[ELECTRONIC NOISES]
Dumping hashes with Mimikatz-- in this video,
we will be exploring the process of dumping both NDLM hashes
as well as clear-text passwords with Mimikatz on a Windows
system.
So first and foremost, what is Mimikatz?
Mimikatz is a Windows post-exploitation tool that was
developed by Benjamin Delpy, and it allows for the extraction
of plaintext credentials from memory as well as password
hashes from the local SAM database--
or rather, the SAM databases-- and much more.
Now, what is SAM because we are going to be interacting
with SAM quite a bit here?
So SAM stands for the Security Account Manager.
And the SAM database is essentially
a database file on Windows systems
that stores users' passwords and can
be used to authenticate users both locally and remotely.
So we can either utilize the prebuilt Mimikatz executable
that we can transfer over to the target
and then execute manually.
However, or alternatively, if we have access
to a Meterpreter session on a Windows target,
we can essentially utilize the inbuilt Meterpreter extension
called Kiwi.
So Kiwi is essentially just a Meterpreter extension
that allows us to, again, execute Mimikatz
from within memory as opposed to utilizing the actual Mimikatz
executable.
So Kiwi allows us to dynamically execute Mimikatz
on the target system without touching the disk.
So Kiwi is a fantastic extension.
Similar to Incognito, everything can be done really simply.
And you don't have to go through the process of transferring
over the Mimikatz executable.
And then, of course, that also comes with its own risk,
and the risks associated with transferring
exploit code or executables onto the target system
are that you need to take into consideration things
like antivirus detection.
You may also-- the actual exploit
files may actually be found.
So, again, it's always good to do things
dynamically and in memory.
So let's take a look at how this can be done.
And all you need to do is just fire up your lab environment,
and we can get started.
So I'll see you within the lab environment.
So I'm back within the lab environment,
and we have the target IP already
provided for us, which is great.
You'll also probably notice that you
have another tab at the top here that
allows you to essentially engage or interact
with the target machine.
So if we click on that, as you can see,
this will essentially provide you with access
to the Windows system.
So, again, if I just minimize that,
you can see that we currently have access
to the Windows target.
And you have the ability to start up
the actual vulnerable service that we will be exploiting
in order to gain access.
So, again, you can always utilize the target machine
or access to the target machine if you ever have any issues.
So let's switch back to the attacker machine.
I'm just going to copy the target IP address here.
And I will open up my terminal, and let me just maximize that.
And we can also zoom in, so you can see what's going on.
There we are, fantastic.
So the first thing we want to do is, of course,
start up the PostgreSQL Database Service, as well as
MSF console, so we can save a bit of time.
So I'm just going to say msfconsole.
There we are.
That's going to start the PostgreSQL database
server so that we can interact with the Metasploit framework
database.
And it's then going to start up MSF console.
Fantastic, MSF console is started up,
and we can create a workspace.
And in this case, I'm just going to call this Mimikatz
because that's the tool we will be utilizing.
And I'm going to set up the global variable
for the rhosts option to the target IP
so that we don't need to keep on typing the target IP
or specifying the target IP whenever we load a module.
Now that that is done, we actually
need to exploit the vulnerable service or the target system
in order to gain access.
So we're going to perform an Nmap scan using the db_nmap
command, which will allow us to perform an Nmap
scan from within the Metasploit framework console
and consequently save the results into the Metasploit
framework database within our current workspace.
So I'll just perform a quick service version detection scan.
I'll paste in the target IP, and we'll give this
a few seconds to a few minutes.
As we can see from the Nmap scan results,
we have a web server running on the target.
We also know that the target is running Windows,
most likely a version of Windows Server or probably
Windows 7 or 10.
We're really not sure, but probably Windows 10 and later.
And we have a web server running here on port 80.
The web server is BadBlue httpd 2.7.
So we can actually verify that.
Let's open this up here.
I'm just going to open up the browser here.
And let's see whether we can actually access BadBlue
through our website browser.
So I'll just copy the target IP.
There we are.
And I'll open up Mozilla Firefox here.
And we'll paste in the IP.
And as you can see, BadBlue is currently
running on the target.
