In this lesson,
we're going to cover Credential Harvesting
and Credential Dumping.
Two essential techniques in penetration testing.
We'll explore the theory behind these methods
and demonstrate their practical applications
through a detailed scenario using a tool
like Mimikatz or Rubeus.
Credential harvesting involves collecting user credentials,
such as usernames and passwords,
typically through phishing attacks
or other social engineering techniques.
Credential dumping, on the other hand,
is a post-exploitation activity
where an attacker extracts credentials
from a compromised system.
Imagine you're conducting a penetration test
for a financial institution.
Your goal is to assess the security
of their internal network
and identify potential vulnerabilities
that could be exploited by an attacker.
During the initial reconnaissance phase,
you discover an outdated web application running
on one of their servers.
You exploit a known vulnerability,
CVE-2021-
34527
to gain access to the server.
With access to the system,
you then move on to credential dumping.
First, you use Mimikatz,
a tool for extracting plain text passwords,
hashes, pin codes, and Kerberos tickets from memory.
Mimikatz can be used to dump credentials
from the local security authority subsystem service,
or LSASS process, on Windows Systems.
This is how you can do it.
Open a command prompt with administrative privileges
on a compromised server and run the following commands.
mimikatz # priviledgte::debug
and then, mimikatz #
sekurlsa::logonpasswords.
These commands grant Mimikatz the necessary privileges
and then extract the credentials from the memory.
You may find usernames and passwords in plaintext
or NTLM hashes that can be cracked offline.
Next, you use Rubeus, another tool that focuses
on Kerberos ticket manipulation.
Rubeus can be used to perform pass-the-ticket attacks,
where you authenticate as a user
without knowing their password
by using a valid Kerberos ticket.
Here is an example of how to use Rubeus.
Now, let's break this command down.
Rubeus.execute is the executable name
for the tool being used.
Again, Rubeus is a tool used
for manipulating Kerberos tickets,
which are used in Windows networks for authentication.
Then we have the tgt::renew,
this specifies the action to be performed by Rubeus.
In this case,
it's renewing a ticket granting ticket, or TGT.
A TGT is a special ticket used in Kerberos
to authenticate users without requiring them
to enter their password multiple times.
Then we have the /user:admin.
This parameter specifies the username
for which the TGT is being renewed.
In this example, the username is admin,
indicating a high privileged account.
Then we have the /domain:banksecure.local,
This parameter specifies the active directory domain
where the user account resides.
In this example, domain is banksecure.local.
And finally, we have the /sid.
This parameter specifies the security identifier
of the user account.
The SID is a unique identifier used
to represent the user and the domain.
The SID provided should be the SID of the admin account
in the banksecure.local domain.
Simply, this command renews the ticket granting ticket,
or TGT, for the specified user,
allowing you to impersonate them
and access resources on the network.
After you successfully dump
the credentials of the domain admin, with these credentials,
you can access sensitive financial data,
modify transactions, or even create new user accounts
with administrative privileges.
So remember, credential harvesting and credential dumping
are critical techniques in pentesting.
They allow you to assess the effectiveness
of the organization's security measures
in protecting sensitive information.
Tools like Mimikatz and Rubeus are powerful,
but they also highlight the importance
of using robust security practices
such as regular patching, network segmentation,
and the use of multi-factor authentication
to mitigate these risk.