In this lesson,
we're going to talk about Credential Passing Attacks.
These include Pass-the-Hash attacks,
Pass-the-Ticket attacks, and Pass-the-Token attacks.
Understand these attacks will help you
both defend against them
and use them ethically during a pen test.
First, let's look at Pass-the-Hash attacks.
Pass-the-Hash attacks allow an attacker
to authenticate to a remote server or service
by using the hash value of a user's password
rather than the plain text password itself.
Windows operating systems store password hashes in memory,
and attackers can extract these hashes
and use them to gain unauthorized access.
For example, if an attacker has compromised a machine,
they can use a tool like Mimikatz
to extract the password hashes from memory.
The command might look something like this,
mimikatz # sekurlsa::logonpasswords.
Here's a short breakdown of this command.
So, the Mimikatz that just stands for the executable
for the Mimikatz tool, which is used to extract passwords
and other authentication information from Windows systems.
The pound symbol
just symbolizes that the next text will be a command
that be executed within the Mimikatz interface.
Now, the sekurlsa::logonpasswords option
is a specific command within Mimikatz
to extract logon passwords.
It retrieves and displays login session information,
including usernames, domain names,
and password hashes currently stored in the system's memory.
Once the hashes are extracted, the attacker can use them
to authenticate to other machines on the network.
Using a tool like CrackMapExec,
the attacker can Pass-the-Hash to access a remote system.
Here's the command for that, crackmapexec smb,
then we'll have the IP address, the -u option,
the -H option, and the -x option.
In this command, the -u option user specifies the username.
The -H option specifies the hash that we'll be using,
and then we'll have the -x command.exe,
which runs a command prompt on the target system.
Next, let's discuss Pass-the-Ticket attacks.
In a Pass-the-Ticket attack,
an attacker uses a stolen Kerberos tickets
to authenticate to a network service.
Kerberos tickets are used in Windows environments
to authenticate users and services
without repeatedly sending passwords over the network.
An attacker can extract Kerberos tickets
from a compromised machine
using Mimikatz with the following command,
mimikatz # kerberos:: list /export
Now, this command
exports the Kerberos ticket present on the machine.
The attacker can then use these tickets
to authenticate to other network services.
For instance, you can use Impacket's psexec tool
to authenticate with the extracted ticket.
Here is what the command would be for that,
psexec.py -k -no-pass DOMAIN/user@192.168.1.100
Now, in this command,
the -k option uses the Kerberos authentication,
the -no-pass specifies no passwords needed,
because the Kerberos ticket will be used.
And then, we have the domain and the username
and IP address, which again,
just specifies the domain, user, and target IP address
that we are trying to send the ticket to.
To protect against Pass-the-Ticket attacks,
ensure regular ticket expiration,
use strong authentication mechanisms,
and just monitor for unusual authentication patterns.
If compromised, a painful but effective method
is to rotate the password
of the Key Distribution Center or the KDC.
Finally, let's look at Pass-the-Token attacks.
Pass-the-Token attacks
involve using stolen authentication tokens
to gain unauthorized access.
These tokens are often used
in web application and APIs for authentication.
Attackers can capture these tokens through various means,
such as intercepting network traffic
or compromising a session.
For example, if an attacker intercepts a JSON Web Token
or JWT from a web application,
they can reuse it to access the application
without knowing the user's credentials,
suppose an attacker capture it the following JWT.
The attacker can then use its token
to access the application
by including it in the HTTP authorization header.
To protect against Pass-the-Token attacks,
use secure communication channels like HTTPS,
implement token expiration and revocation mechanisms,
and also monitor for unusual token usage.
So, remember, Pass-the-Hash attacks
use password hashes to authenticate,
Pass-the-Ticket attacks use stolen Kerberos ticket,
and Pass-the-Token attacks
involve intercepting authentication token.
Understanding these methods
will help you both defend against
and use these attacks in the penetration test.