So here's Incognito, which was originally a standalone application that allowed you to impersonate
user tokens when successfully compromising a system.
This was integrated into media, sport and ultimately into interpretor.
Tokens are temporary key that allows you to access the system and network without having to provide
credentials each time you access a file.
Incognito exploits tokens by replaying that temporary key when asked to authenticate.
And there are two types of tokens, delegate and impersonate delegate tokens are created for interactive
log-on, such as logging into the machine or connecting to it via remote desktop.
Impersonate tokens are for non interactive sessions, such as attaching a network drive or a domain
log on script.
One great thing about tokens is they persist until a reboot when a user logs off, their delegate token
is reported as an impersonate token but will still hold all the rights of a delegate token.
And once you have a maturity session, you can impersonate valid tokens on the system and become that
specific user without ever having to worry about credentials or for that matter, even hashes.
During a penetration test, this is especially useful due to the fact that tokens have the possibility
of allowing local and or domain privilege escalation, enabling you alternate avenues with potentially
elevated privileges to multiple systems.
So here we are in a metaphorical session in Colly session is on Windows XP, victim incognito module
is not loaded by default, so type load incognito to load it, help incognito to list a variety of options
we have for Incognito and brief descriptions of each option.
And what we will need to do first is identify if there are any valid tokens on this system, so we'll
use the list tokens command to list the tokens.
Well, let's use it with you parameter.
Let's impersonate the administrator using impersonate token.
Now, don't forget to put a double backslash.
And after successfully impersonating a token, we check our current user I.D. by executing the get UID
command.
Now open a shell on the victim and look at who we are with the who am I command?
Well, now we have another method to see who we are through the environmental variables, echo user
domain, user name.
We are administrator, user on the CEO XP system now control see to terminate the Shell command.
Now I will use the Rev to self-command to be the system user again.
To get you I.D. to check it, OK, so we are the system user again, so now I'll open the shell again
and look who I am once more.
Well, a system user looks just like this.