Dumping Hashes With Mimikatz
Last updated
Was this helpful?
Last updated
Was this helpful?
is a Windows post-exploitation tool written by Benjamin Delpy (). It allows for the extraction of clear-text passwords, hashes and Kerberos tickets from memory.
The SAM (Security Account Manager) database, is a database file on Windows systems that stores hashed user passwords.
Mimikatz can be used to extract hashes from the lsass.exe process memory where hashes are cached.
We can utilize the pre-compiled mimikatz executable, alternatively, if we have access to a meterpreter session on a Windows target, we can utilize the inbuilt meterpreter extension Kiwi.
Objective: Identify vulnerable services running on the target server.
Tool: nmap
Command:
Description: Scan port 80 to find the BadBlue service running on the server.
Objective: Exploit the vulnerability in the BadBlue service.
Tool: msfconsole
Module: badblue_passthru
Commands:
Description: Use the badblue_passthru module to exploit the BadBlue vulnerability and gain initial access.
Objective: Migrate from a 32-bit process to a 64-bit process for better stability and functionality.
Tool: meterpreter
Command:
Description: Migrate the Meterpreter session to a 64-bit process.
Objective: Use Mimikatz to gather credentials from the compromised server.
Tool: Mimikatz
Commands:
Load Mimikatz:
Retrieve All Credentials:
Dump SAM Database:
Dump Secrets:
Description: Use Mimikatz to extract stored passwords, hashes, and secrets from the system.
Objective: If Mimikatz is not on the target system, upload it.
Tool: meterpreter
Command:
Description: Upload the Mimikatz executable to the victim server.
Objective: Assess the level of access on the target system.
Tool: Mimikatz
Commands:
Description: Check for debugging privileges.
Objective: Extract password hashes from the system.
Tool: Mimikatz
Command:
Description: Dump user password hashes from the SAM database.
Objective: Retrieve plaintext passwords from memory.
Tool: Mimikatz
Command:
Description: Extract plaintext passwords from LSASS process memory.
To Dump Password Hashes:
Description: Extract password hashes from the system.
Hacker's Mantra:If you wanna know how not secure you are, just take a look around. Nothing’s secure. Nothing’s safe. I don’t hate technology, I don’t hate hackers, because that’s just what comes with it, without those hackers, we wouldn’t solve the problems we need to solve, especially security. - Fred Durst