Cached AD Credentials
Let’s try to use Mimikatz to extract domain hashes
on our Windows 11 system.
Since the jeff domain user is a local administrator on CLIENT75,
we are able to launch a PowerShell prompt with elevated privileges.
We’ve connected to this machine as jeff
and with his password over RDP
and started PowerShell as Administrator.
From this command prompt, we can start Mimikatz,
and enter privilege debug to engage the SeDebugPrivlege privilege,
which will allow us to interact with a process owned by another account.
Now we can run sekurlsa logonpasswords
to dump the credentials of all logged-on users with the Sekurlsa module.
This should dump hashes for all users logged on to the current workstation
or server,
including remote logins
like Remote Desktop sessions.
The output shows all credential information
stored in LSASS for the domain users.
We can observe two types of hashes for dave,
and jeff.
This will vary based on the functional level of the AD implementation.
For AD instances at a functional level of Windows 2003,
NTLM is the only available hashing algorithm.
For instances running Windows Server 2008 or later,
both NTLM and SHA-1
(a common companion for AES encryption) may be available.
On older operating systems like Windows 7,
or operating systems that have it manually set,
WDigest will be enabled.
When WDigest is enabled,
running Mimikatz will reveal cleartext passwords alongside the password hashes.
Armed with these hashes,
we could attempt to crack them and obtain the cleartext password
as we did in Password Attacks.
A different approach and use of Mimikatz
is to exploit Kerberos authentication by abusing TGT and service tickets.
As already discussed,
we know that Kerberos TGT and service tickets
for users currently logged on to the local machine
are stored for further use.
These tickets are also stored in LSASS,
and we can use Mimikatz to interact with and retrieve our own tickets
as well as the tickets of other local users.
Let’s open a second PowerShell window,
and list the contents of the SMB share on WEB04.
This will create and cache a service ticket.
Once we’ve executed the directory listing on the SMB share,
we can use Mimikatz to show the tickets that are stored in memory.
And by running sekurlsa::tickets.
The output shows both a TGS,
and a TGT.
Stealing a TGS
would allow us to access only particular resources associated with those tickets.
Alternatively, armed with a TGT,
we could request a TGS
for specific resources we want to target within the domain.
We will discuss how to leverage stolen or forged tickets
later on in this and the next Module.
Mimikatz can also export tickets to the hard drive
and import tickets into LSASS, which we will explore later.
As we’ve now covered in this section and in Password Attacks,
Mimikatz can extract information
related to authentication performed through most protocols and mechanisms,
making this tool a real Swiss Army knife for cached credentials!