Windows Access Tokens - From Authentication to Exploitation

Описание: This presentation dives into Windows authentication and access tokens. It explains how Windows handles authentication, describes the various logon session types (including why and how cached credentials are used), and examines the function of Windows access tokens. You’ll learn how access tokens are created, the different token types and levels, their actual usage and how these are used for access control. Finally, you will also see through practical demonstrations how attackers can abuse these mechanisms to impersonate users or carry out privilege escalation on a system.

Slides download: https://www.compass-security.com/file...

Content:

00:00 Welcome
01:19 Windows Authentication
04:23: Logon Sessions & Logon Types
13:17 Cached Credentials
15:10 Access Tokens
18:26 Impersonation Levels
20:51 The Netonly Logon Case
23:00 User Impersonation
28:16 Process Injection
31:47 Token Impersonation
26:39 Double Hop Problem
32:49 Access Token Handling with Mimikatz
39:12 Token Impersonation Demo using Mimikatz
49:14 Token Impersonation using Netexec
50:04 Privilege Escalation (From Service to SYSTEM)
53:40 Privilege Escalation (From Local Admin to SYSTEM)
56:53 Recap
57:39 References