WEBVTT 00:00:00.940 --> 00:00:04.019 Would you like to learn how attackers are able to pull clear 00:00:04.019 --> 00:00:08.600 text passwords of users with active login sessions directly from 00:00:08.600 --> 00:00:13.060 memory or how to search and find passwords that a browser might 00:00:13.060 --> 00:00:14.220 have stored on a system? 00:00:14.230 --> 00:00:19.450 Hi, and welcome to Credential Access with Mimikatz. My name is Lee, 00:00:19.460 --> 00:00:23.260 and in this course, I will provide you with explanations and hands‑on 00:00:23.260 --> 00:00:27.130 demonstrations of how Mimikatz can be leveraged towards finding clear 00:00:27.130 --> 00:00:29.850 text passwords on compromised systems. 00:00:30.440 --> 00:00:32.560 Before we dive into the demonstrations, 00:00:32.570 --> 00:00:36.370 I'm going to talk just a moment about what Mimikatz is, 00:00:36.380 --> 00:00:38.660 who created it, and where you can find it. 00:00:40.140 --> 00:00:43.610 Mimikatz was created by French researcher, Benjamin Delpy, 00:00:43.620 --> 00:00:45.540 also known by the handle, gentilkiwi. 00:00:46.540 --> 00:00:50.280 He has described Mimikatz as a little tool he has made to learn 00:00:50.280 --> 00:00:53.170 C and to experiment with Windows security. 00:00:53.390 --> 00:00:56.380 Benjamin Delpy is very well known for his continual and 00:00:56.380 --> 00:00:58.990 courageous contributions to the security community. 00:00:59.180 --> 00:01:04.450 Among other capabilities, Mimikatz can be used to extract plain text passwords, 00:01:04.769 --> 00:01:08.660 hashes, Kerberos tickets, and PIN codes from memory. 00:01:09.340 --> 00:01:13.050 In addition, Mimikatz can also be used to pass the hash, 00:01:13.060 --> 00:01:16.660 pass the ticket or create golden and silver tickets. 00:01:17.040 --> 00:01:20.850 Mimikatz is best known for its credential dumping capabilities. 00:01:21.340 --> 00:01:24.380 It allows you to pull clear text credentials or password 00:01:24.380 --> 00:01:27.250 hashes from the memory of a Windows system. 00:01:27.740 --> 00:01:28.610 There are, of course, 00:01:28.610 --> 00:01:32.670 certain dependencies involved such as requiring administrative rights for 00:01:32.670 --> 00:01:36.530 the account that you're running Mimikatz from. Over time, many additional 00:01:36.530 --> 00:01:38.640 capabilities have been added to Mimikatz. 00:01:38.750 --> 00:01:41.270 Many of these may not be as well known as others. 00:01:41.640 --> 00:01:42.280 For instance, 00:01:42.390 --> 00:01:46.390 did you know that you're able to use Mimikatz to retrieve credentials 00:01:46.390 --> 00:01:50.160 that have been stored or cached by certain browsers or that it can be 00:01:50.160 --> 00:01:53.980 used to temporarily set a computer to be a domain controller on your 00:01:53.980 --> 00:01:58.240 network? You can find downloadable, pre‑compiled binaries, and the 00:01:58.240 --> 00:01:59.760 source code at GitHub. 00:02:00.640 --> 00:02:02.680 The build instructions are is pretty straightforward, 00:02:02.790 --> 00:02:05.950 and I encourage you to try your hand at building your own executables. 00:02:06.440 --> 00:02:09.240 Keep in mind that, as with any hacking tool, 00:02:09.250 --> 00:02:12.330 you should only use this on systems that you personally 00:02:12.340 --> 00:02:15.550 own or have explicit permission to test. 00:02:16.340 --> 00:02:22.040 Mimikatz is licensed under the Creative Commons BY 4.0. Mimikatz has been 00:02:22.040 --> 00:02:25.730 used by hackers across the planet to ensure that environments are properly 00:02:25.730 --> 00:02:30.880 secured and in some form or another by over 25 known threat groups such as 00:02:30.890 --> 00:02:33.470 Oil Rig and Threat Group‑3390. 00:02:34.240 --> 00:02:38.020 Due to the prolific use of this tool for both good and evil, 00:02:38.030 --> 00:02:42.830 odds are pretty high that you may need to bypass your own antivirus and other 00:02:42.830 --> 00:02:47.730 security controls when attempting to download the pre‑compiled binaries or 00:02:47.800 --> 00:02:50.470 when attempting to even run Mimikatz on a system. 00:02:50.840 --> 00:02:54.860 Let's take a look at the kill chain and see just where Mimikatz fits in. 00:02:55.740 --> 00:02:59.720 Well, it could be used anywhere between the escalation stage with 00:02:59.720 --> 00:03:03.660 capabilities such as credential dumping and setting up persistence. 00:03:04.140 --> 00:03:06.040 It could also be used for lateral movement, 00:03:06.040 --> 00:03:08.060 using techniques such as pass the hash. 00:03:08.440 --> 00:03:12.270 There are also some features of Mimikatz that assist you in evading 00:03:12.270 --> 00:03:16.270 defense mechanisms using functionalities such as DCShadow. 