Questions tagged [mimikatz]
mimikatz is a tool for exploring Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.
21
questions
0
votes
0
answers
4k
views
Decrypting Browser Cookies
So I am trying to write my own backdoor with python and it is something like Metaploit, where you can run a single command and it would do the work for you, so I am trying to implement a cookie ...
1
vote
1
answer
1k
views
Why do I see LM hashes stored in Active Directory?
I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command:
lsadump::dcsync /user:mimikatz
The user's password is Pa55w.rd.
The output is
...
Credentials:...
- 364
0
votes
0
answers
2k
views
ERROR kuhl_sekurlsa_acquireLSA from customized mimikatz
Tried to call sekurlsa::logonpasswords function from mimikatz main source, but I get ERROR hl_aaaurlsa_acquireLSA ; Logon list
The program is executed with Administrator cred and I'm sure there's no ...
- 1
3
votes
0
answers
341
views
Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?
When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
4
votes
3
answers
12k
views
What can prevent Mimikatz from accessing LSA?
I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.
.#####. mimikatz 2.2.0 (x64) #...
- 506
3
votes
1
answer
1k
views
Kerberos golden ticket works with DNS only - access denied with IP address
I'm playing with mimikatz kerberos::golden, e.g.,
kerberos::golden /domain:XXX /sid:XXX /user:XXX /aes256:XXX /endin:864000 /renewmax:10240 /ptt
Then I tried to access a domain joined machine, but I ...
- 2,077
4
votes
0
answers
1k
views
How does local pass-the-hash (mimikatz's sekurlsa::pth) work?
Mimikatz's sekurlsa::pth documentation states:
mimikatz can perform the well-known operation 'Pass-The-Hash' to run a
process under another credentials with NTLM hash of the user's
password, instead ...
- 105
1
vote
1
answer
707
views
Windows 10 master key folder empty
I am currently trying to decrypt my files from my old laptop. I have a backup of the user folder of the old laptop and I am trying to find the old user master key to decrypt my files based on mimikatz ...
- 21
1
vote
1
answer
389
views
Is kerberos unconstrained delegation partially safer than constrained delegation?
When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
- 181
0
votes
0
answers
188
views
Searching a drive for a specific malicious exe? [duplicate]
I am completing some online labs for a cyber security course. We are meant to do specific tasks.
For this task we have a compromised virtual machine in an activity titled "compromised host" .
"The ...
- 21
1
vote
0
answers
2k
views
Finding a mimikatz file on a compromised host? [closed]
So I am currently struggling with a cyber security lab, and after searching various online sources and reading documentation I can't find a solution. The 2 tasks are as follows:
"The attacker has ...
- 21
1
vote
0
answers
452
views
Decrypt DPAPI blob offline
mimikatz can decrypt DPAPI with masterkey:
dpapi::blob /in:"test" /masterkey:X /unprotectXXX
How can I dump the masterkey and do the decrypt job offline?
- 2,077
0
votes
1
answer
328
views
Blocking mimikatz on the OS level?
I want to know under which case would Mimikatz still run despite disabling WDigest?
Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012)
Is there a better way to ...
- 1
4
votes
1
answer
506
views
Active Directory Server and Mimikatz
Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
- 395
1
vote
0
answers
158
views
Questions regarding pass the ticket
In the blackhat talk by Gentikwiki on Mimikatz back in 2014,
he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied.
Passing the ...
- 51
1
vote
0
answers
742
views
How does the so-called skeleton key (master password) in Mimikatz work?
I've used Mimikatz to patch the domain controller with a skeleton key misc::skeleton, which makes it possible for any domain user to authenticate with the password "mimikatz", while still being able ...
- 1,277
6
votes
1
answer
2k
views
Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?
Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?
Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
- 1,277
0
votes
2
answers
2k
views
Convert ntlm to aes256 in sekurlsa::pth
In mimikatz, sekurlsa::pth also supports /aes256 switch. But how can I get the aes256 hash?
I can retrieve NTLM hash from many different tools. Is there any way to convert it to an aes256 one?
- 2,077
0
votes
1
answer
2k
views
Mimikatz /rc4 argument for pass-the-ticket?
I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets.
The command usually takes the form (Golden tickets):
kerberos::golden /sid:SID /domain:DOMAIN /...
- 1,277
7
votes
1
answer
29k
views
Decrypting SAM hive after Windows 10 anniversary update?
After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.
In particular, samdump2 decrypted the SAM hive into a list of users with &...
- 1,277
5
votes
2
answers
715
views
Are we safe from infection of Bad Rabbit?
I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say ...
- 739