WEBVTT 00:00:01.040 --> 00:00:03.850 Hi, and welcome to Lateral Movement with Mimikatz. 00:00:04.160 --> 00:00:05.790 My name is Lee, and in this course, 00:00:05.790 --> 00:00:08.800 you are going to be provided with explanations and hands‑on 00:00:08.800 --> 00:00:11.740 demonstrations of how Mimikatz can be used towards lateral 00:00:11.740 --> 00:00:14.150 movement once a system has been compromised. 00:00:15.580 --> 00:00:19.700 Mimikatz was created and is maintained by French researcher Benjamin 00:00:19.700 --> 00:00:22.050 Delpy, who's also known by the handle gentilkiwi. 00:00:22.640 --> 00:00:26.040 He has described Mimikatz as a little tool that he's made to 00:00:26.040 --> 00:00:28.950 learn C and to experiment with Windows security. 00:00:29.540 --> 00:00:32.590 I would like to take a moment and thank him for this and other tools that 00:00:32.590 --> 00:00:34.850 he's created and released to the security community. 00:00:35.270 --> 00:00:37.520 These tools make our jobs so much easier, 00:00:37.640 --> 00:00:40.350 and in the long run, our systems so much more secure. 00:00:40.740 --> 00:00:41.430 Thanks, Benjamin. 00:00:41.690 --> 00:00:43.150 Among its other capabilities, 00:00:43.540 --> 00:00:46.360 Mimikatz can be used to pass the hash so that you can 00:00:46.370 --> 00:00:48.550 authenticate without the need of a password. 00:00:49.040 --> 00:00:53.120 It can also be used to authenticate with Kerberos tickets using pass the ticket. 00:00:53.250 --> 00:00:53.940 In addition, 00:00:54.060 --> 00:00:58.000 you can use Mimikatz to create golden and silver tickets or to 00:00:58.000 --> 00:01:00.380 push changes to legitimate domain controllers. 00:01:00.520 --> 00:01:03.850 Mimikatz is best known for its credential dumping capabilities. 00:01:04.440 --> 00:01:08.020 It allows you to pull clear text credentials or password hashes from 00:01:08.020 --> 00:01:11.470 memory, and these capabilities are all described in Pluralsight's 00:01:11.470 --> 00:01:13.750 Credential Access with Mimikatz course. 00:01:14.240 --> 00:01:16.940 This course is focused primarily on the lateral movement 00:01:16.940 --> 00:01:19.770 capabilities that Mimikatz provides. In other words, 00:01:19.780 --> 00:01:22.730 the activity of moving from system to system once a 00:01:22.730 --> 00:01:24.120 foothold has been established. 00:01:24.490 --> 00:01:25.900 In addition to lateral movement, 00:01:26.110 --> 00:01:29.370 Mimikatz can also be used towards defense evasion with tools like 00:01:29.380 --> 00:01:32.180 DCShadow. Mimikatz is open source software, 00:01:32.380 --> 00:01:36.070 and you can find instructions and downloadable precompiled binaries, as 00:01:36.070 --> 00:01:39.670 well as the source code that GitHub. Mimikatz is licensed under the 00:01:39.670 --> 00:01:44.300 Creative Commons BY 4.0. Keep in mind that you must always obtain 00:01:44.300 --> 00:01:48.090 permission from system owners before you use tools like Mimikatz on 00:01:48.090 --> 00:01:49.750 their systems and their networks. 00:01:50.180 --> 00:01:53.250 Let's take a look at the kill chain and see where Mimikatz fits in. 00:01:53.690 --> 00:01:57.200 Mimikatz can be used anywhere between the escalation stage, with 00:01:57.200 --> 00:02:00.920 capabilities such as credential dumping and setting up persistence. 00:02:01.200 --> 00:02:05.040 It is also used for lateral movement, using techniques such as pass the hash. 00:02:05.540 --> 00:02:06.040 In addition, 00:02:06.040 --> 00:02:09.150 there are also some features of Mimikatz that assist you with evading 00:02:09.150 --> 00:02:12.750 defense mechanisms using functionalities such as DCShadow. 00:02:13.540 --> 00:02:16.450 So, taking a closer look at the MITRE ATT&CK framework, 00:02:16.940 --> 00:02:19.900 which provides security professionals with a comprehensive 00:02:19.900 --> 00:02:23.780 matrix of tactics and techniques that are all based on data 00:02:23.780 --> 00:02:27.650 collected about real‑world attacks, we can determine where Mimikatz fits in. 00:02:28.840 --> 00:02:31.800 This specific course is focused on two of these tactics, 00:02:31.800 --> 00:02:35.250 defense evasion and lateral movement. 