Mimikatz
In this section,
we’ll discuss how Mimikatz can be used to extract credentials from memory
due to caching requirements of the Kerberos protocol.
We’ll also discuss Local Security Authority (LSA) protection
and how it can be bypassed.
Due to the automatic renewal of TGTs,
password hashes are cached in the
Local Security Authority Subsystem Service
or (LSASS) memory space.
If we gain access to these hashes, we could crack them
to obtain the clear text password
or reuse them
to perform various actions (which we’ll discuss in a later module).
Since LSASS is part of the operating system and runs as SYSTEM,
we need SYSTEM (or local administrator) permissions
to gain access to the hashes stored on a target.
In addition, the data structures are not publicly documented
and they are encrypted
with an LSASS-stored key.
Mimikatz is a powerful tool that we can extract
and manipulate credentials,
tokens, and privileges in Windows.
In this section, we’ll specifically use it to dump cached domain credentials
and use it for other purposes later in this module.
After launching Mimikatz from an elevated command prompt
on our Windows 10 victim machine,
we’ll have to tamper with the memory of the LSASS process,
which is normally not allowed
since it belongs to the SYSTEM user
and not the current offsec user.
However, as administrator, the offsec user can use
SeDebugPrivilege
to read and modify a process
under the ownership of a different user.
To do this, we’ll use the Mimikatz privilege::debug command
to enable the SeDebugPrivilege
by calling AdjustTokenPrivileges.
Once we have enabled the SeDebugPrivilege privilege,
we’ll dump all cached passwords and hashes from LSASS with sekurlsa::logonpasswords:
The inner workings of the command are quite complex
and beyond the scope of this module
due to the inherent encryption and undocumented structures employed by LSASS,
but the results show the NTLM hash
of the domain offsec user.
Since 2012 when Mimikatz was released and cached credential dumping was popularized,
Microsoft has developed mitigation techniques:
LSA Protection
and Windows Defender Credential Guard
In this module, we will focus on LSA protection.
As previously mentioned, Windows divides its processes into four
distinct integrity levels.
An additional mitigation level,
Protected Processes Light (PPL)
was introduced from Windows 8 onwards,
which can be layered on top of the current integrity level.
In essence, this means that a process running at SYSTEM integrity
cannot access or modify the memory space of a process
executing at SYSTEM integrity with PPL enabled.
To demonstrate this, we’ll log on to the Windows 2019 server appsrv01
as the admin user.
This is done through the RunAsPPL DWORD Value
in HKLM\SYSTEM\CurrentControlSet\Control\Lsa
with the value of 1.
This protection mechanism is disabled by default
due to third-party compatibility issues.
On appsrv01
LSA Protection has already been configured
When LSASS is executing as a Protected Process Light,
Mimikatz fails due to insufficient permissions
The sekurlsa::logonpasswords command returns the access denied error value.
PPL protection is controlled by a bit residing in the EPROCESS kernel object
associated with the target process.
If we could obtain code execution in kernel space,
we could disable the LSA protection
and dump the credentials.
Luckily, this can be achieved with Mimikatz
since it comes bundled with the mimidrv.sys driver.
We must be local administrator or SYSTEM to dump the credentials
which means we will also have the SeLoadDriverPrivilege privilege
and the ability to load any signed drivers.
Mimikatz can load the mimidrv.sys driver with the !+ command:
Once the driver is loaded,
we can use it to disable the PPL protection for LSASS
through the !processprotect command
while supplying the /process: option
to specify the name of the process
and the /remove flag
to disable PPL.
While this technique will disable the LSA Protection
it does require that we upload the mimidrv.sys driver
to the victim machine,
which may trigger antivirus.
Next, we’ll again attempt to dump the cached credentials
According to this output, we have bypassed LSA protection
and have obtained the domain admin’s user NTLM hash.
In the next section, we’ll discuss how to dump LSASS memory
without Mimikatz.