WEBVTT 00:00:01.940 --> 00:00:02.940 In this demonstration, 00:00:02.940 --> 00:00:07.050 we're going to take a look at creating a golden ticket with Mimikatz. 00:00:07.540 --> 00:00:10.460 Please note that this attack does require that you have domain 00:00:10.460 --> 00:00:14.180 administrator privileges because you're going to need to get the hash 00:00:14.180 --> 00:00:18.050 for the KRBTGT account for this attack to work. 00:00:18.540 --> 00:00:21.150 This can be quite difficult for a variety of reasons. 00:00:21.840 --> 00:00:25.480 The tickets that are created can last an extremely long time and 00:00:25.480 --> 00:00:28.370 will continue to work until the password for this account has been 00:00:28.370 --> 00:00:32.880 changed two times. The usernames and the RIDs can be set to 00:00:32.890 --> 00:00:34.200 anything you want them to be. 00:00:34.940 --> 00:00:38.830 Some attackers have found very clever ways to hide their activities or to 00:00:38.830 --> 00:00:41.300 make it very hard for the blue teams to track them down. 00:00:41.740 --> 00:00:44.550 Basically, once an attacker has a golden ticket, 00:00:44.940 --> 00:00:47.350 they can impersonate anyone on your domain. 00:00:47.940 --> 00:00:51.910 Only use this attack with very specific permissions that have been 00:00:51.910 --> 00:00:54.750 provided by someone that has the authority to do so. 00:00:55.340 --> 00:00:58.490 This is an attack that when executed successfully gives you 00:00:58.490 --> 00:01:01.650 somewhat permanent access to the entire domain, 00:01:02.140 --> 00:01:05.510 and it is difficult to change the passwords for everyone and 00:01:05.519 --> 00:01:09.950 then change the password for the KRBTGT account, not only once, 00:01:10.150 --> 00:01:13.120 but twice. For this demonstration, 00:01:13.120 --> 00:01:18.610 we're going to assume that you've already collected the ntds.dit. 00:01:18.800 --> 00:01:23.550 That's the New Technology Directory Services directory information tree, 00:01:24.190 --> 00:01:26.650 which stores all of your credentials for AD. 00:01:27.240 --> 00:01:30.580 Now this file can be pretty large when you get it. It's also difficult to 00:01:30.580 --> 00:01:32.960 get. You have to get it from the domain controller, 00:01:33.170 --> 00:01:35.020 but there are various ways to do this. 00:01:35.020 --> 00:01:35.610 Also, 00:01:35.610 --> 00:01:39.570 there's a tool that you can use in Mimikatz to get it as well with 00:01:39.570 --> 00:01:43.290 DCSync. So, to get this demonstration going, 00:01:43.580 --> 00:01:46.550 let's go ahead and open up cmd as administrator. 00:01:49.540 --> 00:01:50.390 Okay, there we go. 00:01:51.140 --> 00:01:55.260 Now we're going to leverage a packet in order to dump the secrets 00:01:55.270 --> 00:02:00.180 out of the ntds.dit file that I have. So, first we've got to go to 00:02:00.180 --> 00:02:04.500 that directory, and this is just a basic install of impacket, and 00:02:04.500 --> 00:02:06.010 I'm just using the examples. 00:02:06.020 --> 00:02:07.320 It's a very powerful tool. 00:02:07.370 --> 00:02:11.050 There's a lot to it, definitely way more than we're going to cover here. 00:02:11.039 --> 00:02:15.640 We're just using the one function that it has, this secretsdump.py. Okay, 00:02:15.640 --> 00:02:20.280 so secretsdump.py, and we need to tell it where our ntds file is. 00:02:20.280 --> 00:02:28.150 In this case I've got it on c:\ntds‑dump\Active Directory\ntds.dit. 00:02:29.290 --> 00:02:33.560 And then we need to give it our system file that we pulled from the 00:02:33.560 --> 00:02:36.350 domain controller as well, and it's named SYSTEM. 00:02:37.440 --> 00:02:44.690 We're going to put the results into an outputfile, and then end it with LOCAL. 00:02:46.840 --> 00:02:48.050 Let that run for a second. 00:02:48.840 --> 00:02:51.850 Okay, so now it's done that. We can close this window out. 00:02:52.240 --> 00:02:58.780 And if you want to take a look here, we have DomainHash.txt, and the 00:02:58.780 --> 00:03:03.680 one we're looking for right now is this KRBTGT. 