Pentest - Mimikatz

Overview

Active Directory supports two primary authentication protoc
ols, NTLM and Kerberos. Modern Windows versions default to Kerberos authentication.

NTLM suffers from two main weaknesses:

• 1) the NTLM password hash only changes when the password changes, so exposure of this hash provides access to the account until the password is changed, and
• 2) the server hosting the resource needs to check with
  the Domain Controller to verify the challenge response data sent from the client is valid.

Kerberos improves on these issues by

• 1) limiting the Kerberos ticket lifetime so if the ticket is stolen, can only be used for a set amount of time,
• 2) the authentication flow involves the user getting a service ticket (from a DC) for the service on a server which the server checks without requiring communication
  with a DC.

Kerberos Communication

Here’s a quick example describing how Kerberos works:
User logs on with username & password.

1a. Password converted to NTLM hash, a timestamp is encrypted with the hash and sent to the KDC as 
an authenticator in the authentication ticket (TGT) request (AS-REQ).

1b. The Domain Controller (KDC) checks user information (logon restrictions, group membership, etc) & creates Ticket -Granting Ticket (TGT).

2. The TGT is encrypted, signed, & delivered to the user (AS-REP).Only the Kerberos service (KRBTGT) in the domain can open and read TGT data.

3. The User presents the TGT to the DC when requesting a Ticket Granting Service (TGS) ticket (TGS-REQ). The DC opens the TGT & validates PAC checksum –If the DC can open the ticket & the checksum check out, TGT = valid. The data in the TGT is effectively copied to create the TGS ticket.

4. The TGS is encrypted using 
the target service accounts’ NTLM password hash and sent to the user (TGS-REP).

5.The user connects to the server hosting the service on the appropriate port & presents the TGS (AP-REQ). The service opens the TGS ticket using its NTLM password hash.

6. If mutual authentication is required by the client (think MS15-011: the Group Policy patch from February that added UNC hardening).

Unless PAC validation is required (rare), the service accepts all data in the TGS ticket with no communication to the DC.

---

The Skeleton Key malware is installed on one or multiple Domain Controllers running a supported 64bit OS.
The malware “patches” the security system enabling a new master password to be accepted for any domain user, including admins.

This enables the attacker to logon as any user they want with the master password (skeleton key) configured in the malware.

“Joe User” logs in using his usual password with no changes to his account. The attacker can log in as Joe using the skeleton key password and it is seen as a valid logon…

Key points

• Requires domain-level admin rights (and debug rights which admins have by default) to “patch” LSASS on a Domain Controller.
• All existing user account passwords continue working as normal.
• Adds a new password that enables the attacker to log on as any user with this password – this is the “skeleton key”.
• Active Directory Domain Controllers may experience replication issues.
• User accounts that require a smart card for authentication are not affected.
• The Skeleton Key malware currently doesn’t remain active after a reboot – rebooting the DCs removes the in-memory patch. Note that DCs are typically only rebooted about once a month.
• The Skeleton Key malware only works on the following 64-bit systems: Windows Server 2008, Windows Server 2008 R2, and Windows Server 2003 R2.
• Mimikatz now has skeleton key functionality and seems to work on all versions of Windows Server…
• Protect your Active Directory admin accounts and don’t let untrusted code run on Domain Controllers.

---

Mimikatz Functions

mimikatz # base64::
ERROR mimikatz_doLocal ; "base64" module not found !

        standard  -  Standard module  [Basic commands (does not require module name)]
          crypto  -  Crypto Module
        sekurlsa  -  SekurLSA module  [Some commands to enumerate credentials...]
        kerberos  -  Kerberos package module  []
       privilege  -  Privilege module
         process  -  Process module
         service  -  Service module
         lsadump  -  LsaDump module
              ts  -  Terminal Server module
           event  -  Event module
            misc  -  Miscellaneous module
           token  -  Token manipulation module
           vault  -  Windows Vault/Credential module
     minesweeper  -  MineSweeper module
             net  -  
           dpapi  -  DPAPI Module (by API or RAW access)  [Data Protection application programming interface]

Standard

mimikatz # standard::
ERROR mimikatz_doLocal ; "(null)" command of "standard" module not found !

Module :    standard
Full name : Standard module
Description :   Basic commands (does not require module name)

            exit  -  Quit mimikatz
             cls  -  Clear screen (doesn't work with redirections, like PsExec)
          answer  -  Answer to the Ultimate Questi