00:02:35.790 --> 00:02:39.880 The MITRE ATT&CK framework has T1207: Rogue Domain 00:02:39.880 --> 00:02:44.070 Controller listed as a defense evasion technique. With the 00:02:44.070 --> 00:02:46.420 Mimikatz DCShadow functionality, 00:02:46.700 --> 00:02:49.950 you can register a rogue domain controller that you control. 00:02:50.540 --> 00:02:54.470 This domain controller can then push data to legitimate AD 00:02:54.470 --> 00:02:58.510 controllers. Taking a look at lateral movement, it includes 00:02:58.510 --> 00:03:03.730 technique T1550: Use Alternate Authentication Material, 00:03:03.800 --> 00:03:07.480 which in turn includes two sub‑techniques that we are going to cover, 00:03:07.480 --> 00:03:13.800 the first of which is T1550.002, Pass the Hash, 00:03:14.240 --> 00:03:18.050 which provides an attacker with the capability to authenticate to a system 00:03:18.330 --> 00:03:20.650 without actually having to know what the password is. 00:03:21.140 --> 00:03:21.710 Basically, 00:03:22.140 --> 00:03:27.950 you get to access the password hash and then use that as your authentication. 00:03:28.840 --> 00:03:30.250 The second sub‑technique, 00:03:31.440 --> 00:03:37.900 T1550.003, Pass the Ticket, involves using a valid 00:03:37.900 --> 00:03:40.170 Kerberos ticket to authenticate. 00:03:40.440 --> 00:03:41.130 Once again, 00:03:41.320 --> 00:03:44.100 you are not going to need to have a user's clear text 00:03:44.100 --> 00:03:46.150 credentials to perform this attack. 00:03:46.590 --> 00:03:52.980 This course also covers T1558, Steal or Forge Kerberos Tickets, by 00:03:52.980 --> 00:03:58.650 diving into sub‑techniques T1558.1, Golden Ticket, 00:03:59.040 --> 00:04:02.190 where we leverage Mimikatz to compromise an entire 00:04:02.190 --> 00:04:07.800 domain, and T1558.002, Silver Ticket, 00:04:08.070 --> 00:04:11.000 where Mimikatz is used to forge ticket‑granting service 00:04:11.000 --> 00:04:14.350 tickets to enable access to specific resources. 00:04:15.840 --> 00:04:17.950 So how is Mimikatz used in lateral movement? 00:04:18.740 --> 00:04:22.950 Let's assume that an attacker was able to gain access to a system on a network. 00:04:23.580 --> 00:04:24.280 In this case, 00:04:24.360 --> 00:04:27.720 the attacker has compromised Sarah's system and begins 00:04:27.720 --> 00:04:30.890 reconnaissance to see if their goals can be achieved. So the 00:04:30.890 --> 00:04:33.770 attacker must get access to a system where a domain 00:04:33.770 --> 00:04:37.050 administrator has an active session established. 00:04:37.740 --> 00:04:39.540 After getting local admin access, 00:04:39.540 --> 00:04:42.150 the attacker dumps the credentials out of the memory 00:04:42.150 --> 00:04:43.590 of the system that Sarah's on, 00:04:43.770 --> 00:04:47.350 and the attacker obtains the password hash for the Jessie account. 00:04:48.140 --> 00:04:52.150 The attacker then authenticates to another system using the 00:04:52.150 --> 00:04:55.700 password hash for the Jessie account. Now authenticated to 00:04:55.700 --> 00:04:57.550 the next system as Jessie, 00:04:57.970 --> 00:05:01.610 the attacker performs further reconnaissance and identifies a machine 00:05:01.610 --> 00:05:04.510 where the Mario account has an active connection. 00:05:05.940 --> 00:05:08.150 The Mario account is a domain administrator. 00:05:09.340 --> 00:05:13.260 The attacker uses credential access techniques to find an account that 00:05:13.260 --> 00:05:16.150 has access to the machine where Mario is logged in. 00:05:16.800 --> 00:05:18.550 Once connected to Mario's desktop, 00:05:18.690 --> 00:05:22.530 the attacker dumps the credentials for the Mario account and now has the 00:05:22.530 --> 00:05:25.350 domain admin rights needed to accomplish their goals, 00:05:25.740 --> 00:05:28.230 which could include things such as creation of golden 00:05:28.230 --> 00:05:31.150 tickets or other attacks, like DCShadow.