WEBVTT 00:00:01.340 --> 00:00:03.800 When you choose to save your credentials for websites 00:00:03.800 --> 00:00:06.170 when using certain browsers like Chrome, 00:00:06.540 --> 00:00:09.800 it will then store them in a file that is leveraging the 00:00:09.810 --> 00:00:12.550 data protection API to encrypt that data. 00:00:13.140 --> 00:00:15.970 Mimikatz has functionality that allows you to decrypt these 00:00:15.970 --> 00:00:18.360 files and view the credentials in clear text. 00:00:18.800 --> 00:00:22.070 In this demonstration, we start out by saving our credential in Chrome, 00:00:22.440 --> 00:00:25.770 and then using Mimikatz to unprotect and read that credential. 00:00:26.640 --> 00:00:30.060 We then move on to changing an account password for a user account. 00:00:30.160 --> 00:00:31.400 And last but not least, 00:00:31.410 --> 00:00:36.570 we leverage the MemSSP tool to abuse the extensibility of LSA, 00:00:37.040 --> 00:00:41.720 so that we can then inject a custom security provider that allows us to force a 00:00:41.720 --> 00:00:45.470 clear text login credential to be stored within a text file. 00:00:46.240 --> 00:00:48.670 This will work until the system has been rebooted. 00:00:49.240 --> 00:00:50.950 So for this demonstration, 00:00:50.960 --> 00:00:54.740 imagine you have a situation to where you've managed to get 00:00:54.750 --> 00:00:57.070 administrative access to a user system, 00:00:57.640 --> 00:01:02.620 and you go to see C:\Users in their AppData folder, 00:01:02.620 --> 00:01:03.250 Local, 00:01:03.640 --> 00:01:07.450 and you look for things like Chrome to see if they have any user data there. 00:01:08.140 --> 00:01:11.040 There's a possibility that the user may have stored 00:01:11.050 --> 00:01:13.800 their WebApp credentials in Chrome. 00:01:13.810 --> 00:01:15.910 Well, if you take a look at the file here, 00:01:15.910 --> 00:01:20.150 Login Data, and choosing Open With, and then just Notepad, 00:01:21.040 --> 00:01:24.080 okay, and you see that you do have some data here, 00:01:24.090 --> 00:01:26.240 but it's not readable in clear text. 00:01:26.250 --> 00:01:30.750 So let's go ahead and exit out of this, and we'll take this information here, 00:01:31.440 --> 00:01:32.490 and we'll open up Mimikatz, 00:01:32.490 --> 00:01:36.900 and I've already got privilege::debug and Privilege '20' OK. 00:01:36.900 --> 00:01:39.440 And in this case, maximize this, 00:01:39.440 --> 00:01:46.460 we're going to leverage dpapi::chrome /unprotect /in:. 00:01:46.460 --> 00:01:51.370 We'll paste our information there, \, put the file name in, 00:01:51.370 --> 00:01:53.060 we'll press Enter, 00:01:53.440 --> 00:01:56.750 and Mimikatz will identify that an encrypted key was 00:01:56.750 --> 00:02:01.580 found in the local state file, and that it seems to be protected by dpapi, 00:02:02.540 --> 00:02:04.580 and it will then decrypt that information, 00:02:04.580 --> 00:02:10.070 and we have the URL here, the username, and the password all in clear text. 00:02:10.940 --> 00:02:13.290 And sometimes you might run into a situation to where 00:02:13.290 --> 00:02:17.110 you've gained access to a system and you don't have the 00:02:17.120 --> 00:02:19.370 clear text credentials for a user. 00:02:19.740 --> 00:02:21.240 So although you're on the system, 00:02:21.240 --> 00:02:25.380 you still need to somehow know what those are so that you can perform 00:02:25.380 --> 00:02:28.260 other activities that do require clear text credentials. 00:02:28.840 --> 00:02:30.550 So Mimikatz can help with that. 00:02:31.040 --> 00:02:34.470 We're going to go ahead and load up Mimikatz here, 00:02:34.480 --> 00:02:38.400 run as administrator, maximize this privilege::debug, 00:02:38.630 --> 00:02:41.080 and then we're going to create a log file, 00:02:41.080 --> 00:02:42.200 there we go, 00:02:42.210 --> 00:02:45.870 and we're going to dump all of the creds that we currently can have access to. 00:02:47.840 --> 00:02:53.820 Let's go ahead and minimize Mimikatz, and take a look at the log file here, 00:02:53.820 --> 00:02:56.130 here we go. 00:02:56.140 --> 00:03:03.430 We're going to grab the NTLM hash, copy that, 00:03:03.430 --> 00:03:07.890 minimize this, and jump back over into Mimkatz. 