Edit

Mimikatz

Tables of Contents

Run

./mimikatz.exe

  • Ensure that the output is "Privilege '20' ok" - This ensures that you're running mimikatz as an administrator.

  • If you don't run mimikatz as an administrator, mimikatz will not run properly

Dump hashes

Mimikatz .kirbi extraction

Carve Tickets out of LSASS Memory

  • Mimikatz can carve tickets directly out of LSASS memory

Crack with hashcat

Golden Ticket

  • Again using the mimikatz as the previous task; however, this time we'll be using it to create a golden ticket.

  • We will first dump the hash and sid of the krbtgt user then create a golden ticket and use that golden ticket to open up a new command prompt allowing us to access any machine on the network.

  • This dumps the hash and security identifier of the Kerberos Ticket Granting Ticket account allowing you to create a golden ticket

  • Output should look like this:

Create the Golden Ticket

  • You will need the:

  • Domain SID (S-1-5-21-849420856-2351964222-986696166)

  • USER (krbtgt)

  • NTLM (5508500012cc005cf7082a9a89ebdfd)

  • Create a Golden Ticket

  • To create a golden ticket based on the output above we would use:

  • Output should look like this:

Use the Ticket

  • Use the Golden Ticket to access other machines:

  • This will open a new command prompt with elevated privlages to all machines

  • Access other Machines! - You will now have another command prompt with access to all other machines on the network

DPAPI

  • See blog post

PreviousLinux BasicsNextnetcat

Last updated