Token Impersonation - LM

PRACTICE ! PRACTICE ! PRACTICE !

What are Tokens ?

Tokens can be assumed as cookies for our computer, basically some sort of temporary keys that allows us to access a system or a network without having to provide credentials each time we access some resource

• Delegate - Created while loggin into a machine via RDP

• Impersonate - "non-interactive" such as attaching a network driver or a domain logon script

Token Impersonation w Metasploit

• Fire up the msfconsole and search for the module /exploit/windows/smb/psexec

• Set the required options and run the module

d

s

s

Token Impersonation w/o Metasploit -> Potato Attacks

Mitigation Strategies

• Limit user or group token creation permissions

• Account tiering

• Local Admin restriction