Pass-The-Hash opens the process under original user rights. #885

CryptomaticSquirrel · 2017-12-25T17:06:15Z

Empire Version

2.3

OS Information (Linux flavor, Python version)

Host: Linux kali 4.13.0-kali1-amd64 #1 SMP Debian 4.13.4-2kali1 (2017-10-16) x86_64 GNU/Linux
Target machine: Windows 8.1 with patches up to 2014 November.
Mimikatz 2.1

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

Screenshot of error, embedded text output, or Pastebin link to the error

The cmd.exe that is executed does not adopt new user rights.

Any additional information

I have tried PTH with the built in modules in Empire and by executing the commands with domain administrator and NT SYSTEM on target machine. Using the module imported from Invoke-Mimikatz.ps1.

Invoke-mimikatz seems to work. But if I use PTH it will create a process with the original user rights.

Under mimikatz tokens it shows:
I have cropped the domain just in case.

The Creds are there. But the original system rights are used.

I will link the two previous posts on this just in case.
#884
#873

CryptomaticSquirrel · 2017-12-25T17:43:27Z

Solved...

It seems it was working the whole time. Unlike MSF the rights are not adopted. I have to steal the right from the new process created by mimikatz PTH.
After this, the console still reports back the original user rights of the agent. So I assumed the new rights I tried to get were not transferred. But if I use the process with the stolen rights I can move laterally in the network.

CryptomaticSquirrel changed the title ~~Pass-The-Hash opens the process under original rights.~~ Pass-The-Hash opens the process under original user rights. Dec 25, 2017

CryptomaticSquirrel closed this as completed Dec 25, 2017

123dshark mentioned this issue Jul 7, 2018

Empire runas module throws Access Denied error #1184

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pass-The-Hash opens the process under original user rights. #885

Pass-The-Hash opens the process under original user rights. #885

CryptomaticSquirrel commented Dec 25, 2017

CryptomaticSquirrel commented Dec 25, 2017

Pass-The-Hash opens the process under original user rights. #885

Pass-The-Hash opens the process under original user rights. #885

Comments

CryptomaticSquirrel commented Dec 25, 2017

Empire Version

OS Information (Linux flavor, Python version)

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

Screenshot of error, embedded text output, or Pastebin link to the error

Any additional information

CryptomaticSquirrel commented Dec 25, 2017