Lab: Maintaining Access

Step 5 – Credential Dumping on Windows 10 Client

Teamwork – Team DaMa

1. Introduction

If you have local administrative privileges on a Windows machine, you can abuse this to retrieve various forms of credentials stored on the respective machine. This includes credentials of local user accounts (stored in the SAM file) as well as temporarily cached credentials of currently logged-in users (kept in the memory of the lsass process).

There are many ways to do this. In this exercise we will use the famous tool Mimikatz.

Please write a short PDF report that includes screenshots of the major steps of the attack (at least the final step) and answer the following questions:

1. Why does Mimikatz need debug privileges?
2. What are the prerequisites that your current session has SeDebugPrivileges
3. What are you going to do next with the NTLM hash of user Aalfort?
4. Explain what Mimikatz does in the background to reveal these credentials?
5. Why can user Aalfort’s credentials be found in the LSASS memory of Client1

2. Answers

1. Mimikatz requires this privilege as it interacts with processes such as LSASS.exe. Otherwise we won’t be able to dump sensitive informations from the memory.

   

   In a Windows System the LSASS.exe process is responsible for the following things:

   • Verifying and storing users credentials
   • Writing to the windows security log
   • Enforcing the security policy on the system

2. The debug privilege according to Microsoft determines which users can attach a debugger to any process or to the kernel. By default this privilege is given to Local Administrators!
   We have two ways to go:

   • become (local) Administrator
   • become local system

3. After gaining hashes it is up to the attacker to what they decide to do with the hash. They can try their hand at cracking it. But as we all know that it is difficult, time-consuming, and still no guarantee of gaining the correct password. Then there is this other way. During authentication, the basic procedure is the password is collected from the user, then it is encrypted and then the encrypted hash of the correct password is used for future authentication. During Credential Dumping, we see that we have extracted lots and lots of hashes. Now as an attacker we don’t know the password. So, during the authentication, we provide the hash instead of the password. Windows compares the hashes and welcomes the attacker with open arm.

   https://crackstation.net is an online hash cracker service.

   Crackstation’s lookup tables were created by extracting every word from the Wikipedia databases and adding with every password list we could find. We also applied intelligent word mangling (brute force hybrid) to our wordlists to make them much more effective. For MD5 and SHA1 hashes, we have a 190GB, 15-billion-entry lookup table, and for other hashes, we have a 19GB 1.5-billion-entry lookup table.

   

   Next step is allready part of the lateral movement. We’ve tried if we can access the fs1 server by trying the pass the hash attack.

   In Mimikatz we’ve used the following command:
   sekurlsa::pth /user:aalfort /domain:winattack.local /ntlm:9859340265d3b3c1eb628ece70ebc238 /run:cmd

   
   By using the psexec utility we weren’t able to access the fs1 fileserver, but this is not the goal of this exercise!

4. Mimikatz is doing a memory dump of the process LSASS.exe to generate an output of sensitive logon informations.
   (See Screenshot of Step1)

5. After the initial authentication, Windows keeps the hash in its memory so that the user doesn’t have to enter the password again and again. The User Aalfort has an interactive session to our client and that’s the reason why we found the NTLM Hash in the memory.

PDF Report
Step5