Exam 312-50v11 topic 1 question 348 discussion

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS Introduction Mimikatz, developed by Benjamin Delpy (@gentilkiwi), is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as perform attacks such as pass-the-hash, pass-the-ticket or build a golden ticket. Arguably, the primary use of Mimikatz is retrieving user credentials from LSASS process memory for use in post exploitation lateral movement.

Steps to perform an internal monologue attack: 1. The attacker disables the security controls of NetNTLMv1 by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic.

Types of Password Attacks - Active Online Attacks: Internal Monologue Attack Attackers perform an internal monologue(獨自) attack using SSPI (Security Support Provider Interface) from a user-mode application, where a local procedure call to the NTLM authentication package is invoked to calculate the NetNTLM response in the context of the logged-on user.Attacker disables the security controls of NetNTLMv1, extracts all the non-network logon tokens from all the active processes to masquerade as legitimate users. (P.594/578)

Steps of Attacker: 1. Disable the security controls of NetNTLMv1 2. Extract all the non-network logon tokens from all the active processes 3. Interact with NTLM SSP locally to obtain NetNTLMv1 response 4. Restore the security controls of NetNTLMv1 5.Crack the NTLM hash using rainbow tables Attacker 6. Use the cracked hashes to gain system-level access

Correct Ans:CEH v11 module 6

Correct D