00:03:04.880 --> 00:03:07.050 And we need this piece right here. 00:03:08.040 --> 00:03:10.950 We'll copy this for later, and we can just minimize this. 00:03:12.380 --> 00:03:13.590 And we'll get rid of these. 00:03:13.600 --> 00:03:14.850 We don't need these anymore. 00:03:16.940 --> 00:03:18.700 And run Mimikatz as administrator. 00:03:19.540 --> 00:03:22.150 We need our privilege::debug. 00:03:22.160 --> 00:03:25.250 We're going to choose kerberos::list. 00:03:27.740 --> 00:03:32.350 We'll go ahead and clear this part out with purge, we'll list again, 00:03:33.140 --> 00:03:34.440 and it's nice and clean. 00:03:34.790 --> 00:03:38.270 Clear the screen, and we'll get started with creating our golden ticket. 00:03:38.460 --> 00:03:44.150 Let's go ahead and start with kerberos::golden, we need a user, so 00:03:44.840 --> 00:03:49.250 we'll name him evilUser, and this can be pretty much anybody you want 00:03:49.250 --> 00:03:51.240 or anything that you want to place there. 00:03:51.370 --> 00:03:52.800 And you'll want to select an ID, 00:03:52.980 --> 00:03:55.810 which is also something that you can just make up. 00:03:56.050 --> 00:03:57.100 I'll just use 500. 00:03:57.540 --> 00:03:59.580 And then the sid, actually, 00:03:59.580 --> 00:04:03.450 we're going to start with the rc4 for that hash that we copied. 00:04:03.580 --> 00:04:07.550 I'll copy that in there, and then I'll use sid, which is the domain SID. 00:04:08.540 --> 00:04:13.210 I'm going to minimize this, open up a window, and it's just 00:04:13.210 --> 00:04:15.640 this part right here, so don't copy the rid, 00:04:15.650 --> 00:04:19.589 which is the last part, just that part, and then maximize this again. 00:04:19.640 --> 00:04:20.230 Here we go. 00:04:20.240 --> 00:04:21.610 And last but not least, 00:04:21.779 --> 00:04:24.950 we'll tell it to go ahead and pass the ticket, and I forgot my 00:04:24.950 --> 00:04:28.070 domain, so let's go ahead and correct that. In this case it's 00:04:28.070 --> 00:04:31.590 domain:globomantics.lab1, and there we go. 00:04:31.590 --> 00:04:32.630 That's more like it. 00:04:32.640 --> 00:04:35.180 So now let's take a look at kerberos::list, and 00:04:35.180 --> 00:04:37.140 we've got our golden ticket here. 00:04:37.150 --> 00:04:38.650 We'll take a look at what we can do with this? 00:04:39.040 --> 00:04:44.360 We'll use miscellaneous, misc::cmd, to open up a command window. 00:04:44.550 --> 00:04:45.130 There we go. 00:04:45.220 --> 00:04:49.030 We're still showing as olaf.jackson; however, take a look here. 00:04:49.280 --> 00:04:53.380 We've got evilUser@globomantics.lab, which is what we're looking for. 00:04:53.590 --> 00:05:00.900 So let's go to PsExec, so we use change directory to PSTools, and then PsExec 00:05:00.910 --> 00:05:04.250 to our dc01, and we'll try to open up a command window. 00:05:04.970 --> 00:05:05.510 There we are. 00:05:05.520 --> 00:05:07.330 We are globomantics/evilUser. 00:05:07.390 --> 00:05:09.860 Take a look at our groups, and as expected, 00:05:09.980 --> 00:05:13.900 we've got Domain Admin along with lots and lots of other rights. 00:05:14.090 --> 00:05:15.250 Now last but not least, 00:05:15.260 --> 00:05:19.250 if you're trying to follow along at home and you don't quite know how to get 00:05:19.260 --> 00:05:24.450 ntds.dit, there is a simple way to do it with Mimikatz itself, 00:05:24.540 --> 00:05:28.880 but it does have to be running as a domain administrator. So you can run this. 00:05:28.880 --> 00:05:37.190 In this case I have the domain administrator login. Do the privilege::debug and 00:05:37.190 --> 00:05:44.630 we'll use lsadump::dcsync, and then /user:krbtgt. 00:05:44.810 --> 00:05:46.610 There we go. And if you maximize this, 00:05:47.340 --> 00:05:50.150 you can see that the information that we needed for 00:05:50.150 --> 00:05:52.350 our golden ticket is right here. 00:05:52.940 --> 00:05:55.760 So everything that we needed. As I had mentioned before, this 00:05:55.760 --> 00:05:59.320 works really well in Mimikatz, but you do need to have a domain 00:05:59.320 --> 00:06:01.050 administrator account to run this with.