Fun with Incognito
In this section, we’ll use the Meterpreter Incognito module
to impersonate any logged in users and obtain code execution
in their context without access to any passwords or hashes.
Although we’ll use Mimikatz to collect Kerberos authentication credentials
later in this module, this access token attack vector does not rely on Mimikatz
and may evade some detection software.
To demonstrate this, we’ll authenticate to “appsrv01” as the admin user
through remote desktop,
and leave the connection open.
We’ll then switch to a SYSTEM integrity Meterpreter shell.
Next, we’ll load the Incognito extension through the load command,
and run help to display available commands.
We’ll focus on list_tokens -u, which will list all currently used tokens
by unique username.
The output reveals a delegation token for the admin domain user.
Next we’ll run impersonate_token to impersonate the admin user
through the ImpersonateLoggedOnUser API.
To invoke it, we must specify the user name of the token we want to impersonate.
The output shows that we were able to impersonate the admin domain user
from a delegation token, which will allow us to perform actions on this server
and authenticate against remote computers in the context of that user.
With this approach, we have impersonated a user within a Meterpreter shell
without writing to disk.