And this is the Enterprise Edition.
So you want to pay close attention to the actual edition
here as it will actually come in handy.
That's the actual service we will be exploiting.
Now, BadBlue version 2.7 is vulnerable to a buffer overflow
attack.
So if we run a search for BadBlue 2.7,
we'll get the actual exploit module that we can use here.
So this is the BadBlue 2.72b PassThru Buffer Overflow,
and we can use that particular exploit module.
So I'm going to copy it there.
And I'm going to say use, paste that in there.
There we are.
And the default payload that it is utilizing
is the 32-bit Meterpreter payload, which is fine.
So I'm going to say show options.
We have the ability to actually specify the target IP.
But that's done for us automatically because we set up
the global variable value for rhosts.
rport is fine.
We know that the web server is not running SSL.
Well, it actually looks like, but there isn't an SSL
or a valid SSL certificate.
And furthermore, the port has been configured to port 80.
So we'll leave the SSL option as false.
We then have the payload option.
So we can specify the lhost option.
And this is going to be our current IP address, which again
is automatically added for us.
And then we have the lport option,
which we'll leave to port 4444.
So the next thing that we need to specify
is the actual exploit target, and that
is going to be in reference to the actual version of BadBlue
that we're targeting.
So if we take a look at the actual web page
here that's been provided to us, we
don't get any version information here.
So if we actually take a look at the set target option and what
options we can specify, you can see that we can specify BadBlue
2.72b Universal or BadBlue Enterprise Edition 2.7,
which is exactly what we want to do.
So we want to set it to-- we're going
to set the target to BadBlue Enterprise Edition 2.7
Universal.
And then we're just going to type in exploit.
So we'll give that a few seconds.
And it looks like it sends the stage,
and we get a Meterpreter.
So we've now obtained initial access to the target system.
So I'm just going to clear out the terminal.
And we can, again, perform some local system enumeration
by typing in sysinfo.
And we get the actual target operating system version.
In this case, it's Windows Server 2016.
The actual architecture is 64-bit,
but our Meterpreter payload that we're using is 32-bit.
So that will probably be our next order of process
or the next order of business, if you will.
So let me list out the processes that we can actually
migrate to.
Before we do that, if we type in getuid,
you can see that we have access via the administrator
account, which pretty much means that our privileges are
elevated.
And in order to dump hashes or credentials,
you need elevated privileges.
That that's why we covered the privilege escalation
process beforehand.
So we can migrate to the LSASS process.
So if I want to search for a specific process,
I can essentially utilize the actual pgrep option.
So I can say pgrep and then search for LSASS.
As you can see, that's under the process ID 792.
So I can say migrate 792.
And because we have elevated privileges,
we should be able to migrate without any issues.
There we are, migration completed successfully.
So if I type in sysinfo, you can now
see that our Meterpreter payload is currently
now a 64-bit payload.
We have a 64-bit session, essentially.
So now that we've done that, we can essentially
go ahead and load Kiwi which, as I said,
is essentially just Mimikatz but a module that
was made for Meterpreter.
So in order to do that, we can say load,
and then we say kiwi, hit Enter.
It's going to load the Kiwi extension,
and it's going to say success.
So there we are Mimikatz, 2.2.0 on x64 Windows.
Now if we open up the help--
or rather, the documentation for Meterpreter at the bottom
here once you've loaded the Kiwi extension it'll
give you a list of commands that you
can run based on the type of credentials
that you want to dump.
So we can first and foremost run the credentials all command
to retrieve all credentials.
We can also dump the LSA or other the contents of the SAM
database using lsa_dump_sam.
And we can also dump the LSA secrets using lsa_dump_secrets.
So let's try and dump all the credentials first.
So we're going to say creds_all.
And that will dump all the credentials.
So we get the W digest credentials,
Kerberos credentials, as well as MSV credentials.
So for the administrator user, we get the NTLM hash.
And then for the W digest credentials as well as
Kerberos credentials, you can see that the password is null.
So we haven't been able to get either the hash
or the actual clear-text password.
However, as I've mentioned previously,
you can only get the hashes or the passwords of actual user
accounts on the system.
