In this demonstration,
we begin with the functionality that Mimikatz is best known for,
credential dumping.
Every time an active login session is established,
the local security authority subsystem service,
LSASS, will store the credentials being used in the system's memory.
An active login session could be established in several ways,
including logging in locally,
remoting into a system using the remote desktop protocol, and
then using disconnect instead of logging off,
using the run‑as command, setting up scheduled tasks that use credentials,
and various other tools that would allow for remote administration capabilities.
The demonstration is performed on a fully patched Windows 10 system
that's been joined to the globomantics.lab1 domain.
In order to see clear text passwords,
we're going to have to start out by making some minor
modifications to the registry so that we can then use
UseLogonCredential and set it to enabled.
This may require elevated privileges,
which should not be a problem as usually by the time
you're already using Mimikatz on a system,
you would have gained admin level access to the machine anyhow. We're
going to start out by creating a few logon sessions,
one for a user named amy.miles and one by a domain
administrator that's going to remote into the machine. We'll
continue by covering some basic commands,
such as privilege::debug, log, sekurlsa::logonpasswords so that we can create
a log file containing the hashes and clear text passwords for any currently
active login sessions that have been established.
So here we have a Windows 10 system that's been fully patched and updated,
and I've downloaded Mimikatz to this system.
I am running as administrator,
and that's pretty much recommended. Whenever you're using the Mimikatz,
you should have some type of an elevated privilege.
There are tools available in Mimikatz that do not require elevated privilege,
but for most of them, you probably will need to have that.
So let's go ahead and run Mimikatz here as administrator,
and I'm going to start out with the most common command that
you're probably going to use privilege::debug to make sure that
you have the proper access level and we do, privilege 20 OK, if
you got an error message here,
you probably have some other issues going on, and we're
going to try to just see if we can pull the login passwords
so sekurlsa : : logonpasswords,
and we'll scroll up here, and we have interactive from 1 lee Globomantics with
the logon server of DC01, and if you take a look at wdigest,
you'll see it has username and domain,
but the password is listed as null, same with kerberos.
So by default, Windows 10 is not going to display clear text passwords here,
so we need to change a register key, so let's go
ahead and do that, and in your case,
you may even need to add this. Odds are it's not going to exist,
so run regedit and you'll want to go to Computer\HKEY_LOCAL_MACHINE\
SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest and there
you'll need to create a key, if one doesn't already exist, for use logon
credential and you'll want to set this as 1.
After that, you're going to have to reboot,
so I'll go ahead and take care of that right now, and we're back,
so I'll go ahead and log in, and let's go ahead and try this again.
We've got our privilege : : debug and it says that we've got Privilege 20 OK,
sekurlsa : : logon passwords, and we'll have to scroll up
again and here we have lee Interactive from 1, and if you
look down where it says wdigest,
you now have username lee domain GLOBOMANTICS and password,
p@ssword! in clear text. So scrolling down here, there are not any
interactive sessions that are already logged in so let's go ahead
and minimize this and create some.
We'll start out with a run as, so in this case,
I have to hold down Shift and right‑click, Run as a different user. We're
already Globomantics domain, so we'll log in as amy.miles,
which is a Globomantics user and have her run as a different user.
So this could be in a situation where possibly you trick
someone into installing something for you or somebody may
have done this already in the past.
There are various situations where a valid session could be established.
So now if we do a whoamI, we can see this is globomantics\amy.miles.
So let's take a look at me Mimikatz and see if we were
able to capture her credentials, clear the screen,
see who we are.
We're logged in as GLOBOMATICS\lee and we'll run sekurlsa :
: logonpasswords again, and scroll up.
And here we have Interactive from 0, amy.miles, and we can see she's logged
into the GLOBOMANTICS domain and her password is P@ssword123. So let's
imagine a situation to where we have an administrator that remotes into our
machine because they need to provide us with some support or for whatever
other reason that they might have.
So here, in a Windows 2016 Server,
I can establish a remote desktop connection to the
system that's been compromised.
Obviously, this is probably not going to happen very often.
Hopefully, your domain administrators aren't just randomly remoting into systems,
but I've seen stranger things,
so let's go ahead and connect. We'll click yes to the certificate error,
and in this case, we have an indicator, another user is logged in,
which we already knew that it would be me.
So I'm going to sign in anyways.
We'll typically have a timer if you do this so it's much quicker just to
swap back over in your lab and log off of the other user.
And now, we've logged into the system using RDP, in this case,
we would perform whatever activities we needed to and then often what you'll see
is somebody instead of signing out will simply disconnect.
So we'll do that and we're back over on our server.
So let's go ahead and have Lee log back into the Windows 10 machine, and
we'll minimize this here and we'll look at Mimikatz again, sekurlsa login
passwords, and we've got a lot of information here,
so it's starting to get a little clunky,
but we'll scroll up here and see if we can find
administrator and here we have Remote Interactive from 2
Administrator of GLOBOMANTICS domain,
and the password is P@ssword!. So you can actually log this stuff
to a file, just use log and then the file name,
so we'll want to know where we're actually keeping this file at,
so go to cd c:\users\lee.globomantics\desktop,
and there we go, we can list the directory.
And that's not one of our standard commands.
So, luckily,
Mimikatz will show you what some of the standard commands could
have been. So this is important if you're trying to find out more
about a specific command, in this case,
we have host name here, we can do that, WIN10A globomantics.lab1, and we're
going to log a file and it's going to be mimilog.text.
And from now on,
everything that we type into Mimikatz will be logged so we can go back up and
do sekurlsa : : logonpasswords, and if we minimize this,
we now have mimilog on the desktop, and we could just use find.
There is Administrator and amy.miles, and, of course, lee.