WEBVTT

00:00:00.740 --> 00:00:04.710
In this demonstration, we're going to use Mimikatz to create a silver ticket,

00:00:04.910 --> 00:00:07.850
which is a forged Kerberos service authentication ticket.

00:00:08.940 --> 00:00:13.830
The use of this ticket is not validated by the domain controller and is only

00:00:13.830 --> 00:00:17.250
valid for the service and system that you created it for.

00:00:17.940 --> 00:00:20.850
Unlike many of the other attacks we have demonstrated so far,

00:00:21.280 --> 00:00:24.420
this attack does not require any special privileges.

00:00:25.440 --> 00:00:28.040
There are various attack scenarios in which you

00:00:28.040 --> 00:00:29.550
might want to use silver tickets.

00:00:30.080 --> 00:00:30.650
For instance,

00:00:31.240 --> 00:00:34.150
if you had already performed Kerberoasting and pulled down

00:00:34.170 --> 00:00:36.050
and cracked the password for the service,

00:00:36.540 --> 00:00:38.950
then you could use this to create a forged ticket.

00:00:40.140 --> 00:00:41.980
In this case and demonstration,

00:00:41.980 --> 00:00:45.560
we are going to leverage information obtained during a previous

00:00:45.570 --> 00:00:50.840
demonstration to create a silver ticket using the DC01 system hash.

00:00:51.740 --> 00:00:54.930
That ticket will then be used to access the file share on the

00:00:54.930 --> 00:00:59.490
domain controller. The username and the user ID can absolutely

00:00:59.490 --> 00:01:00.950
be something that you just make up.

00:01:01.340 --> 00:01:04.300
This can then make it more difficult for someone that is trying to track

00:01:04.300 --> 00:01:08.040
you. In this demonstration we're going to create a silver ticket so that we

00:01:08.040 --> 00:01:11.100
can access the domain controller file share.

00:01:11.200 --> 00:01:12.720
So log in as Olaf Jackson,

00:01:12.720 --> 00:01:18.520
who is a local system administrator only. I'm going to run the command prompt,

00:01:18.520 --> 00:01:24.450
not as an administrator, but my user, and I'm going to go ahead and copy the

00:01:25.040 --> 00:01:28.150
domain SID here. Then let's try some out here.

00:01:29.140 --> 00:01:34.380
Pushd, we'll try to access this file share here, and as expected,

00:01:34.380 --> 00:01:35.680
access is denied.

00:01:35.690 --> 00:01:39.890
So let's go to Mimikatz and run Mimikatz directly from here,

00:01:39.940 --> 00:01:41.950
and I'll go ahead and expand the screen here,

00:01:42.060 --> 00:01:44.880
check our privileges, and we did get an error message,

00:01:44.880 --> 00:01:45.930
which was expected.

00:01:46.070 --> 00:01:47.140
So let's try this.

00:01:47.150 --> 00:01:50.510
Kerberos::golden, so just like with the golden ticket that starts out

00:01:50.510 --> 00:01:52.940
at the same when you want to make a silver ticket,

00:01:53.210 --> 00:01:57.590
we need the sid, which I just copied, so I'll paste that here, and I'll need

00:01:57.590 --> 00:02:00.650
an rc4. Let's take a look at where I can get that from.

00:02:01.840 --> 00:02:06.070
So if I look at Mimikatz, I've got one here with DomainHash, and

00:02:06.070 --> 00:02:12.810
this time I'm looking for this machine hash right here for DC01. So

00:02:12.810 --> 00:02:19.520
I'm going to copy that back into my window here, and that will be

00:02:19.520 --> 00:02:25.250
under rc4. We need a user, so we use tigerkingz, and this username

00:02:25.260 --> 00:02:26.050
can be anything.

00:02:26.590 --> 00:02:27.660
And we need an ID,

00:02:27.790 --> 00:02:31.100
which is also something I can just make up. We need a target,

00:02:32.840 --> 00:02:42.340
DC01.GLOBOMANTICS.LAB1. We need a service, which in this case is cifs because

00:02:42.340 --> 00:02:45.600
there are silver tickets that you can make for lots of different services,

00:02:45.700 --> 00:02:47.990
and we'll tell it to go ahead and pass the ticket.

00:02:48.180 --> 00:02:48.680
Let's check.

00:02:48.680 --> 00:02:53.980
We've got kerberos::golden sid, the rc4, the user tigerkingz, the

00:02:53.980 --> 00:02:57.150
ID, the target, and we're missing our domain.

00:02:57.860 --> 00:02:58.220
Here we go.

00:02:58.220 --> 00:03:04.450
Let's give this a try. There we have our tigerkingz@globomantics.lab,

00:03:04.900 --> 00:03:08.750
and this is for the DC01 system, and it is for cifs.

00:03:09.640 --> 00:03:10.850
So let's give it a try.

00:03:12.440 --> 00:03:17.240
And we used pushd to open that up, and this time it actually let us in.

00:03:17.350 --> 00:03:22.800
Take a look at that directory, and that is the DC01, DC01 Globomantics system,

00:03:22.810 --> 00:03:24.160
which is exactly what we wanted.

00:03:24.160 --> 00:03:25.050
So at this point,

00:03:25.050 --> 00:03:29.030
we could upload malware or do pretty much anything we needed

00:03:29.030 --> 00:03:30.870
to that you can do with a file system.

00:03:31.090 --> 00:03:34.540
So let's go ahead and popd, and that'll exit that out,

00:03:34.690 --> 00:03:36.850
and finish up with clearing the screen.