WEBVTT 00:00:01.840 --> 00:00:02.930 In this demonstration, 00:00:02.940 --> 00:00:06.430 we begin with the functionality that Mimikatz is best known for, 00:00:06.460 --> 00:00:07.630 credential dumping. 00:00:07.640 --> 00:00:10.270 Every time an active login session is established, 00:00:10.640 --> 00:00:13.650 the local security authority subsystem service, 00:00:13.900 --> 00:00:19.030 LSASS, will store the credentials being used in the system's memory. 00:00:19.040 --> 00:00:21.820 An active login session could be established in several ways, 00:00:21.830 --> 00:00:23.810 including logging in locally, 00:00:23.990 --> 00:00:27.280 remoting into a system using the remote desktop protocol, and 00:00:27.280 --> 00:00:29.710 then using disconnect instead of logging off, 00:00:29.720 --> 00:00:33.850 using the run‑as command, setting up scheduled tasks that use credentials, 00:00:34.140 --> 00:00:38.280 and various other tools that would allow for remote administration capabilities. 00:00:38.300 --> 00:00:42.110 The demonstration is performed on a fully patched Windows 10 system 00:00:42.120 --> 00:00:45.270 that's been joined to the globomantics.lab1 domain. 00:00:45.940 --> 00:00:47.800 In order to see clear text passwords, 00:00:47.810 --> 00:00:50.060 we're going to have to start out by making some minor 00:00:50.060 --> 00:00:53.050 modifications to the registry so that we can then use 00:00:53.060 --> 00:00:56.260 UseLogonCredential and set it to enabled. 00:00:56.840 --> 00:00:58.760 This may require elevated privileges, 00:00:58.770 --> 00:01:01.340 which should not be a problem as usually by the time 00:01:01.340 --> 00:01:03.470 you're already using Mimikatz on a system, 00:01:03.940 --> 00:01:07.670 you would have gained admin level access to the machine anyhow. We're 00:01:07.670 --> 00:01:10.560 going to start out by creating a few logon sessions, 00:01:10.570 --> 00:01:14.560 one for a user named amy.miles and one by a domain 00:01:14.560 --> 00:01:17.220 administrator that's going to remote into the machine. We'll 00:01:17.220 --> 00:01:19.320 continue by covering some basic commands, 00:01:19.320 --> 00:01:26.160 such as privilege::debug, log, sekurlsa::logonpasswords so that we can create 00:01:26.160 --> 00:01:30.150 a log file containing the hashes and clear text passwords for any currently 00:01:30.160 --> 00:01:32.960 active login sessions that have been established. 00:01:34.640 --> 00:01:38.530 So here we have a Windows 10 system that's been fully patched and updated, 00:01:38.540 --> 00:01:41.600 and I've downloaded Mimikatz to this system. 00:01:41.610 --> 00:01:43.300 I am running as administrator, 00:01:43.310 --> 00:01:47.070 and that's pretty much recommended. Whenever you're using the Mimikatz, 00:01:47.320 --> 00:01:49.560 you should have some type of an elevated privilege. 00:01:49.560 --> 00:01:55.340 There are tools available in Mimikatz that do not require elevated privilege, 00:01:55.340 --> 00:01:57.550 but for most of them, you probably will need to have that. 00:01:58.240 --> 00:02:02.670 So let's go ahead and run Mimikatz here as administrator, 00:02:04.440 --> 00:02:07.780 and I'm going to start out with the most common command that 00:02:07.780 --> 00:02:10.860 you're probably going to use privilege::debug to make sure that 00:02:10.860 --> 00:02:14.440 you have the proper access level and we do, privilege 20 OK, if 00:02:14.440 --> 00:02:15.530 you got an error message here, 00:02:15.530 --> 00:02:19.060 you probably have some other issues going on, and we're 00:02:19.060 --> 00:02:23.100 going to try to just see if we can pull the login passwords 00:02:23.250 --> 00:02:27.960 so sekurlsa : : logonpasswords, 00:02:29.640 --> 00:02:34.790 and we'll scroll up here, and we have interactive from 1 lee Globomantics with 00:02:34.790 --> 00:02:39.520 the logon server of DC01, and if you take a look at wdigest, 00:02:39.520 --> 00:02:41.470 you'll see it has username and domain, 00:02:41.480 --> 00:02:44.750 but the password is listed as null, same with kerberos. 