Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mimikatz]

mimikatz is a tool for exploring Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.

3
votes
0answers
60 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
2answers
24 views

Convert ntlm to aes256 in sekurlsa::pth

In mimikatz, sekurlsa::pth also supports /aes256 switch. But where how can I get the aes256 hash? I can retrieve NTLM hash from many different tools, is there any way to convert it to a aes256 one?
0
votes
0answers
76 views

Extracting clear text password using Mimikatz and DCSync

I have a AD domain and the passwords are stored using the reversible encryption. I am using the Mimikatz tool with lsadump::dcsync /domain:xxx.com /user:<name> to retrieve the clear text ...
0
votes
0answers
26 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
3
votes
1answer
3k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with "...
5
votes
2answers
627 views

Are we safe from infection of Bad Rabbit?

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
4
votes
1answer
413 views

Inject hash into sam file. Is possible?

I have a very uncommon scenario. I have a Windows 10 laptop with a specific configuration. On that configuration there is a user (local user, not domain user) which I don't know its password. I want ...