[Attacks and Exploits] During an internal penetration test, a tester compromises a Windows OS-based endpoint and bypasses the defensive mechanisms…

The tester's goal is to leverage credentials from a compromised domain-joined Windows endpoint for lateral movement within the Active Directory (AD) environment. Mimikatz is a post-exploitation tool specifically designed to extract credentials from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. On a domain-joined machine, LSASS often caches domain user credentials, including plaintext passwords, NTLM hashes, and Kerberos tickets. By running Mimikatz, the tester can dump these credentials and use them in attacks like Pass-the-Hash or Pass-the-Ticket to authenticate to other systems on the domain, directly fulfilling the objective.

B. Use Hashcat to crack a password for the local user on the compromised endpoint

Cracking a local user's password does not provide credentials for authenticating to other systems within the Active Directory domain, which is the specified goal.

C. Use Evil-WinRM to access other systems in the network within the endpoint credentials

Evil-WinRM is a tool for lateral movement that uses credentials. The primary step is to first obtain the credentials to leverage, which is what Mimikatz does.

D. Use Metasploit to create and execute a payload and try to upload the payload into other systems

This describes exploiting a vulnerability on another system, not specifically leveraging stolen credentials for authentication, which is the method described in the tester's goal.

1. MITRE ATT&CK Framework. (2023). T1003.001: OS Credential Dumping: LSASS Memory. The MITRE Corporation. Retrieved from https://attack.mitre.org/techniques/T1003/001/

Reference Detail: This official resource states

"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS)... Mimikatz is a common tool for this purpose." This directly supports using Mimikatz to extract credentials from LSASS.

2. Al-Mhiqani

M. N.

et al. (2021). A Review of Credential Dumping and Pilfering in Windows Operating System. IEEE Access

9

123339-123354. https://doi.org/10.1109/ACCESS.2021.3110011

Reference Detail: (Section III-A

p. 123342) The paper details Mimikatz as a primary tool for post-exploitation

explaining its ability to "extract plaintext passwords

hashes

and Kerberos tickets from the LSASS memory." This validates Mimikatz as the correct tool for the task described.

3. Microsoft Corporation. (2023). Local Security Authority Subsystem Service. Microsoft Learn.

Reference Detail: Official Microsoft documentation describes LSASS as the process responsible for "enforcing the security policy on the system

" which includes handling user logons and managing security tokens. This explains why credentials reside in its memory

making it the target for tools like Mimikatz.

4. Broussard

S. (2018). Active Directory Post-Exploitation and Lateral Movement. SANS Institute InfoSec Reading Room.

Reference Detail: (Page 5) This SANS whitepaper

a reputable source in cybersecurity education

explicitly outlines the post-exploitation step: "Once an attacker has a foothold on a system

they will often attempt to dump credentials from memory... The most popular tool for this is Mimikatz." This confirms the standard procedure in a penetration test.