WEBVTT

00:00:02.340 --> 00:00:06.950
In this demonstration, we will use Mimikatz for a pass‑the‑ticket attack.

00:00:07.540 --> 00:00:08.250
Basically,

00:00:08.260 --> 00:00:13.530
you're extracting a Kerberos ticket granting ticket from LSASS with Mimikatz,

00:00:13.850 --> 00:00:17.570
and then using that to access other systems on the network.

00:00:17.650 --> 00:00:20.950
This will then allow you to impersonate users on your domain.

00:00:21.340 --> 00:00:22.110
Keep in mind,

00:00:22.160 --> 00:00:24.760
the attack does require that you have local administrator

00:00:24.760 --> 00:00:27.920
privileges on the system that you are attacking from.

00:00:27.920 --> 00:00:30.220
For this pass‑the‑ticket demonstration,

00:00:30.220 --> 00:00:33.800
we're going to start out logged in as Olaf Jackson on a

00:00:33.800 --> 00:00:36.230
Windows 10 machine that has been fully patched,

00:00:36.230 --> 00:00:41.040
and I will give us something to look for here by running

00:00:41.040 --> 00:00:43.870
this as domain administrator again.

00:00:43.870 --> 00:00:47.090
So we're just trying to establish an active session.

00:00:47.090 --> 00:00:51.340
This could have been through RDP or various other ways that someone

00:00:51.340 --> 00:00:54.220
could have gotten their credentials into your memory of your system

00:00:54.220 --> 00:00:56.250
that you're a local administrator for.

00:00:56.740 --> 00:01:00.140
Then I will minimize this, start this as administrator,

00:01:00.140 --> 00:01:06.840
and then so let's go ahead and change directory here to mimikatz.

00:01:06.840 --> 00:01:11.160
I need to be in the x64 directory, and then run Mimikatz.

00:01:11.320 --> 00:01:11.830
As usual,

00:01:11.830 --> 00:01:15.550
we're going to do our privilege::debug and get our 20 OK. Now what

00:01:15.550 --> 00:01:20.150
we need to run is the sekurlsa::tickets /export.

00:01:25.840 --> 00:01:29.710
And as you can see, there are a lot of different tickets that were collected.

00:01:30.000 --> 00:01:32.590
It probably would be easiest just to look at the folder, so we'll take a

00:01:32.590 --> 00:01:39.640
look at mimikatz_trunk here in the x64, and we've got quite a few tickets

00:01:39.640 --> 00:01:43.900
here. And I could have just changed directories in Mimikatz, but I'm

00:01:43.900 --> 00:01:49.450
going to take these and copy them, minimize this, and just paste this in here.

00:01:50.940 --> 00:01:54.550
And the ticket that we're interested in is this one right here.

00:01:54.940 --> 00:01:56.500
So let's go ahead and copy this.

00:01:58.540 --> 00:01:59.850
We're going to need that.

00:02:00.540 --> 00:02:07.330
We'll go back into Mimikatz. So let's go ahead and exit out of Mimikatz for

00:02:07.330 --> 00:02:14.450
just a moment and go back into PowerShell, and then we're going to try

00:02:15.140 --> 00:02:19.150
Enter‑PSSession for DC01 to see what the result is,

00:02:20.590 --> 00:02:23.150
and as expected, our access was denied.

00:02:24.440 --> 00:02:28.910
So let's go back into Mimikatz and actually make sure

00:02:28.910 --> 00:02:30.850
that we go into Mimikatz itself.

00:02:31.540 --> 00:02:32.100
There we go.

00:02:33.440 --> 00:02:36.930
We'll clear the screen and make sure that we have the right

00:02:36.930 --> 00:02:42.940
permissions, and then simply kerberos, pass the ticket, and then the

00:02:42.940 --> 00:02:52.650
full path of where our ticket is. There we go.

00:02:53.440 --> 00:02:58.180
So we've got the full path of where this ticket is. And we'll

00:02:58.180 --> 00:03:04.740
exit, take a look at klist. We can see that we've got the

00:03:04.740 --> 00:03:07.640
Administrator@GLOBOMANTICS.LAB1 ticket.

00:03:07.860 --> 00:03:12.200
Let's go back into Enter‑PSSession again, ‑ComputerName

00:03:12.200 --> 00:03:15.810
dc01, and this time we were successful.

00:03:16.840 --> 00:03:17.540
And there we go.

00:03:17.550 --> 00:03:24.860
We can see the whoami/all, that we are part of the Domain Admins

00:03:24.860 --> 00:03:31.010
and we have lots and lots of privileges. We are remoted into DC01

00:03:31.020 --> 00:03:32.650
and we're going to close this out now.