Getting the Hash
To perform the constrained delegation attack,
we'll dump the NTLM hash of the web01 machine account from LSASS.
We have managed to obtain a SYSTEM shell
so this is typically a simple matter of dumping it,
but we have already determined that LSA protection is enabled.
When LSA protection is enabled, the LSASS process is marked as
Protected Process Light,
meaning that we can not inject code or tamper with the process.
This enforcement is performed from the kernel
and to solve this issue,
we’ll leverage the mimidrv.sys driver that accompanies Mimikatz.
While we could use reflective PE injection to load an executable or DLL from memory,
we can’t do this with a kernel driver
since it must be on disk before it is loaded.
In addition, a kernel driver must have a digital signature
and new drivers must be vetted
and cross-signed by Microsoft.
Fortunately, Windows Defender does not flag mimidrv.sys as malicious,
but it does flag Mimikatz.
To solve this, we could load Mimikatz from memory
with the Invoke-Mimikatz PowerShell script,
but due to this technique’s popularity,
this may be flagged even with AMSI disabled.
Although this seems to get complicated quickly, there is a way forward.
The best approach at this point is to use Mimikatz
from memory through Invoke-Mimikatz,
but we will use it as few times as possible.
First, we’ll manually load the driver without Mimikatz,
then run Mimikatz once
to clear the PPL flag,
and finally we’ll run our custom application
to dump the entire LSASS memory.
We can then parse the output on our test machine.
This will only generate a single antivirus alert
but Mimikatz will not be shut down before it has issued the call to remove
LSASS protections.
To proceed, we’ll upload an updated version of mimidrv.sys
that works on Windows 2019
to web01.
To ensure stability of our SYSTEM Meterpreter,
we’ll migrate into the SYSTEM integrity spoolsv process,
and open a command prompt.
Now we can manually load the driver with the Service Control application.
First, we’ll create a service named “mimidrv”,
specify the file path of the driver,
set its type to “kernel”,
and the starting setting to “demand”.
Let’s start our new service.
With the driver running,
we can instruct it to turn off the LSASS PPL protection.
We’ll disable AMSI,
load Invoke-Mimikatz into memory,
and use it to disable PPL.
To invoke the !processprotect command with the desired arguments,
we must use quotes on the command line
for the -Command parameter,
but the command itself must also be in quotes,
which means we must escape the inner quotes
with a back tick character.
When the command is executed,
the driver successfully turns off LSASS protection.
Just after that, Windows Defender detects the execution of Mimikatz
and shuts down the PowerShell process.
While this generates an antivirus alert,
we have managed to turn off the PPL protection
and we can now interact with LSASS.
Instead of using Mimikatz for this,
we could use our custom application that calls the Win32 MiniDumpWriteDump API.
Our code will perform a memory dump of the LSASS process
and write the dump to a file.
To parse the dump file, we can use Invoke-Mimikatz on web01,
but this will again trigger an antivirus alert.
Instead, we are going to download the dump file
and transfer it to the Windows Server 2019 test machine.
Given that the LSASS dump file is almost 46 MB,
the download can take some time through Meterpreter.
Once it’s downloaded, we’ll upload it to the test machine
along with Invoke-Mimikatz.
Next, we’ll run sekurlsa::minidump to specify the dump file,
followed by sekurlsa::logonpasswords
to dump passwords and hashes
for all logged on users.
Finally,
we have captured the NTLM hash for the machine account
of web01.
Nice!
We’re now armed to exploit the configured constrained delegation
to file01.
We’ll explore this in the next section.