[MUSIC PLAYING]
Dumping hashes with Mimikatz.
Now that we've taken a look at how
we can find an administrative password by searching
through various configuration files, more
specifically the unattended installation
or set up utilities configuration files,
let's begin the actual hash dumping process.
And of course, the tool that we're
going to be utilizing in order to do this is Mimikatz.
So Mimikatz is pretty much the de facto standard
when it comes down to post-exploitation on a Windows
system, more specifically, password extraction or hash
extraction from memory.
All right, before we actually get
started with taking a look at how to use Mimikatz,
let's get an understanding of what it is and how it works.
All right, so Mimikatz is a Windows post-exploitation tool
that was written by Benjamin Delpy,
and it allows for the extraction of clear-text passwords,
hashes, and Kerberos tickets from memory.
Now we already have gone through the SAM database,
but I'll just go through it again.
So the SAM database or the Security Account Manager
database is a database file on Windows systems
that stores hashed user passwords.
And Mimikatz that can be used to extract
hashes from the LSASS process memory
where the hashes are actually cached.
So again, if you've opened up your Task Manager on a Windows
system and take a look at these services or processes tab,
you may have noticed that you have
a process called lsass.exe.
So LSA stands for the Local Security Authority,
and LSASS stands for the Local Security Authority Subsystem.
And this process is responsible for authenticating users,
and part of that process involves interacting
with the SAM database.
And as a result, the LSASS process will actually
store the actual data that it's retrieving from the SAM
database, so data like the administrator or rather
user hashes.
And it'll store them in its memory, so within RAM.
And what Mimikatz does is it essentially
extracts these hashes from the LSASS process memory
where the hashes are being cached.
So in terms of utilizing Mimikatz.
We can utilize the pre-compiled Mimikatz
executable, which comes pre-packaged with Kali Linux
And parent OS.
Alternatively, if we have access to an meterpreter session
on a Windows target, we can utilize the inbuilt meterpreter
extension called Kiwi.
And the great thing about Kiwi is it essentially
performs or allows you to dump or extract hashes from memory
directly from within memory, so you're not really
uploading the Mimikatz binary or executable onto the target.
Everything is being executed in memory,
so you're really not leaving any artifacts on the system.
However, we will be taking a look at how to use both.
So we'll take a look at how to utilize the Mimikatz
executable as well as the Kiwi module or extension
for meterpreter.
Now, it's very important to note,
as I've mentioned previously, that Mimikatz
will require elevated privileges in order to run correctly.
The reason for that is because the lsass.exe process
is a privileged process, so it runs with system privileges.
And in order to interact with it,
you need to have administrative privileges or system
privileges.
So that is really what is required.
Now, this particular video has a lab environment attached to it.
So we'll actually be taking a look
at how to perform all of these techniques
so how to dump NTLM hashes with Mimikatz
either through the executable or through the meterpreter
extension, which is Kiwi.
So fire up the lab environment, and I'll do that as well.
And I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And you should already have the target IP
address specified for you.
Of course, in your case, it's going to be different.
So the first step will involve essentially
exploiting a vulnerable service running on the target in order
to obtain initial access.
So we'll perform an Nmap scan on the target
to identify the vulnerable service.
However, before I do that, you can
see that this particular lab environment provides you
with the attacker machine, which is your Kali Linux system,
and the target machine right over here,
which is running Windows 10 and is currently
running a service on port 80 called BadBlue.
So we'll just perform the Nmap scan anyway, even though that's
the service will be exploiting.
So I'll say Nmap, and I'll just paste in the target IP
right over there.
And of course, we can perform some service version detection
if we want to to get a more specific or exact information
regarding the version of the service that's running.
So I'll hit Enter.
And I'll give that a couple of seconds to a couple of minutes
to complete.
All right, so we can see that on port 80,
we have BadBlue running.
And that is version 2.7.
Now luckily for us, the Metasploit framework
has an exploit module that can be
used to exploit this specific version of BadBlue
and consequently provide us with a meterpreter session.
So we will start up MSF console.
I'm just going to start up the PostgreSQL database as well.
So service postgresql start and MSF console.
We'll give that a couple of seconds.
And we can immediately then search for the exploit module.
There really are only two exploit modules
for the BadBlue service.
So there we are.
And I'll say search BadBlue.
And we will be utilizing the first exploit module.
So this is exploit zero and exploit one.
So this is the BadBlue pass through overflow
or rather the pass through exploit modules.