00:02:45.140 --> 00:02:50.440 So by default, Windows 10 is not going to display clear text passwords here, 00:02:50.450 --> 00:02:53.080 so we need to change a register key, so let's go 00:02:53.080 --> 00:02:54.500 ahead and do that, and in your case, 00:02:54.500 --> 00:02:58.160 you may even need to add this. Odds are it's not going to exist, 00:02:58.840 --> 00:03:05.340 so run regedit and you'll want to go to Computer\HKEY_LOCAL_MACHINE\ 00:03:05.340 --> 00:03:12.480 SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest and there 00:03:12.490 --> 00:03:15.930 you'll need to create a key, if one doesn't already exist, for use logon 00:03:15.930 --> 00:03:19.370 credential and you'll want to set this as 1. 00:03:21.340 --> 00:03:23.380 After that, you're going to have to reboot, 00:03:23.390 --> 00:03:28.320 so I'll go ahead and take care of that right now, and we're back, 00:03:28.320 --> 00:03:32.570 so I'll go ahead and log in, and let's go ahead and try this again. 00:03:35.040 --> 00:03:39.650 We've got our privilege : : debug and it says that we've got Privilege 20 OK, 00:03:40.640 --> 00:03:45.760 sekurlsa : : logon passwords, and we'll have to scroll up 00:03:45.760 --> 00:03:50.020 again and here we have lee Interactive from 1, and if you 00:03:50.020 --> 00:03:51.940 look down where it says wdigest, 00:03:51.940 --> 00:03:55.300 you now have username lee domain GLOBOMANTICS and password, 00:03:55.580 --> 00:04:01.610 p@ssword! in clear text. So scrolling down here, there are not any 00:04:01.610 --> 00:04:05.480 interactive sessions that are already logged in so let's go ahead 00:04:05.490 --> 00:04:07.870 and minimize this and create some. 00:04:09.440 --> 00:04:12.740 We'll start out with a run as, so in this case, 00:04:12.740 --> 00:04:16.649 I have to hold down Shift and right‑click, Run as a different user. We're 00:04:16.649 --> 00:04:19.810 already Globomantics domain, so we'll log in as amy.miles, 00:04:19.810 --> 00:04:23.610 which is a Globomantics user and have her run as a different user. 00:04:23.610 --> 00:04:26.980 So this could be in a situation where possibly you trick 00:04:26.980 --> 00:04:30.650 someone into installing something for you or somebody may 00:04:30.650 --> 00:04:32.270 have done this already in the past. 00:04:32.270 --> 00:04:36.670 There are various situations where a valid session could be established. 00:04:36.740 --> 00:04:42.960 So now if we do a whoamI, we can see this is globomantics\amy.miles. 00:04:43.440 --> 00:04:45.770 So let's take a look at me Mimikatz and see if we were 00:04:45.770 --> 00:04:48.340 able to capture her credentials, clear the screen, 00:04:48.350 --> 00:04:49.350 see who we are. 00:04:50.240 --> 00:04:55.330 We're logged in as GLOBOMATICS\lee and we'll run sekurlsa : 00:04:55.330 --> 00:04:59.070 : logonpasswords again, and scroll up. 00:05:00.240 --> 00:05:06.740 And here we have Interactive from 0, amy.miles, and we can see she's logged 00:05:06.740 --> 00:05:11.890 into the GLOBOMANTICS domain and her password is P@ssword123. So let's 00:05:11.890 --> 00:05:17.130 imagine a situation to where we have an administrator that remotes into our 00:05:17.130 --> 00:05:21.240 machine because they need to provide us with some support or for whatever 00:05:21.250 --> 00:05:22.830 other reason that they might have. 00:05:22.870 --> 00:05:26.140 So here, in a Windows 2016 Server, 00:05:26.150 --> 00:05:29.260 I can establish a remote desktop connection to the 00:05:29.260 --> 00:05:30.850 system that's been compromised. 