pass the hash attack, detection and mitigation

Pass the hash (lateral movement)

pass the hash is a technique that enables an attacker using mimikatz tool to capture ntlm or lanman password hash of user from memory. successful attack allow the attacker to access directory or resources that the compromised user has authorize to access. 

how this attack works:

1. attacker first compromise a system or without taking consent of the user, attacker access that system and if that account has admin rights then leveraging that right attacker can use mimikatz to dump out all other ntlm password hashes from memory. or they can also compromise AD and take the ntds.dit file to capture hash from that file. 

2. using mimikatz tool they can embed the hash on the local token and starts moving through out the network laterally. it will not give attacker high level access on the target system. but if the compromised user account hash is authorized to high level access then attacker also will get the same. it depends based on the permission.

 you can see that steveholt is the user in this system and he is only has local admin rights as he belongs to local administrators group. he does not have domain admin rights. so he cannot access domain controller at any aspects. as he has local admin access so what we can do is launch mimikatz to dump out all the password hashes that is stored in memory in a search of if any domain admin ever access this system or not. if yes then we can find his hash and merged that with our token using mimikatz to elevate our privilege on our desired target system. 

after executing this command we found that there is an administrator in my domain who logged in my system for do some work someday. so copy his ntlm hash. 

after launching this command an elevated command prompt will appear. if you type whoami then it still tells you, you are steveholt but actually the command prompt has been appear by taking the token privilege of user Tony.Wonder.

now access the DC, you shall get access. 

 

Avi