Lateral Movement - Skeleton Key Attack
Last updated
Was this helpful?
Last updated
Was this helpful?
The Skeleton Key attack is a sophisticated technique that allows attackers to bypass Active Directory authentication by injecting a master password into the domain controller. This enables the attacker to authenticate as any user without their password, effectively granting them unrestricted access to the domain.
It can be performed using . To carry out this attack, Domain Admin rights are prerequisite, and the attacker must target each domain controller to ensure a comprehensive breach. However, the attack's effect is temporary, as restarting the domain controller eradicates the malware, necessitating a reimplementation for sustained access.
Executing the attack requires a single command: misc::skeleton.
Attacker must have obtained Domain Admin rights
Mimikatz running on a Domain Controller
For most effective use all Domain Controllers will need to be exploited however, this is not a hard requirement
Rebooting a Domain Controller will remove the malware
After Mimikatz has been dropped onto a Domain Controller and executed with Domain Admin privileges the following simple command can be used to perform the exploit.