Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mimikatz]

mimikatz is a tool for exploring Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.

1
vote
0answers
25 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
0
votes
0answers
33 views

How does the so-called skeleton key (master password) in Mimikatz work?

I've used Mimikatz to patch the domain controller with a skeleton key misc::skeleton, which makes it possible for any domain user to authenticate with the password "mimikatz", while still being able ...
4
votes
1answer
103 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
2answers
36 views

Convert ntlm to aes256 in sekurlsa::pth

In mimikatz, sekurlsa::pth also supports /aes256 switch. But where how can I get the aes256 hash? I can retrieve NTLM hash from many different tools, is there any way to convert it to a aes256 one?
0
votes
0answers
155 views

Extracting clear text password using Mimikatz and DCSync

I have a AD domain and the passwords are stored using the reversible encryption. I am using the Mimikatz tool with lsadump::dcsync /domain:xxx.com /user:<name> to retrieve the clear text ...
0
votes
0answers
35 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
3
votes
1answer
4k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with "...
5
votes
2answers
628 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
4
votes
1answer
448 views

Inject hash into sam file. Is possible?

I have a very uncommon scenario. I have a Windows 10 laptop with a specific configuration. On that configuration there is a user (local user, not domain user) which I don't know its password. I want ...