mimikatz

A very cool topic. Similar to that, mimikatz has a minesweeper functionality. You can use it to dump passwords and kerberos tickets, or just cheat at minesweeper https://github.com/gentilkiwi/mimikatz/blob/c78b1cf37c517ae9...

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't being blocked - just the specific implementation. This is why we build our own tools: to demonstrate to defenders that while they are blocking a specific implementation they have not addressed the underlying vulnerability. I do want to call out FireEye for doing an amazing job recovering from this situation. They did the responsible thing and released fingerprints [2] that could be used to detect every single one of their tools. T

The gist of it is gathering credentials from the initialy compromised machines, and using them to access other computers on the network. A lot of this is possible because of the way Windows handles authentication between computers. Mimikatz is a tool that really made this method of lateral movement much easier for attackers, and Microsoft has been slow to adapt defences. Over time the attackers will eventually gather some admin credentials, and then it is really game over. It is hard to defend against, unless you want a system that constantly prompts you for your password everytime you want to do something. Frequent password prompts is not really good for security either. Current mitigations really just slow down the attacks and gives you time to respond. If they are left alone they will manage to gather credentials over time. https://git

If you have the DS-Replication-Get-Changes permission, you can exploit dc-sync through something like mimikatz [0] to grab the password hashes out of Active Directory, so you can run your checks. [0] https://github.com/gentilkiwi/mimikatz