Dumping Hashes With Mimikatz
Mimikatz
Mimikatzis a Windows post-exploitation tool written by Benjamin Delpy (@gentilkiwi). It allows for the extraction of clear-text passwords, hashes and Kerberos tickets from memory.The SAM (Security Account Manager) database, is a database file on Windows systems that stores hashed user passwords.
Mimikatz can be used to extract hashes from the lsass.exe process memory where hashes are cached.
We can utilize the pre-compiled mimikatz executable, alternatively, if we have access to a meterpreter session on a Windows target, we can utilize the inbuilt meterpreter extension Kiwi.
Attack Flow for Dumping Hashes With Mimikatz - Exploiting BadBlue
1. Initial Reconnaissance
Objective: Identify vulnerable services running on the target server.
Tool: nmap
Command:
Description: Scan port 80 to find the BadBlue service running on the server.
2. Exploit BadBlue Vulnerability
Objective: Exploit the vulnerability in the BadBlue service.
Tool: msfconsole
Module: badblue_passthru
Commands:
Description: Use the badblue_passthru module to exploit the BadBlue vulnerability and gain initial access.
3. Shell Migration
Objective: Migrate from a 32-bit process to a 64-bit process for better stability and functionality.
Tool: meterpreter
Command:
Description: Migrate the Meterpreter session to a 64-bit process.
4. Load Mimikatz and Extract Credentials
Objective: Use Mimikatz to gather credentials from the compromised server.
Tool: Mimikatz
Commands:
Load Mimikatz:
Retrieve All Credentials:
Dump SAM Database:
Dump Secrets:
Description: Use Mimikatz to extract stored passwords, hashes, and secrets from the system.
5. Upload Mimikatz (If Not Already Present)
Objective: If Mimikatz is not on the target system, upload it.
Tool: meterpreter
Command:
Description: Upload the Mimikatz executable to the victim server.
6. Check User Privileges
Objective: Assess the level of access on the target system.
Tool: Mimikatz
Commands:
Description: Check for debugging privileges.
7. Dump Password Hashes
Objective: Extract password hashes from the system.
Tool: Mimikatz
Command:
Description: Dump user password hashes from the SAM database.
8. Extract Plaintext Passwords
Objective: Retrieve plaintext passwords from memory.
Tool: Mimikatz
Command:
Description: Extract plaintext passwords from LSASS process memory.
9. Additional Commands
To Dump Password Hashes:
Description: Extract password hashes from the system.
Hacker's Mantra:If you wanna know how not secure you are, just take a look around. Nothing’s secure. Nothing’s safe. I don’t hate technology, I don’t hate hackers, because that’s just what comes with it, without those hackers, we wouldn’t solve the problems we need to solve, especially security. - Fred Durst
Last updated
Was this helpful?