And in this case, it looks like we only have one user account,
and that is the administrator account.
So we pretty much will not be able to get
any other credentials apart from the administrator credentials.
So we can also dump the contents of the SAM database
by saying lsa_dump_sam.
And in this case, it looks like we get the other account.
So we have another account here called student,
and we get the NTLM hash for student.
We also get the guest account.
But no hash is provided there because the guest account
doesn't require any passwords.
So we get the administrator NTLM hash as well as
the actual student account NTLM hash.
So that's great.
We've been able to get these hashes.
We can also take a look at how to dump the LSA
secrets by saying lsa_dump_secrets, hit Enter.
And in this case, we only get the system key
for the actual domain, which again in this case is the flag.
Now in the next video, we will be
exploring the process of utilizing
these hashes to perform a pass-the-hash attack
and consequently authenticate to the target system legitimately
using the hash.
So we haven't been able to find any clear-text passwords, which
again is something that I expected.
And, again, in this case, the only piece
of information that we have been able to gather
is just the NTLM hash.
Now as I said, the NTLM hash does not necessarily
need to be cracked in order to get the clear-text password
in the next video, we'll be exploring
the process of how to utilize these hashes
for legitimate authentication.
So that's pretty much it in regards to dumping hashes
with Mimikatz.
As I said, you have the ability of also transferring
the Mimikatz binary onto the target system manually.
So if I say upload and we can head over
into the usr/share/windows-resources/
Windows resources directory, if we head over into the binaries
folder, you can see that we have Mimikatz.
If we don't have it within, here then
it should be under the Mimikatz folder.
And we have two versions of Mimikatz.
We have the 64-bit version of Mimikatz
as well as the 32-bit version.
So if we head over into the 64-bit memory case folder,
you can see that we can upload the Mimikatz.exe
executable onto the target.
So I can just say Mimikatz.exe, hit Enter,
and that will upload it to the target system.
And if I list out the contents of our current working
directory, we should see that we have
the Mimikatz.exe stored here.
And this wasn't a very good directory to store it in.
But we can probably execute it as well.
So if I open up a command prompt session,
I can then execute it by saying Mimikatz.exe and hit Enter.
And in this case, we specified that incorrectly
So I'm going to say Mimikatz.exe.
There we are.
Let's make sure we specify the actual name correctly.
And as you can see, Mimikatz loads directly
from within the command shell.
And then of course, we can type in the privilege::debug command
to ensure that we have the appropriate privileges.
And if it tells us "Privilege '20' OK,"
then it means that we have the required privileges in order
to dump our passwords.
So in terms of the native Mimikatz commands and not
Meterpreter commands, we can dump the logon passwords
by typing in sekurlsa and then saying--
we can probably just say logon passwords, so logonpasswords.
There we are.
That'll dump the logon passwords.
And in this case let's see whether we
were able to get any clear-text logon passwords.
So we'll start off with the administrator user.
So there we are.
If we take a look at the administrator user,
we don't get the password.
As you can see, it says null here.
So in this case, we weren't able to get the clear-text password,
which is fine.
In terms of the student user, let
me see if I can find the student user here.
And it looks like we weren't able to identify the student
user account.
And of course, this is going to require that the student user
account has been logged into.
And in this case, it doesn't look like it has,
so we aren't able to get any of the logon passwords.
We can also dump the SAM database by saying
lsadump::sam.
Let me just type that in correctly,
lsadump, double colon, sam.
Hit Enter and that, of course, will dump the contents
of the SAM database.
And in this case, it's very similar to the results
we got using Kiwi.
The great thing with Kiwi is the commands
are fairly simple to remember and very easy to type in.
So, again, if you want to do this manually
through the Mimikatz executable, you can do that as well.
Although, I would recommend utilizing the Kiwi module,
so we get the NTLM hash for the administrator user.
So that is how to utilize Mimikatz to dump NTLM hashes as
well as clear-text passwords.
But in this case, we weren't able to find
any clear-text passwords.
And that's, again, by design because I'm
going to show you how to utilize NTLM hashes for authentication.
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of performing the pass-the-hash attack with BSXX.
So I'll see you in the next video.