Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Skeleton Key

So skeleton key like mimikatz was something I learned about recently and was interested in. So this post is one is for me to understand how to use these features and hopefully log and or detect it.

According to Dell SecureWorks, skeleton key uses a method of bypassing AD authentication when single factor (password) authentication mechanism is used. Basically a malicious actor can assign a "master" password to the AD domain and thus login as any user.

So how do we test this?
We will leverage information we learned in the previous posts, specifically this one and this one.

Since most of the work was done in the previous posts, let's just go ahead and install the "skeleton key" using mimikatz.














From above we see skeleton key has been loaded. 

Let's now test this by trying to connect to a network share on the DC from a Windows 7. Below I use the password "Blogging1" with the username "tUser" and was a able to successfully map drive "F" to the "tmp" share on the server and perform a "dir" to view the files in the directory.





Similarly below, I connect to a network share on the DC from a Windows 7.  In this scenario however, I use the "master" password "mimikatz" with the username "tUser" and was a able to successfully map drive "F" to the "tmp" share on the server and perform a "dir" to view the files in the directory.

Both examples above clearly demonstrated that this worked as expected.

According to Dell, skeleton key does not have any type of persistence at this time, thus by rebooting the Domain Controller, the system will no longer be affected.

Similar to the other posts, we will try to analyze all of this activity when we look at the log analysis in this post.

Reference:
https://adsecurity.org/?p=1275
https://www.secureworks.com/research/skeleton-key-malware-analysis

Posts in this series:
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Lab Setup
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Dumping the AD database
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Mimikatz
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Exporting Certificates
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Pass The Ticket (Golden Ticket)
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Skeleton Key
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Log Analysis
Learning about Mimikatz, SkeletonKey, Dumping NTDS.dit and Kerberos with Metasploit - Volatility Memory Analysis