Remote Credential Guard Issue about mimikatz

[gentilkiwi]

Amazing :)
It already existed with /restrictedAdmin, a ticket without keys (without SSO).
A flag may exist to indicate it's remote :)

Do you have a dump on client side, and in the same time on server side ?

Cheers

[goldfinger2]

No currently not but we can make it at the end of this week.

Jürgen

[gentilkiwi]

Thank you Jürgen!
It can be easier if @microsoft can buy me a Surface Book :P

[goldfinger2]

Salut Benjamin,
here your dumps.
We made a connection from source with active credential guard (lsass-source-rdp-cg) with mstsc /remoteGuard to the target (lsass-target-rg)
Executing mimikatz on the target with sekurlsa::tickets we get a crash.
We used sadmin with P@ssw0rd!

lsass-target-rgc.zip
lsass-source-rdp-cg.zip

[gentilkiwi]

Hello Jürgen :)

Thank you, I'll take a look 👍
Was the user in "Protected Users" group too ?

[goldfinger2]

Yes, he is in the Protected User Group, too.

Jürgen

[goldfinger2]

Salut Benjamin,
I forgot to attach the user information. 
We used claims, too. May be they can be counterfeit soon and easy by the mimikatz golden ticket creation. ;-)
By the way is there a mimikatz command to list the Kerberos PAC field authorization information directly?

Juergen

whoami /all
USER INFORMATION
----------------
User Name      SID                                         
============== =============================================
company\sadmin S-1-5-21-504569365-2122958605-3922303804-1609

GROUP INFORMATION
-----------------
Group Name                                     Type             SID                                          Attributes                                                    
============================================== ================ ============================================ ===============================================================
Everyone                                       Well-known group S-1-1-0                                      Mandatory group, Enabled by default, Enabled group            
BUILTIN\Users                                  Alias            S-1-5-32-545                                 Mandatory group, Enabled by default, Enabled group            
BUILTIN\Administrators                         Alias            S-1-5-32-544                                 Mandatory group, Enabled by default, Enabled group, Group owner
NT AUTHORITY\INTERACTIVE                       Well-known group S-1-5-4                                      Mandatory group, Enabled by default, Enabled group            
CONSOLE LOGON                                  Well-known group S-1-2-1                                      Mandatory group, Enabled by default, Enabled group            
NT AUTHORITY\Authenticated Users               Well-known group S-1-5-11                                     Mandatory group, Enabled by default, Enabled group            
NT AUTHORITY\This Organization                 Well-known group S-1-5-15                                     Mandatory group, Enabled by default, Enabled group            
LOCAL                                          Well-known group S-1-2-0                                      Mandatory group, Enabled by default, Enabled group            
COMPANY\Group Policy Creator Owners            Group            S-1-5-21-504569365-2122958605-3922303804-520 Mandatory group, Enabled by default, Enabled group            
COMPANY\Domain Admins                          Group            S-1-5-21-504569365-2122958605-3922303804-512 Mandatory group, Enabled by default, Enabled group            
COMPANY\Protected Users                        Group            S-1-5-21-504569365-2122958605-3922303804-525 Mandatory group, Enabled by default, Enabled group            
COMPANY\Schema Admins                          Group            S-1-5-21-504569365-2122958605-3922303804-518 Mandatory group, Enabled by default, Enabled group            
COMPANY\Enterprise Admins                      Group            S-1-5-21-504569365-2122958605-3922303804-519 Mandatory group, Enabled by default, Enabled group            
NT AUTHORITY\Claims Valid                      Well-known group S-1-5-21-0-0-0-497                           Mandatory group, Enabled by default, Enabled group            
Authentication authority asserted identity     Well-known group S-1-18-1                                     Mandatory group, Enabled by default, Enabled group            
COMPANY\Denied RODC Password Replication Group Alias            S-1-5-21-504569365-2122958605-3922303804-572 Mandatory group, Enabled by default, Enabled group, Local Group
Mandatory Label\High Mandatory Level           Label            S-1-16-12288                                                                                               

PRIVILEGES INFORMATION
----------------------
Privilege Name                            Description                                                        State  
========================================= ================================================================== ========
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Disabled
SeSecurityPrivilege                       Manage auditing and security log                                   Disabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Disabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Disabled
SeSystemProfilePrivilege                  Profile system performance                                         Disabled
SeSystemtimePrivilege                     Change the system time                                             Disabled
SeProfileSingleProcessPrivilege           Profile single process                                             Disabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Disabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Disabled
SeBackupPrivilege                         Back up files and directories                                      Disabled
SeRestorePrivilege                        Restore files and directories                                      Disabled
SeShutdownPrivilege                       Shut down the system                                               Disabled
SeDebugPrivilege                          Debug programs                                                     Disabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Disabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Disabled
SeUndockPrivilege                         Remove computer from docking station                               Disabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Disabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Disabled
SeTimeZonePrivilege                       Change the time zone                                               Disabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Disabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Disabled

USER CLAIMS INFORMATION
-----------------------
Claim Name           Claim ID                    Flags Type   Values                 
==================== =========================== ===== ====== ========================
"AuthenticationSilo" ad://ext/AuthenticationSilo       String "Restricted_Admin_Logon"

[gentilkiwi]

I don't know a lots about claims for the moment.
I've embedded some tools in mimikatz to decrypt ticket & for PAC interpretation,.. but can not make all automated because of ASN.1 interpretation: https://social.msdn.microsoft.com/Forums/vstudio/en-US/b237c77e-614b-4c77-b9d7-9773eefb2698/berinit-and-asn1-sequence

You can enable "allowtgtsessionkey", export tgt by API and send me ticket + AES krbtgt. I can take a look.
Do not hesitate to use mail if sensitive informations.