Token Impersonation
What are tokens?
Temporary keys that allow you access to a system/network without having to provide credentials each time you access a file. Think cookies for computers.
Two types:
Delegate – Created for logging into a machine or using Remote Desktop
Impersonate – “non-interactive” such as attaching a network drive or a domain logon script
Example
We can sometimes also find admin tokens.
We can then use it to dump hashes
We can also add a new user to get more access
Exploiting Tokens
1. Get a meterpreter shell
We can use smb psexec to gain a terminal if we have credentials
User must have logged in to our target machine.
2. Load INCOGNITIO module
meterpreter has some commands that can be used to impersonate tokens.
You need to load the incognitio module.
You can type help and see the supported commands.
List tokens
We can also list groups
Impersonate tokens
If you have admin token, you can even impersonate it.
Adding a user
We can even add a user.
Secrets Dump
Now we can use it to dump things.
Last updated