Our next attack type is called token impersonation.
So what are tokens.
Well you could think of tokens basically as cookies for your computer.
There are these temporary keys allow you access to a system or network without actually having to provide
your credentials.
So like a cookie now there are two types.
There's what is called a delegate or an impersonal token.
So for the delegate token that is used when you log into a machine or you have remote desktop for example
or if you have an impersonal token if you're having like a network drive attached or some sort of domain
log on script that's where you would see an impersonate token in this course.
It's much easier to just demonstrate a delegate token because all we have to do is log into a machine
and then that token exists.
So we're going to do that.
So let's take a quick overview before we go into the live demonstration of why this is bad and what
this really is.
So here we have our user and we have we've gotten a shell and we're in a shell in return fritter.
We've loaded a tool here called Incognito which is built into Metis flight and we're just going to list
our tokens of our user here.
Marvel f Castle appears we're on the Frank Cassell machine.
Now we're going to go ahead and try to impersonate that user.
So we're going to say is impersonate token Marvel f Castle kind of like this we'll go into a shell and
guess what.
Or Marvel Frank Castle.
Cool.
So let's go ahead and try to run something.
Do not worry about what this is right now but we're going to use invoke Mimi Katz and this is a power
shell script that is trying to dump hashes.
OK.
We're trying to do an LSA dump here and dump all the hashes off the domain controller and what's going
to happen is it's going to say hey access denied you do not have this kind of access OK.
But what if for some reason the user was a domain admin and that token was available.
Now you can see the domain admin has logged into this machine the tokens now available and we're going
to impersonate this token.
So we're going to say in person a token Marvel administrator we go into a shell and you can see that
Marvel administrator is now available to us we try running this command again.
And guess what.
It succeeds this time allowing us to dump all the hashes in the network including the cover ticket grounding
ticket hash which we haven't covered yet.
We'll get there.
But this is a big win.
So the difference is that if you can navigate to a machine and you find a token of a domain administrator
that you can impersonate you have domain admin.
There are a lot of things that you can do with that domain Alvin.
So you want to bounce around and look for these token impersonation attacks and really see if you can't
find that domain admin on a machine.
So this is when I was talking about in the last video when it came down to moving laterally and there's
always potential difference in a new machine.
So we might go from machine one where we're afraid Castle and there's nothing great we passed that password
pass the hash round we get onto machine to run Spider Man's machine and there is the administrator just
sitting there with a token and then we impersonate that token and then we are now a domain administrator
we can act on their behalf.
So pretty cool feature here.
So let's go ahead and do a live demonstration of this so we can get a hands on and then we'll talk about
mitigation strategies.