In token impersonation.
You can grab a Kerberos Tolkan on the target's machine and then use it in the place of authentication
to assume the identity of the user that originally created that token.
Token impersonation is very beneficial for penetration tests.
And can be one of the territory's most powerful features, if you look at it.
So let's consider the following scenario.
For example, if you are performing a penetration test and then you successfully compromise the system
and establish an interpreter console.
A domain administrator account has logged on within the last 10 hours to the compromise machine.
So in this account, logs on a across Tolkan is passed to the server and is valid for a certain period
of time.
You exploit this system via the valid and active Kerberos token and through interpreter, you successfully
assume the role of a domain administrator without needing the password.
So then you hack a domain administrator account or go after a domain controller.
And this is probably one of the easiest ways to gain access into a system.
And just another example of why interpretor is so useful, I almost made this not a family friendly
course.
In MSA, you can accomplish this by using the Incognito extension.
Incognito was originally a standalone application that allowed you to impersonate user tokens when successfully
compromising a system.
And it was so good that it was integrated into motorsport as an extension to interpretor.
So in order to load interpretor extension, the load command is used.
Type lowed L to Leslieville extensions for the current session.
And you can use any of these extensions.
So let's load incognito.
OK, incognito, successfully loaded into my session.
So every extension has its own commands.
So does Incognito, you can type in help incognito.
To view additional commands that will come with it and also every command has a help menu.
So in the lab that we've set up.
You're not going to have a domain, so I won't use the first three commands.
OK, so let's list tokens.
And this is the help menu, and now I'm going to list tokens with the new parameter.
Now, let's again look at who I am on the system to give you a clear idea.
Right, to list tokens you.
So in a nutshell, the tokens are acting just like Web cookies.
There are temporary key that allows you to access the system and network without having to provide credentials
every time you access a file.
Incognito exploits this the same way cookie stealing works by replaying that temporary key whenever
asked to authenticate.
Now there are two types of tokens delegate and impersonate.
Delegate tokens are created for interactive longans.
Such as logging into the machine or connecting to it via remote desktop.
Impersonate tokens are for non interactive sessions.
Such as attaching a network drive or a domain log on script.
So what are the other great things about Tolkien's?
Do they persist until a reboot?
When a user logs on, their delegate token is reported as an impersonate token, but will still hold
all the rights of a delegate token.
So right now I will impersonate the token of a vagrant user.
To do this, I'm going to use impersonate token as my command, impersonate toljan and then paste the
vagrant user here.
Don't forget to add a backslash here and hit enter.
And the message is positive.
So check if it's true.
Yet UUID.
It is really true you impersonate the vagrant user.
So once you have an interpreter session, you can impersonate valid tokens on the system and become
that specific user without ever having to worry about credentials, even hashes.
So now you can continue with this user or you can go back to your actual user.
And then to do this, there's another command.
Rev to self to just type, rev to self.
And then you are in the authority system again.
Now, during a penetration test, this is especially useful since tokens have the possibility of allowing
local and or domain privilege escalation, enabling you alternate avenues with potentially elevated
privileges to multiple systems.
And that's what makes you a pro.