With that said, we're going to be able to go in and use MSF console for us to be able to
potentially create a golden ticket. Now again, there's a lot of assumptions here in that we've
done our research and due diligence in making sure that we gained access to the network and
the different components of that network. So if you're just taking the skill by itself, just know
that there's plenty of other things here within the course overall that play into where we're at
in this step-by-step process of tearing somebody's network, our pen testing and organization.
So inside of our MSF console, we do need to make sure that we swap over to our multi-handler
and we can do that by use exploit multi-handler and then we want to make sure that it is still
being configured with Windows x64 made a pretty reverse TCP. Reason so is because this matches
the actual dummy file that we have on that domain controller that is simulating the effect of
having a file or backdoor into that domain controller as it is. Now in this particular
case, we're going to be using... well let's go in and show our options real quick
because we need to make sure that we have everything configured.
And we do. So now let's go ahead and run dash j to have that service run in the background
while we go and crank up our connection to that DC. Our session is now open and where this is
going to take a turn for the weird is that inside of here now we're going to go into sessions three
and inside of meterpreter you can see that we're on our standard terminal here. We could go to shell
but we really want to load kiwi. Now this is going to have a basically adding mimikatz instead
of a standalone tool like we've used in the past. It's integrated inside of our MSF console shell
that we've have our session connected with the DC with. So some of the tools that we have
gained familiarity with we don't no longer have to dump in and out of MSF console to use them.
Now once that's loaded we want to do a DC sync for NTLM for the KRB TGT. Now before I do that
let me scroll up and show you something real quick. Inside of the actual users that we were
enumerating you'll notice that one of these users was KRB TGT and that's inside of the actual
scanner SMB scanner and this is also in the other method as well. If I continue to scroll up
or open up the other window I think it's in yes I'll tab over and show you real quick.
Right here you can see that it's listed as 502 as well. The reason I'm pointing this one particular
account out is because that's the actual ticket granting account for Kerberos inside the Active
Directory domain. You don't have to be on the DC to see it you just have to be able to have LDAP
visibility. We've seen how to do that many times over but this one is really important because
that's the account that we're going to be attacking but not directly right. So inside of
this account that does the ticket granting stuff we are doing a DC sync in order to be able to get
the NTLM hash and as I'm running it you can see that the information came back with NTLM and LM
hash and if those look familiar they should because you could very well just crack the password using
John right there or you could go even further into just using golden ticket create and creating the
golden ticket is something as simple as golden ticket create and I'll have all these commands
below for you for the actual domain of texas.local-u for the user and this is where it
gets weird. You can create fake users and we already seen in Active Directory users of computers
the listing of users that we have. We have Eric, we have Zaphod, we have the service accounts that
we've made. We could create whoever we want and make it look like a regular user regular user
or we can make it a domain admin which is what we're doing and the reason this is such a vulnerable
bad attack is because by creating this fake user using the fake ticket under the Kerberos
ticket granting account we can bypass a lot of the security measures and not have to log in as an
administrator and just say I've got the master key I can totally do what I want when I want.
So the user that we're going to be making here is going to be
I don't know let's just say cbt and then dash k is going to be the kgbt
the accounts hash right and we're going to be using the ntlm hash for that so you just copy
everything from alpha all the way over to foxtrot in that line right there and then paste it inside
the command that you're working on as we speak. Paste selection there we go and then you dash t
to the actual file that you want. Now I'm going to save this to golden ticket and I've already made
one but I'm going to go ahead and delete that and create another one so that way you could use this
if you want moving forward golden ticket so that file is what's actually being used. What did I
miss? You know I mentioned everything about the SID and I totally forgot to add the SID in there.
Before we actually do the hash itself we need to go in after the cbt which is the fake account that
we're making type in a dash s and this will be where the domain SID is going to be placed at.
Now I'm going to tab over real quick and go ahead and copy that for us. Now that the command is
truly complete and again it will be in the box below you can see that a golden ticket was made
on the lower left hand side of the screen and where we go from there is where the golden ticket
is really the the point of this whole exercise and why everybody tries to get it.