Last updated
Last updated
Pass the hash is a technique that allows you to authenticate to a Windows service using the NTLM hash of a user's password. It works by starting a new logon session with a fake identity and then replacing the session information with the domain, username and NTLM hash provided.
Beacon has a dedicated pth command which executes Mimikatz in the background.
This command requires elevated privileges.
First, attempt to list the C$ share of the WEB machine - this will fail because bfarmer is not a local admin there.
Then run the pth command with jking's username and NTLM hash.
We can see that the command Mimiktaz runs passes the new credentials over a named pipe, which Beacon then impersonates automatically. We can then attempt to list the C$ share again, which will succeed.
To "drop" impersonation afterwards, use the rev2self command.
OPSEC
Two opportunities to detect PTH are the R/W handle to LSASS; and looking for the echo foo > \\.\pipe\bar pattern in command-line logs.
The former is already part of the "Suspicious Handle to LSASS" saved search. This time we see an access mask of 0x1038. This is a combination of PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_WRITE (0x0020), PROCESS_VM_READ (0x0010) and PROCESS_VM_OPERATION (0x0008).
The latter can be found via the "Suspicious Named Pipe Impersonation" search, which queries process events where the arguments contain "echo", ">" and "\\.\pipe\".