So this works on BadBlue version 2.7.
And in this case, this will work.
So I will copy it.
So I can say use one.
That will specify that particular exploit module.
And then, the default payload is set to the 32-bit meterpreter
payload, which is perfectly fine in this case.
If I show the options for this module,
the only option that we need to configure is the target IP.
So I'll say set our hosts, and I'll paste in the target IP.
You can then configure your payload options.
This is for your meterpreter session
so you can set up your Kali Linux IP, which in this case,
it is already configured for me, and the default Lport
is 4444, which I'll leave it as it is.
So I'll say exploit, and we'll give this a couple of seconds.
There we are.
It sends the stage, and we get a meterpreter session
on the target system.
All right, so let me clear out my terminal.
So let's learn more about our system.
We type in sysinfo.
We can see it's running Windows 2016.
Oh, interesting.
So I actually did not realize that.
It's running Windows Server 2016, build 17763,
and we currently have a 32-bit interpreter payload
on a 64-bit operating system.
So we say get user ID.
You can see we currently have access
as the administrator user.
However, what I would like to do is
I would like to migrate to the lsass.exe process.
So I can use the pgrep option and say pgrep LSASS,
and that'll find the process ID for the LSASS service.
So it's provided us with that.
And of course, in your case, it's going to be different.
So I'll say migrate to 788.
And because we have administrative privileges,
we can migrate to any process, so I'll hit Enter.
There we are.
And if I now type in get user ID,
we should have NT authority system
privileges which are the highest privileges on a Windows system.
All right, fantastic.
So let's start off first and foremost
with the Kiwi module, which is an inbuilt meterpreter
extension.
So in order to load it, we simply need to type
in load and then kiwi.
Hit Enter.
It's going to say loading the extension Kiwi as you can see,
Mimikatz version 2.2.0 on 64-bit version of Windows.
And, of course, it was developed by Benjamin Delpy.
The only reason I'm mentioning that
is because it's a fantastic tool.
So now that it's loaded, if we open up
the Help menu for the meterpreter,
you can see at the bottom we now have the kiwi commands.
So we can use the credentials all command to retrieve
all credentials, or we can specifically
target the actual SAM database.
So we can use the LSA or the local security authority
and, more specifically, the LSASS process
to dump the contents of the SAM database
or rather the cached contents of the SAM database.
So, for example, I can say creds_all,
and that will dump all credentials.
And in this case, you can see we get the NTLM
hash of the administrator user.
And in terms of WDigest credentials and Kerberos
credentials, you can see that no clear-text passwords
are specified.
Now the reason that is the case is
because Windows versions, probably later than Windows
8.1, do not store clear text passwords at all.
So you'll pretty much be running into this quite a bit,
but we were still able to obtain the NTLM hashes.
So we can also say LSA dump SAM and hit Enter,
and that is going to dump all the NTLM
hashes for all the user accounts on the system.
And if you take a closer look, if you remember,
in my first video within this section,
I mentioned that the same database
is encrypted with a syskey.
And Mimikatz or kiwi, in this case,
actually provides us with the syskey, which
can be very useful later on.
We also get the SAM key here.
And you can see for every user, we get the NTLM hash, so
the administrator user.
We also have the user account student here,
and we get the NTLM hash for the user account student.
So we can also dump the LSA secret.
So I can say LSA dump secrets and hit Enter.
And in certain situations, dumping the LSA secrets
could provide you with some clear text
credentials in some cases.
So you can see in this case, it really
doesn't provide us with much.
And, of course, I'm not going to dive deeper into LSA secrets.
If I clear up my terminal and I open up the Help menu,
you can take a look at the additional Kiwi commands
that you can run.
So you can also dump the WDigest credentials,
which we did because we run the credentials all command.
And then, of course, if you're working within an Active
Directory environment, you can also essentially
work with golden tickets or create a golden ticket, Golden
Kerberos ticket for that matter, and then, of course,
you can list the Kerberos ticket list
or list all Kerberos tickets.
And in terms of what we are doing,
another great tool or command that you can run
is password change.
So you can change the password or hash of a user.
Now, as I said, during a penetration test,
I would not recommend doing that because you're obviously
changing an account password that is being used
in a production environment.
So do you refrain from running that if you do not need to.
Now, as I said, you might be thinking to yourself, well,
why are hashes so important?
I know we can crack them, but cracking in and of itself
is a very difficult process.
