WEBVTT 00:00:01.740 --> 00:00:04.330 We start out this first demonstration with using 00:00:04.330 --> 00:00:07.050 Mimikatz to perform a pass‑the‑hash attack. 00:00:07.940 --> 00:00:11.540 When you don't have a user's password, a stolen hash can be used 00:00:11.540 --> 00:00:14.780 to authenticate instead. Considering that sometimes it's 00:00:14.780 --> 00:00:17.150 difficult to obtain clear text passwords, 00:00:17.640 --> 00:00:20.600 this is very important, and Mimikatz makes it easy. 00:00:20.700 --> 00:00:23.430 This attack does require that you have local administrative 00:00:23.430 --> 00:00:27.090 privileges on the systems that you're attacking from. The lab 00:00:27.100 --> 00:00:28.950 for this demonstration is fairly simple. 00:00:29.380 --> 00:00:33.240 For most of the situations we have here, I'm only going to need two systems. 00:00:33.490 --> 00:00:35.460 One is a domain controller, 00:00:35.460 --> 00:00:39.430 which is running Windows 2016 and it's fully patched, and 00:00:39.430 --> 00:00:41.490 then I've also got a Windows 10 system, 00:00:41.490 --> 00:00:43.350 which is the one we're going to log in to right here. 00:00:44.270 --> 00:00:46.200 My user is Olaf Jackson. 00:00:46.300 --> 00:00:52.130 Olaf is a local administrator on the system. As we're going to 00:00:52.130 --> 00:00:56.210 be demonstrating the pass‑the‑hash attack with Mimikatz, let's 00:00:56.210 --> 00:00:57.790 go ahead and give us a nice, 00:00:57.980 --> 00:01:01.940 juicy hash to pass. So I will start out with pressing Shift, 00:01:02.280 --> 00:01:06.950 Run as a different user, and log in as the Globomantics administrator. 00:01:09.800 --> 00:01:13.230 Now obviously you're probably not going to have this occur very often, 00:01:13.240 --> 00:01:16.550 but for the sake of this demonstration, and to keep things clear, 00:01:16.550 --> 00:01:17.650 this does make it easier. 00:01:17.950 --> 00:01:22.950 This creates an active session for the administrator of the Globomantics domain. 00:01:25.840 --> 00:01:27.390 So we're going to minimize this, 00:01:28.040 --> 00:01:32.210 and we're going to open up another command prompt as Olaf and 00:01:32.210 --> 00:01:36.910 demonstrate that he is not currently able to enter a PSSession on 00:01:36.910 --> 00:01:38.950 DC01, which is our domain controller. 00:01:39.740 --> 00:01:39.920 Okay, 00:01:39.920 --> 00:01:43.470 so we did powershell ‑ep bypass for execution policy 00:01:43.470 --> 00:01:47.740 bypass, and now we're going to simply Enter‑PSSession, 00:01:47.740 --> 00:01:54.750 auto complete that, ComputerName, and then DC01, which is our domain controller. 00:01:55.140 --> 00:02:00.020 As expected, this has failed, so let's open up Mimikatz after minimizing this 00:02:00.020 --> 00:02:04.930 window. So we're going to open up Mimikatz as administrator, and we'll maximize 00:02:04.930 --> 00:02:08.660 this. And many of the commands in Mimikatz do require you to have debug 00:02:08.660 --> 00:02:12.480 privileges, so it's always good practice to go ahead and start out with 00:02:12.480 --> 00:02:17.130 privilege::debug to verify that you get a 20 OK. Let's take a look at who the 00:02:17.130 --> 00:02:23.440 user is with token::whoami. We can see here that we're running as olaf.jackson, 00:02:23.530 --> 00:02:24.700 Globomantics domain. 00:02:24.920 --> 00:02:25.120 Now, 00:02:25.120 --> 00:02:28.540 the next commands we're going to have, there's a lot of outputs, so 00:02:28.540 --> 00:02:34.250 we're going to go ahead and select log and then mimilog.txt, which 00:02:34.250 --> 00:02:38.230 will place a log of all of the output into the folder that we're 00:02:38.230 --> 00:02:42.150 currently in, and we're going to get to business and go ahead and pull 00:02:42.970 --> 00:02:44.570 the hashes out of memory. 00:02:44.580 --> 00:02:51.320 We can do that with sekurlsa, secure lsa, logonpasswords. 00:02:51.490 --> 00:02:53.050 As you can see, there's quite a bit here. 00:02:53.540 --> 00:02:55.850 And then if I minimize this here, 00:02:57.340 --> 00:03:02.640 we can look at our mimilog and we have the administrator for 00:03:02.640 --> 00:03:06.370 the Globomantics domain, and here is their hash. And this is 00:03:06.370 --> 00:03:07.550 really what we're after here. 00:03:09.540 --> 00:03:14.470 All right, so now we're going to use sekurlsa, pass the hash, 00:03:14.480 --> 00:03:25.750 pth /user:administrator /domain:globomantics.lab1, and ntlm 00:03:26.540 --> 00:03:28.650 where we paste our administrator hash. 00:03:29.040 --> 00:03:33.640 There we go. And it opens us up a new command shell, and let's try that 00:03:33.640 --> 00:03:36.550 command that we used earlier to see if we made any progress. 00:03:37.040 --> 00:03:43.250 So first, let's look at who we are, and I'm still being listed as Olaf Jackson. 00:03:44.540 --> 00:03:48.750 We'll go back in to PowerShell again, Enter‑PSSession 00:03:49.840 --> 00:03:54.350 ‑ComputerName dc01 again, and it let us right in. 00:03:54.740 --> 00:03:58.310 So, let's do a couple of commands here, globomantics\administrator, 00:03:58.310 --> 00:04:03.150 hostname DC01, and we'll go ahead and exit out of here. 00:04:04.240 --> 00:04:06.650 Now what about something that might be a little bit more useful? 00:04:06.950 --> 00:04:09.560 I mean, we've got a domain administrator account right now, 00:04:09.790 --> 00:04:13.950 and we've got a user on this system that is just a 00:04:14.340 --> 00:04:16.720 standard user with local admin rights. 00:04:17.140 --> 00:04:23.480 So, let's create a new account. We'll do net user evil.hacker and a 00:04:23.480 --> 00:04:31.830 password that meets the password complexity requirements, /ADD and 00:04:31.830 --> 00:04:35.920 /DOMAIN, then we're going to have to maximize this screen to make 00:04:35.920 --> 00:04:37.410 it a little easier to read. 00:04:37.630 --> 00:04:44.050 And this time we'll do net group and we'll select Domain Admins evil.hacker 00:04:44.840 --> 00:04:49.750 /ADD /DOMAIN, and the command completed successfully. 00:04:50.140 --> 00:04:53.440 And this time we're going to actually go to the command prompt and we're 00:04:53.440 --> 00:04:56.150 going to run as a different user by pressing Shift. 00:04:56.640 --> 00:05:00.520 We're going to run this as evil.hacker with our password that we just 00:05:00.520 --> 00:05:06.470 created, whoami, and let's take a look at the groups here. And there we 00:05:06.470 --> 00:05:09.150 have it, everything is working as it should be. 00:05:09.540 --> 00:05:12.110 This is an account that was created on the domain. 00:05:12.250 --> 00:05:15.010 It is part of the domain admins, and now I can use it for 00:05:15.010 --> 00:05:18.570 pretty much anything I needed to as long as a domain admin 00:05:18.580 --> 00:05:19.850 has the rights to log on.