Mimikatz Usage

Introduction

After running Mimikatz, we can interact wth it through its CLI. Each command consists of a module and a command delimited by two colons, for example, privilege::debug.

We can use various commands to extract passwords from the system. One of the most common Mimikatz commands is sekurlsa::logonpasswords

Dumping NTLM hashes with Mimikatz

Using the sekurlsa module, we can attempt to extract plaintext passwords and password hashes from all available sources using:

sekurlsa::logonpasswords

We can also extract all NTLM hashes from the SAM using 

lsadump::sam

For this command, we must first enter 

token::elevate

to elevate to SYSTEM user privileges and we will need to SeDebugPrivilege access right enable, which can be accomplished using:

privilege::debug

Dumping LSASS Password Hashes

Start mimikatz and enter privilege::debug to engage the SeDebugPrivilege privilege, which allows us to interact with a process owned by another user:

PS C:\Windows\system32> cd C:\Tools

PS C:\Tools\> .\mimikatz.exe
...

mimikatz # privilege::debug
Privilege '20' OK

Next run sekurlsa::logonpasswords to dump the credentionals of all logged-on users with the Sekurlsa module.

Exploiting Kerberos TGT and Service Tickets

A different approach from dumping NTLM hashes and trying to crack them would be to use Mimikatz to exploit Kerberos authentication by using TGT and service tickets. Kerberos TGT and service tickets for users currently logged on to the local machine are stored for future use. These tickets are also stored in LSASS, and we can use Mimikatz to interact with and retrieve our own tickets as well as the tickets of other local users.

Cache a Service Ticket

Once the directory listing has been executed on the SMB share, we can use Mimikatz to show the tickets that are stored in memory by using sekurlsa::tickets

The output contains both a TGT and a TGS. Stealing the TGS would allow us to access only particular resources associated with those tickets. Alternatively, armed with a TGT, we could request a TGS for specific resources we want to target within the domain.

PreviousDetecting Offensive PowerShell ToolsNextTechniques

Last updated