And based on the password strength
or the strength of the password, it
can take hours to days or weeks.
And in certain cases, you might not
be able to crack the hashes at all.
So you might be asking yourself, well,
what can we do with hashes?
And that's something that we'll be exploring in the next video.
So I just wanted to highlight this
before we actually continue.
So that's using the Kiwi module.
Now, of course, it's better to learn
how to use Mimikatz by utilizing the actual executable.
So I'll just clear up my terminal.
And I'm currently working within C Windows System32.
So I'll navigate to the root of the C drive,
and I'll create a new directory called temp.
And of course, that's just a temporary directory.
This is where I recommend that you
store all your working files or exploit code.
So I'll navigate into the temp directory.
And as I said, Kavi Linux already
has the Mimikatz executable available for you,
and it is found under the following directory.
So we can upload it to the target.
I'm going to say Upload, and it's
under user, share, Windows, resources, Mimikatz, x64.
And of course, you can also upload the 32-bit Mimikatz
executable.
And then, of course, many mimikatz.exe.
I'll upload that.
There we are.
That's uploaded successfully.
And I'll open up a shell session or a command shell session.
All right, we'll give that a couple of seconds.
There we are.
And if I list out the contents of this directory,
you can see we have Mimikatz here.
So we can easily execute it by saying mimikatz.exe.
I'll hit Enter.
And as you can see, that provides you
with the Mimikatz terminal or console, if you will.
The first thing I would recommend doing
is to actually check whether you have
the appropriate privileges.
And this can be confirmed by typing in privilege colon colon
debug.
And if it tells you privilege 20 OK,
that means that you have the required privileges in order
to perform hash extraction from memory.
All right, so now that we've done that,
let's take a look at how we can replicate what we just
did with the Kiwi module.
So if we want to dump the contents of the SAM database
or rather dump the actual cache of the LSA or LSASS process,
we can say lsadump colon colon, hit Enter,
and this will provide you with much more information
that Kiwi would.
And again, if we just take a look at the output immediately,
you can see that it provides you with the domain the syskey,
and then, of course, you have your SAM key there.
And then for the administrator, you
have the actual RID, which in this case
is 500, which confirms that this indeed is the administrator
user.
You then have the NTLM hash right over here.
You also have the supplementary credentials, which
will not get into right now.
And of course, if you take a look
at the other users like the student account,
you also have the hashes for that particular user account.
So on and so forth.
But we don't really get anything of importance
in terms of clear-text credentials.
We can also dump LSA secrets by saying lsadump colon colon
secrets.
There we are.
And we get the same output that we
did when we ran the same command or rather
a variant of the same command with Kiwi.
Now one great thing that we can actually
do with the actual Mimikatz executables
to display log-on passwords.
So whenever a user logs on to Windows,
if the system has been configured
to store log-on passwords in memory in clear text rather,
Mimikatz can actually show you those passwords.
So in order to do that, I'll say sekurlsa colon colon--
let me just type that in correctly.
Sekurlsa, and then we can say log-on passwords.
Hit Enter.
And again, in this case, you can see
the system has been configured very well in that it's not
displaying any clear text passwords.
So let's just take a look at the output right
from the beginning.
So these are all the log on passwords.
So we can see that--
let me get started from this particular--
Yeah, that's correct.
So we can head over into a few log-ons here.
So we can see that this is an interactive log on directly
from the window manager.
And you can see that the password is always set to null.
So that means that clear text passwords have
been disabled on this system.
However, if they weren't, we should
have been able to get the clear text passwords.
And we can take a look at the administrator interactive log
on there.
You can see that the password is null again.
However, we get the NTLM hash as we did previously.
And then, of course, the same goes
for the WDigest credentials, so null
and then the Kerberos details right over here, which again
the password told us is null.
So again, I just wanted to highlight that technique
because it can be extremely powerful and useful when
working in a Windows environment.
So that is going to conclude the practical demonstration
side of this video.
All right, so now that we've taken a look at how
we can extract NTLM hashes from memory,
you might be asking yourself, and of course, I
mentioned the same thing within the practical demonstration,
what can we do with these hashes in regards
to further exploiting a system or moving or performing
lateral movement?
Well, the technique that we're going to be focusing on next
is called pass the hash.
And that's what we'll be covering in the next video,
and it will address this question,
and we'll show you why password hashes are almost as valuable
as clear text passwords.
So I'll see you in the next video.