Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mimikatz]

mimikatz is a tool for exploring Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.

0
votes
0answers
26 views

Recovering local administrator password after passing the hash

I have a Windows PC (Windows 7/Windows 10, no additional defenses/mitigations in place) that I've created a local administrator account on after 'konbooting' or similar and logged on with. This ...
0
votes
1answer
51 views

Obtaining plain-text passwords from a Domain Controller [on hold]

Is there anyway to log the plaintext passwords of accounts that authenticate against a domain controller? I know most of the Mimikatz attacks and they all recover credentials from memory, but they're ...
0
votes
0answers
17 views

Why lsadump is not working?

I have a shell with root privileges, and I invoke mimikatz in it by using load kiwi in meterpreter shell. Now the problem I have facing is, I can't get the positive results. When I run this lsadump::...
2
votes
0answers
34 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
1
vote
0answers
27 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
0
votes
0answers
61 views

How does the so-called skeleton key (master password) in Mimikatz work?

I've used Mimikatz to patch the domain controller with a skeleton key misc::skeleton, which makes it possible for any domain user to authenticate with the password "mimikatz", while still being able ...
4
votes
1answer
111 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
2answers
63 views

Convert ntlm to aes256 in sekurlsa::pth

In mimikatz, sekurlsa::pth also supports /aes256 switch. But where how can I get the aes256 hash? I can retrieve NTLM hash from many different tools, is there any way to convert it to a aes256 one?
0
votes
0answers
62 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
3
votes
1answer
5k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with "...
5
votes
2answers
628 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
5
votes
1answer
487 views

Inject hash into sam file. Is possible?

I have a very uncommon scenario. I have a Windows 10 laptop with a specific configuration. On that configuration there is a user (local user, not domain user) which I don't know its password. I want ...