search

Token Impersonation

hashtag
What are tokens?

  • Temporary keys that allow you access to a system/network without having to provide credentials each time you access a file. Think cookies for computers.

Two types:

  • Delegate – Created for logging into a machine or using Remote Desktop

  • Impersonate – “non-interactive” such as attaching a network drive or a domain logon script

hashtag
Example

We can sometimes also find admin tokens.

We can then use it to dump hashes

We can also add a new user to get more access

hashtag
Exploiting Tokens

hashtag
1. Get a meterpreter shell

We can use smb psexec to gain a terminal if we have credentials

User must have logged in to our target machine.

hashtag
2. Load INCOGNITIO module

meterpreter has some commands that can be used to impersonate tokens.

You need to load the incognitio module.

You can type help and see the supported commands.

hashtag
List tokens

We can also list groups

hashtag
Impersonate tokens

If you have admin token, you can even impersonate it.

hashtag
Adding a user

We can even add a user.

hashtag
Secrets Dump

Now we can use it to dump things.

PreviousPass the Ticket (PtT) from LinuxNextLNK File Attacks

Last updated