WEBVTT

00:00:01.040 --> 00:00:05.250
Now here I have an active shell after exploiting a vulnerable service on a

00:00:05.250 --> 00:00:11.110
target inside the Globomantics corporation. Listing the privileges shows that we

00:00:11.110 --> 00:00:15.730
have an admin with Medium Mandatory Level. Now let's start the privilege

00:00:15.730 --> 00:00:20.220
escalation process by downloading our executables to the victim's machine,

00:00:20.220 --> 00:00:27.260
downloading Akagi and Mimikatz. And then, I'll create a batch file containing a

00:00:27.260 --> 00:00:29.450
one‑liner Mimikatz dump command.

00:00:30.340 --> 00:00:36.230
The parameters are as follows. Log file name and path, going into debug

00:00:36.230 --> 00:00:41.760
mode, dumping the password hashes, and then exiting so that the user on

00:00:41.760 --> 00:00:45.630
that exploited machine won't see the command prompt that will pop up

00:00:45.630 --> 00:00:47.160
when running this batch file.

00:00:47.930 --> 00:00:52.660
And now I run the batch using Akagi in order to elevate the privileges and

00:00:52.660 --> 00:00:55.760
bypass the Windows User Account Control consent box.

00:00:56.240 --> 00:00:57.950
It has finished executing.

00:00:58.640 --> 00:01:06.960
Let's bring the dump file to the screen. And here we go, we

00:01:06.960 --> 00:01:09.250
have the hashes for the logged in user.

00:01:09.840 --> 00:01:12.400
From here you can take it and brute force the

00:01:12.400 --> 00:01:15.510
hashes or look up precomputed ones.