So we come to a little bit of a meaty part of the course where we're gonna do a few videos in a row
that are kind of a little bit of Death by Powerpoint but I really need to get the point across as to
what we're doing and why we're doing it that way you have a better understanding of the following attack
that's about to come.
So this first part of the videos are on token impersonation which if you've done the other Udemy course
you've seen this in the Active Directory portion and this is a very very real thing that we see on assessments
and you're going to see how it comes into play when it comes attack time.
But I'm going to show you a quick overview we'll talk about token impersonation and then we'll start
talking about the different privileges you might see in a machine and the potato attacks.
So token impersonation what our tokens so tokens are basically like cookies for your computer.
They are temporary keys allow you to have access to a system or a network without having to provide
credentials each time you access the file.
So there are two types there's a delegate token and an impersonate token.
Now the delegate tokens what we're going to see most often you're looking for somebody logging into
a machine or even remote desktop.
But say you have a situation where you're sitting at a computer and somebody comes over and switches
user and they log in as a user while they're leaving a token behind just as you're leaving a token behind
an impersonal token uses a script more than that interaction.
So like attaching a network drive or domain log on script those are a little bit different you don't
see them as much.
So we see a lot of delegate tokens and you're going to see an example here as to why that's going to
be bad.
But just think of somebody like a domain admin logging in or helpdesk logging into a computer and just
leaving a token behind who knows when that computer's going to get rebooted.
That's the only time these tokens go away.
So let's take a look at why this is bad.
So here is an example from a lab that I had set up where we have a regular user named Frank Castle and
we load this tool called Incognito.
What you're going to see here in just a little bit and this is part of maternal fritter we list the
tokens out and we say hey I have Frank Castle here and I want to impersonate Frank Castle.
So we just say impersonate token I'm impersonating Frank Castle you go into a shell you are this user.
So we say who am I.
Frank Castle OK well let's try to run Mimi Katz and we're going to run Mimi Katz which is going to attempt
to dump the LSA off of the domain controller here which is this hydra dot marvel that local all we're
doing is nothing really malicious we're trying to dump all the hashes from the Domain Controller.
Well this person's not a domain admin so we're getting access is denied however would have a domain
AB and token was available or an administrator token or a system token don't think of this just from
an active directory even though this is an active directory example think of this for.
For any sort of escalation here if you see an administrator token when you go list all tokens and you
say hey I want to impersonate this token guess what you can drop into a shell and now you are the administrator
and you want everything from an active directory perspective if you can run Mimi Katz remotely you can
dump the LSA and you can get very sensitive hashes including the curb gross hash which allows you to
create golden tickets and do a lot of the nasty nasty things in the network.
So going back just a little bit here remember we're looking for any sort of token that's available to
us.
So if we see the administrator token and we elevate into that token we are the ministry or we control
that machine it's game over.
So that's what token impersonation is.
And it's really really bad and does show up in the real world.
So in the next video we're gonna look at the get preempts command and who am I slash all command and
look at some of the different privileges that you might see on a system and how they can relate to being
bad and then this is all going to tie together in the third video when we talk about potato attacks.
So I will get you over in the next video.