There may be times when you do not have Mimikatz
installed on a victim's machine.
In these cases,
you might need to use one of the many ways available to
create a memory dump of the LSASS process,
exfiltrate the file,
and then open it with Mimikatz running on a computer that you fully control.
Please note that you need to use the same platform when
you're trying to read these files in Mimikatz.
In this demonstration,
I will leverage the Task Manager to dump the LSASS process memory into a file.
I will then open that file with Mimikatz and use the
logonpasswords command to pull the information out.
All right,
so what about a situation to where you possibly cannot
run Mimikatz on a target system, but you have your own Windows 10 running,
maybe a 64‑bit Windows 10 instance, and you have full access to that one,
and you're pretty sure that you can exfiltrate some data?
Well, you can use the Task Manager,
and then go to the Local Security Authority Process,
and you can create a dump file.
So let's go ahead and do that, and the file is located right here.
So I'm going to copy this.
Okay, then we'll go ahead and exit out of here.
Run Mimikatz as administrator.
Maximize the screen here.
And typically you would be running the commands for Mimikatz on
the system that you have full control of,
which you had exfiltrated the file to.
In this case, we're going to leverage Minidump to read this file.
There we go.
And you'll notice that it says Switch to MINIDUMP,
and it tells you which file,
and then you can run the commands that you need to run.
So we'll simply use logonpasswords, and we'll scroll all the way to the top here.
And you can see that as the command was run,
Mimikatz opened the
C:\Users\LEE~1.GLO\AppData\Local\Temp\lsass file that we
created.
So this could have been on your own system,
and it would have been able to get all of the information that
had clear text passwords currently in memory.