00:05:30.940 --> 00:05:33.580 Obviously, this is probably not going to happen very often. 00:05:33.590 --> 00:05:38.070 Hopefully, your domain administrators aren't just randomly remoting into systems, 00:05:38.080 --> 00:05:39.820 but I've seen stranger things, 00:05:39.830 --> 00:05:45.250 so let's go ahead and connect. We'll click yes to the certificate error, 00:05:45.260 --> 00:05:47.970 and in this case, we have an indicator, another user is logged in, 00:05:47.980 --> 00:05:49.750 which we already knew that it would be me. 00:05:50.340 --> 00:05:52.470 So I'm going to sign in anyways. 00:05:52.940 --> 00:05:55.570 We'll typically have a timer if you do this so it's much quicker just to 00:05:55.570 --> 00:05:58.460 swap back over in your lab and log off of the other user. 00:05:58.840 --> 00:06:02.720 And now, we've logged into the system using RDP, in this case, 00:06:02.720 --> 00:06:07.110 we would perform whatever activities we needed to and then often what you'll see 00:06:07.120 --> 00:06:12.960 is somebody instead of signing out will simply disconnect. 00:06:13.840 --> 00:06:16.170 So we'll do that and we're back over on our server. 00:06:16.180 --> 00:06:21.730 So let's go ahead and have Lee log back into the Windows 10 machine, and 00:06:21.730 --> 00:06:29.320 we'll minimize this here and we'll look at Mimikatz again, sekurlsa login 00:06:29.320 --> 00:06:32.580 passwords, and we've got a lot of information here, 00:06:32.590 --> 00:06:34.170 so it's starting to get a little clunky, 00:06:34.170 --> 00:06:36.980 but we'll scroll up here and see if we can find 00:06:36.980 --> 00:06:40.620 administrator and here we have Remote Interactive from 2 00:06:40.620 --> 00:06:42.530 Administrator of GLOBOMANTICS domain, 00:06:42.540 --> 00:06:48.230 and the password is P@ssword!. So you can actually log this stuff 00:06:48.230 --> 00:06:50.540 to a file, just use log and then the file name, 00:06:50.550 --> 00:06:53.430 so we'll want to know where we're actually keeping this file at, 00:06:53.440 --> 00:06:58.230 so go to cd c:\users\lee.globomantics\desktop, 00:06:58.240 --> 00:07:00.870 and there we go, we can list the directory. 00:07:02.040 --> 00:07:04.370 And that's not one of our standard commands. 00:07:04.380 --> 00:07:05.460 So, luckily, 00:07:06.140 --> 00:07:09.190 Mimikatz will show you what some of the standard commands could 00:07:09.190 --> 00:07:12.680 have been. So this is important if you're trying to find out more 00:07:12.680 --> 00:07:14.650 about a specific command, in this case, 00:07:14.650 --> 00:07:19.370 we have host name here, we can do that, WIN10A globomantics.lab1, and we're 00:07:19.370 --> 00:07:23.360 going to log a file and it's going to be mimilog.text. 00:07:23.940 --> 00:07:24.820 And from now on, 00:07:24.830 --> 00:07:29.460 everything that we type into Mimikatz will be logged so we can go back up and 00:07:29.460 --> 00:07:35.430 do sekurlsa : : logonpasswords, and if we minimize this, 00:07:36.440 --> 00:07:40.790 we now have mimilog on the desktop, and we could just use find. 00:07:44.740 --> 00:07:55.410 There is Administrator and amy.miles, and, of course, lee.