Now to perform this attack with token impersonation we're first gonna have to use Metis flight.
Let's go ahead and just type in MSF console.
We're gonna load this guy up and then we're going to go ahead and search for P.S. exact.
We're gonna get a shell on the Frank Cassell machine or the Punisher machine.
So I'm just gonna say use exploit windows SMB is exact because I haven't memorized here and we're gonna
say options and then we're gonna set our our hosts which should be the Punisher machine minds.
Fifty seven one forty one.
We're gonna set the SMB domain which is going to be Marvel local set S&P pass as password one set SNB
user as f Castle and let's go ahead and show targets once you have that all set up those a show targets
and I'm going to do a native upload so we'll set target of 2 I'm going to type options here and I'll
stall verbally just for a second so you can catch up if you need to but we're just making sure that
everything is checked with our boxes we've got be right our host we've got the right domain password
user native upload last thing we're gonna want to set the payload here because it's going to try to
attack with a X 86 payloads we're gonna go ahead and say Windows X 64 and we'll say interpreter reverse
DCP options set the L host here to eat zero and now we have options one more time it should look good
we've got 1 2 1 6 8 fifty seven one thirty nine is the host that is us well OK let's try to run this
and boom interpreter session right off the bat that's I love to see OK so now we have interpreter session
we can do all the fun stuff elsewhere do you know Valerie we can do a hash jump we could say get you
IP we can make sure we're system could say sis info get the system info we're on the right machine right
architecture right everything this is great.
Now there are a few things that we can do in here.
One is we can go ahead and we can load a tool and if you load in double tab there's a few different
things that we can use in here.
Now we can load the tool that we're going to use which is incognito we can also use Kiwi which is a
tool similar to many cats which is made for dumping passwords I'm going to talk about many cats here
very very soon we can also load power shall I love this feature because sometimes if we get into a shell
and we try to load power shell like if we go into a shell we say power shell whatever execution policy
bypass and try to run that it doesn't always run this one's nice and neat for us it's not always like
that so we're gonna go ahead and cancel this or exit out of this channel but we can load power shell
into this and inject power shell as well.
So these different features here are really nice but for this one I'm gonna go ahead and load the incognito
feature and if we type help the last thing that we loaded is always at the bottom so if you ever want
to see that down here incognito commands now I've had incognito come up on interviews before so this
is a special one to note and just to understand what token impersonation is and why it's important so
we have the ability here to impersonate a token once we have a token impersonated we can try to add
add a user add group add local groups we can do all kinds of fun stuff for this example we're just gonna
go ahead and just try to impersonate a user OK and I'm going to go ahead and just list the tokens and
I'm going to do a dash you.
You could do it by Dash you or dash G for groups.
I always like to do it for Dash.
You and you can see sitting on this machine here is Marvel administrator so if we want to impersonate
this person all we have to say is impersonate token and then we're gonna go ahead and just say Marvel
administrator.
Just like that.
You want to backslash is because of character escaping.
Now we've impersonated this user.
Go ahead and take Shel.
Who am I.
And you see now we are moral administrator so one thing to know it's control see exit out of this.
We can go ahead and say it like you want to run hashed out.
Now it's going to have issues and say access is denied because we're not actually running as the system
of the machine.
So if you're ever in this situation all you have to do is type read to self so you can revert to your
old self who you came in as and then now you can run hash dump again and it'll work.
So let's do one more proof of concept here.
You saw the theme in the shooter was available for you it might have been your other user right.
It's whoever is logged in currently I didn't instruct you with who to log in as so on my Windows 10
machine right now I've got the Marvel administrator logged in.
Let's go ahead and just sign in with F. Castle and let's just put in password 1 Get Frank all logged
in here and get your other user logged in whoever it is.
If you had somebody who impersonated.
Go ahead and impersonate a different user here.
So now we can come into this again and we can say list tokens stash you for user and guess you just
showed up.
Frank Castle why.
This is a delegate token remember delegate tokens are on log in or RTP sessions.
So we had a log in on this computer.
Now we've got this token this token exists until the computer is rebooted.
We can impersonate this user in till the computer is rebooted so we can go ahead and say impersonate
token and say Marvel EFF castle like this should work.
Go ahead and say Shel.
Who am I.
Guess what.
Now we're afraid castle.
This one is so cool.
I will love this attack.
So that's it.
I just want you to get the feel for what you're capable of doing.
We just took a user that was just happened to have left a token behind and this happens a lot.
Think of an account where a server that you might log into or get access to.
And there is a domain admin who logged into that computer and servers don't get rebooted that much.
So if there's a domain Advent on that computer and they don't reboot very often that tokens sitting
there until they reboot.
So it's just moving laterally machine to machine.
And so you find that way to escalate and this is a potential way to escalate.
So that's it.
We're going to move on to talk about the mitigation strategies for this and then we can talk about Kirby
roasting which is one of my favorite attacks.
So I'll go ahead and catch in the next video.