed two times. The usernames and the RIDs can be set to
anything you want them to be.
Some attackers have found very clever ways to hide their activities or to
make it very hard for the blue teams to track them down.
Basically, once an attacker has a golden ticket,
they can impersonate anyone on your domain.
Only use this attack with very specific permissions that have been
provided by someone that has the authority to do so.
This is an attack that when executed successfully gives you
somewhat permanent access to the entire domain,
and it is difficult to change the passwords for everyone and
then change the password for the KRBTGT account, not only once,
but twice. For this demonstration,
we're going to assume that you've already collected the ntds.dit.
That's the New Technology Directory Services directory information tree,
which stores all of your credentials for AD.
Now this file can be pretty large when you get it. It's also difficult to
get. You have to get it from the domain controller,
but there are various ways to do this.
Also,
there's a tool that you can use in Mimikatz to get it as well with
DCSync. So, to get this demonstration going,
let's go ahead and open up cmd as administrator.
Okay, there we go.
Now we're going to leverage a packet in order to dump the secrets
out of the ntds.dit file that I have. So, first we've got to go to
that directory, and this is just a basic install of impacket, and
I'm just using the examples.
It's a very powerful tool.
There's a lot to it, definitely way more than we're going to cover here.
We're just using the one function that it has, this secretsdump.py. Okay,
so secretsdump.py, and we need to tell it where our ntds file is.
In this case I've got it on c:\ntds‑dump\Active Directory\ntds.dit.
And then we need to give it our system file that we pulled from the
domain controller as well, and it's named SYSTEM.
We're going to put the results into an outputfile, and then end it with LOCAL.
Let that run for a second.
Okay, so now it's done that. We can close this window out.
And if you want to take a look here, we have DomainHash.txt, and the
one we're looking for right now is this KRBTGT.
And we need this piece right here.
We'll copy this for later, and we can just minimize this.
And we'll get rid of these.
We don't need these anymore.
And run Mimikatz as administrator.
We need our privilege::debug.
We're going to choose kerberos::list.
We'll go ahead and clear this part out with purge, we'll list again,
and it's nice and clean.
Clear the screen, and we'll get started with creating our golden ticket.
Let's go ahead and start with kerberos::golden, we need a user, so
we'll name him evilUser, and this can be pretty much anybody you want
or anything that you want to place there.
And you'll want to select an ID,
which is also something that you can just make up.
I'll just use 500.
And then the sid, actually,
we're going to start with the rc4 for that hash that we copied.
I'll copy that in there, and then I'll use sid, which is the domain SID.
I'm going to minimize this, open up a window, and it's just
this part right here, so don't copy the rid,
which is the last part, just that part, and then maximize this again.
Here we go.
And last but not least,
we'll tell it to go ahead and pass the ticket, and I forgot my
domain, so let's go ahead and correct that. In this case it's
domain:globomantics.lab1, and there we go.
That's more like it.
So now let's take a look at kerberos::list, and
we've got our golden ticket here.
We'll take a look at what we can do with this?
We'll use miscellaneous, misc::cmd, to open up a command window.
There we go.
We're still showing as olaf.jackson; however, take a look here.
We've got evilUser@globomantics.lab, which is what we're looking for.
So let's go to PsExec, so we use change directory to PSTools, and then PsExec
to our dc01, and we'll try to open up a command window.
There we are.
We are globomantics/evilUser.
Take a look at our groups, and as expected,
we've got Domain Admin along with lots and lots of other rights.
Now last but not least,
if you're trying to follow along at home and you don't quite know how to get
ntds.dit, there is a simple way to do it with Mimikatz itself,
but it does have to be running as a domain administrator. So you can run this.
In this case I have the domain administrator login. Do the privilege::debug and
we'll use lsadump::dcsync, and then /user:krbtgt.
There we go. And if you maximize this,
you can see that the information that we needed for
our golden ticket is right here.
So everything that we needed. As I had mentioned before, this
works really well in Mimikatz, but you do need to have a domain
administrator account to run this with.