00:03:17.240 --> 00:03:19.770 So if you take a look at the MITRE ATT&CK framework, 00:03:19.780 --> 00:03:22.700 which provides security professionals with a comprehensive 00:03:22.700 --> 00:03:26.070 matrix of tactics and techniques based on data that was 00:03:26.070 --> 00:03:30.560 collected about real‑world attacks, we can determine where Mimikatz fits in. 00:03:31.440 --> 00:03:35.460 To start, the use of Mimikatz falls into credential access, 00:03:35.470 --> 00:03:38.860 which is focused on techniques that attackers use to 00:03:38.860 --> 00:03:40.790 gain access to credential sets. 00:03:40.920 --> 00:03:44.860 As Mimikatz has functionality far beyond simply dumping clear 00:03:44.860 --> 00:03:48.400 text credentials, MITRE has also noted that it's been used by 00:03:48.400 --> 00:03:54.150 adversaries towards persistence, defensive Asian, and lateral movement efforts. 00:03:54.540 --> 00:03:57.520 This course is focused specifically on two of these 00:03:57.520 --> 00:04:00.660 tactics, persistence and credential access. 00:04:00.910 --> 00:04:07.350 The persistence tactic includes techniques such as T1098: Account Manipulation, 00:04:07.840 --> 00:04:08.890 which, among other things, 00:04:08.890 --> 00:04:13.430 will allow an attacker to change or reset user passwords or 00:04:13.440 --> 00:04:15.740 change the permissions and groups of a user. 00:04:15.930 --> 00:04:23.150 It also includes T1547.005: Security Support Provider, 00:04:23.540 --> 00:04:27.330 which the MITRE ATT&CK framework describes as DLLs that 00:04:27.330 --> 00:04:31.210 are loaded into the Local Security Authority, LSA, process 00:04:31.220 --> 00:04:32.660 when the system is started. 00:04:33.440 --> 00:04:36.760 This, then provides access to stored passwords that 00:04:36.760 --> 00:04:38.710 have been used to log into the system. 00:04:38.720 --> 00:04:45.380 In the Credential Access tactic, we have T1003: OS Credential Dumping, 00:04:45.510 --> 00:04:50.250 which covers a lot of stuff, but will also involve getting access to NTLM 00:04:50.260 --> 00:04:54.890 hashes and clear text passwords that are being stored in memory any time 00:04:55.150 --> 00:04:57.510 that an active session exists. In this course, 00:04:57.510 --> 00:05:00.510 we cover three OS credential dumping subtechniques. 00:05:00.790 --> 00:05:07.260 First off, Mimikatz can be used towards T1003.001 LSASS Memory. 00:05:07.740 --> 00:05:14.670 It can also be used for T1003.002 Security Account Manager and 00:05:14.680 --> 00:05:20.850 T1003.004, which is the LSA Secrets subtechnique. 00:05:21.640 --> 00:05:24.370 By the time Mimikatz is leveraged by an attacker, 00:05:24.740 --> 00:05:27.830 there has usually already been some sort of compromise of a 00:05:27.830 --> 00:05:29.750 system through something like phishing, 00:05:29.760 --> 00:05:33.280 physical access or some other type of activity that lets an 00:05:33.280 --> 00:05:35.450 attacker log into a victim's machine. 00:05:37.040 --> 00:05:39.990 Mimikatz can then be used to gather credentials and 00:05:39.990 --> 00:05:41.570 hashes from the victim's machine. 00:05:42.240 --> 00:05:45.850 Let's assume that Joe from HR is using a system that 00:05:45.850 --> 00:05:47.850 has been compromised by an attacker. 00:05:48.540 --> 00:05:51.220 Once the attacker is able to log into the machine, 00:05:51.640 --> 00:05:55.780 they may be able to leverage Mimikatz to gather the credentials of all 00:05:55.790 --> 00:05:59.360 users that have active sessions on that machine. 00:06:00.040 --> 00:06:00.630 In addition, 00:06:00.630 --> 00:06:03.320 the attacker might be able to find credentials that are stored in 00:06:03.320 --> 00:06:09.220 files or be able to use other capabilities such as the Mimikatz MemSSP 00:06:09.220 --> 00:06:13.760 functionality to have any future logon passwords collected in clear 00:06:13.760 --> 00:06:15.870 text and then written into a file. 00:06:16.840 --> 00:06:20.110 As this course is focused on credential access and persistence, 00:06:20.540 --> 00:06:24.410 we will not discuss the additional capabilities that Mimikatz provides. 00:06:24.450 --> 00:06:26.950 Some of these would allow for activities that would enable the 00:06:26.950 --> 00:06:30.660 attacker to perform actions such as pass the hash or creating 00:06:30.660 --> 00:06:34.020 golden tickets to further compromise the networks that the 00:06:34.020 --> 00:06:35.870 compromised system has access to.