00:03:08.020 --> 00:03:09.070 Let's clear the screen. 00:03:09.440 --> 00:03:14.410 So changentlm provides the ability to change a user's password if you 00:03:14.410 --> 00:03:18.800 have the current password or the NTLM password hash. 00:03:18.810 --> 00:03:21.990 And then the other command that we're going to use here is setntlm, 00:03:22.000 --> 00:03:25.420 which provides you with the capability to reset a user's password, 00:03:25.420 --> 00:03:28.890 but it does require you to have password reset rights for the 00:03:28.890 --> 00:03:30.760 account that you're trying to change that on. 00:03:30.940 --> 00:03:33.590 So let's go ahead and give this a try with changentlm, 00:03:33.590 --> 00:03:36.850 and that's part of the lsadump module. 00:03:37.340 --> 00:03:46.930 We'll need lsadump::changentlm /server, which is our login server, 00:03:46.930 --> 00:03:50.680 dc01.globomantics.lab1 /user, 00:03:50.680 --> 00:03:57.210 which in this case is going to be administrator /old. 00:03:57.220 --> 00:04:06.270 We'll paste that hash there /newpassword:NewPassword1!. We'll give that a try. 00:04:06.940 --> 00:04:09.550 You can see here that you've got the OLD NTLM, 00:04:09.560 --> 00:04:13.050 and then you've got the NEW NTLM, Target server, 00:04:13.060 --> 00:04:15.050 the Target user, which was administrator, 00:04:15.540 --> 00:04:18.360 and User RID, which is 500. 00:04:18.839 --> 00:04:20.300 So password change is successful. 00:04:20.300 --> 00:04:22.260 We can test that out if we want to. 00:04:22.500 --> 00:04:27.590 Let's try to run this as a different user. 00:04:27.590 --> 00:04:32.050 We'll use administrator, and then leverage the new password that we've created. 00:04:32.940 --> 00:04:37.300 Give that a try, okay, and do whoamI, 00:04:37.300 --> 00:04:41.270 we're globomantics\administrator with our new password. 00:04:42.840 --> 00:04:46.370 Alright, so now let's see how we can do the same thing again, 00:04:46.370 --> 00:04:51.020 but using a different technique, the setntlm. 00:04:51.030 --> 00:04:55.440 So let's go ahead and do a quick password dump so we can grab a new hash, 00:04:57.640 --> 00:05:00.570 and take a look at mimilog1, which is where I just had it write this, 00:05:00.570 --> 00:05:01.750 and we'll search for amy. 00:05:04.040 --> 00:05:04.550 There we go. 00:05:05.740 --> 00:05:12.410 We'll grab her hash, minimize that, clear the screen, and maximize. 00:05:12.420 --> 00:05:15.690 This time we're going to use lsadump::setntlm, 00:05:15.690 --> 00:05:20.720 put our server in there, dc01.globomantics.lab1, 00:05:20.720 --> 00:05:26.280 our /user:amy.miles, and in this case you just choose password, 00:05:26.280 --> 00:05:28.230 you don't even need the hash for this. 00:05:28.230 --> 00:05:37.270 We'll make the new password,Password!, and we'll give that a try now. 00:05:37.270 --> 00:05:45.700 Use the new password, and let's see who we are, 00:05:45.700 --> 00:05:51.070 whoamI, globomantics\amy.miles, and that's it. 00:05:51.640 --> 00:05:53.130 Okay, in this demonstration, 00:05:53.130 --> 00:05:56.670 we're going to look at MemSSP to allow you to store 00:05:56.670 --> 00:05:58.940 future local accounts in clear text. 00:05:58.950 --> 00:06:03.120 So let's go ahead and open up Mimikatz, run it as administrator. 00:06:03.120 --> 00:06:07.170 We'll maximize this, use our privilege::debug, 00:06:07.180 --> 00:06:11.960 and then we're going to use misc, and then memssp. 00:06:12.340 --> 00:06:16.530 Now, this injected a custom security package into LSA, 00:06:16.530 --> 00:06:21.200 and now we're going to have a file that will have all of our passwords in there. 00:06:21.200 --> 00:06:25.440 And by default that will be located at Windows, 00:06:25.440 --> 00:06:28.930 System32, and the file name will be mimilsa, 00:06:28.930 --> 00:06:31.050 so let's go ahead and take a look at that. 00:06:32.240 --> 00:06:36.140 And here we go, lots of clear text credentials. 00:06:36.150 --> 00:06:38.840 Keep in mind that once the system is rebooted, 00:06:38.850 --> 00:06:41.380 this functionality will no longer exist and you will 00:06:41.380 --> 00:06:43.460 not receive any of the new logins.