‫So here's Incognito, which was originally a standalone application that allowed you to impersonate
‫user tokens when successfully compromising a system.
‫This was integrated into Métis Point and ultimately into interpretor.
‫Tokens are temporary key that allows you to access the system and network without having to provide
‫credentials each time you access a file.
‫Incognito exploits tokens by replaying that temporary key when asked to authenticate.
‫And there are two types of tokens, delegate and impersonate delegate tokens are created for interactive
‫log-on, such as logging into the machine or connecting to it via remote desktop.
‫Impersonate tokens are for non interactive sessions, such as attaching a network drive or a domain
‫log on script.
‫One great thing about tokens is they persist until a reboot when a user logs off, their delegate token
‫is reported as an impersonate token but will still hold all the rights of a delegate token.
‫And once you have a interpreter session, you can impersonate valid tokens on the system and become
‫that specific user without ever having to worry about credentials or for that matter, even hashes.
‫During a penetration test, this is especially useful due to the fact that tokens have the possibility
‫of allowing local and or domain privilege escalation, enabling you alternate avenues with potentially
‫elevated privileges to multiple systems.
‫So here we are in a metaphorical session in Colly session is on Windows XP, victim incognito module
‫is not loaded by the phone, so type loaded incognito to load it, help incognito to list a variety
‫of options we have for Incognito and brief descriptions of each option.
‫And what we will need to do first is identify if there are any valid tokens on this system, so we'll
‫use the list tokens command to list the tokens.
‫Well, let's use it with you parameter.
‫Let's impersonate the administrator using impersonate token.
‫Now, don't forget to put a double backslash.
‫And after successfully impersonating a token, we check our current user I.D. by executing the get UID
‫command.
‫Now open a shell on the victim and look at who we are with the who am I command?
‫Well, now we have another method to see who we are through the environmental variables, echo user
‫domain, user name.
‫We are administrator, user on the CEO XP system now control see to terminate the Shell command.
‫Now I will use the Rev to self-command to be the system user again.
‫To get you I.D. to check it.
‫OK, so we are the system user again, so now I'll open the shell again and look who I am once more.
‫Well, the system user looks just like this.