search

kiwi-fruitMimikatz

Benjamin Delpy originally created Mimikatz as a proof of concept to show Microsoft that its authentication protocols were vulnerable to an attack. Instead, he inadvertently created one of the most widely used and downloaded threat actor tools of the past 20 years.

Dubbed “one of the world's most powerful password stealers” by Wired.comarrow-up-right, any IT professional tasked with protecting Windows networks needs to pay close attention to the latest Mimikatz developments to understand how hackers will manipulate the tool to infiltrate networks.

It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets

Download mimikatzarrow-up-right

hashtag
Dump Hashes w/ mimikatz

First run privilege::debug to ensure we are running mimikatz as an administrator

controller\administrator@DOMAIN-CONTROLL C:\Users\Administrator\Downloads>.\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #18362 May  2 2020 16:23:51
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

**mimikatz # privilege::debug
Privilege '20' OK**

mimikatz #

20 means that we are running mimikatz as an administrator. If you don't run mimikatz as an administrator, mimikatz will not run properly.

Next we can dump NTLM hashes with lsadump::lsa /patch

⚠️ Starting with Windows 8.1 and Windows Server 2012 R2, the LM hash and “clear-text” password are no longer in memory.

hashtag
Clearing event log w/mimikatz

event::clear clears a specified event log.

  • Mimikatz clears de Security log as default

We can use /log: to specify a specific log to clear:

hashtag
Golden tickets w/mimikatz

A Golden Ticket is a TGT using the KRBTGT NTLM password hash to encrypt and sign. A Golden Ticket (GT) can be created to impersonate any user (real or imagined) in the domain as a member of any group in the domain (providing a virtually unlimited amount of rights) to any and every resource in the domain.

  1. Dump the krbtgt Hash

This dumps the hash and security identifier of the Kerberos Ticket Granting Ticket account allowing you to create a golden ticket

Take note of what is outlined in red you'll need it to create the golden ticket

  1. The SID

  2. The user

  3. The NTL Hash

hashtag
Create the golden ticket

Example:

hashtag
Use the Golden Ticket to access other machine

open a new command prompt with elevated privileges to all machines:

Access other Machines! - You will now have another command prompt with access to all other machines on the network

hashtag
Cross domain forged golden trust tickets

From a child domain you can get a golden ticket for the parent domain if the child domain is trusted by the parent.

hashtag
Enumerating

Need PowerView.ps1 for this:

hashtag
Create cross-trust golden ticket

For creating a cross-trust golden ticket we'll need:

  • NT hash of krbtgt from child domain

  • Domain sid of child domain

  • Domain sid of parent domain

  • SPN child domain

  • SPN parent domain

Get sid of child domain and parent domain using mimikatz:

To get NT hash of krbtgt we can dump SAM and SYSTEM and use mimikatz:

Next, we use mimikatz with lsadump:

We can use mimikatz to create a golden ticket and store it in memory:

hashtag
With impacket

Now that we have the NT hash of krbtgt, we can create the ticket using impacket-ticketer:

And export it in cache:

Next use impacket-getST to get the ticket for the parent domain:

Now export this ticket in cache and use with impacket-secretsdump for example:

hashtag
DCSync attack

We can also use mimikatz to do a dcsync attack:

hashtag
Protection against mimikatz

Windows Server 2012 R2 and Windows 8.1 includes a new feature called LSA Protection which involves enabling LSASS as a protected process on Windows Server 2012 R2arrow-up-right (Mimikatz can bypass with a driver, but that should make some noise in the event logs):

The LSA, which includes the Local Security Authority Server Service (LSASS) process, validates users for local and remote sign-ins and enforces local security policies. The Windows 8.1 operating system provides additional protection for the LSA to prevent reading memory and code injection by non-protected processes. This provides added security for the credentials that the LSA stores and manages.

Enabling LSA protection:

  1. Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa and Set the value of the registry key to: “RunAsPPL”=dword:00000001.

  2. Create a new GPO and browse to Computer Configuration, Preferences, Windows Settings. Right-click Registry, point to New, and then click Registry Item. The New Registry Properties dialog box appears. In the Hive list, click HKEY_LOCAL_MACHINE. In the Key Path list, browse to SYSTEM\CurrentControlSet\Control\Lsa. In the Value name box, type RunAsPPL. In the Value type box, click the REG_DWORD. In the Value data box, type 00000001.Click OK.

LSA Protection prevents non-protected processes from interacting with LSASS. Mimikatz can still bypass this with a driver (“!+”).

https://www.youtube.com/watch?v=RGQuXAABBooarrow-up-right

Now when we add these policies, we can see the results with mimikatz:

PreviousToolsNextNetExec

Last updated