I have a Windows PC (Windows 7/Windows 10, no additional defenses/mitigations in place) that I've created a local administrator account on after 'konbooting' or similar and logged on with. This account is called 'FakeAdmin'

'FakeAdmin' has the same permissions as the real admin account 'RealAdmin' but real admin is installed domain wide (as is usually the case). Now I can recover the local hashes for RealAdmin and FakeAdmin easily enough, and I can use those to perform pass-the-hash attacks as well to gain execution on other machines.

However, if I try to use mimikatz on any machine I log in to with 'RealAdmin' while using the hash, it fails to give me plaintext credentials (as I obviously didn't use them to log in, they aren't stored in memory).

My question is, is it possible to recover local administrator credentials/decode easily from memory after performing a successful pass-the-hash attack on a computer?

Searching for this turns up largely irrelevant results so any help would be much appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.