Commentaires sur : mimikatz

Bonjour

Je créé un minidump via le taskmanager et voici ce que j’obtiens aprés sur la même machine …. Merci de m’éclairer ;-)

  .#####.   mimikatz 2.0 alpha (x86) release "Kiwi en C" (Oct 31 2014 13:30:06)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'    Microsoft BlueHat edition!       with 14 modules * * */


mimikatz # sekurlsa::minidump c:\temp\lsass.dmp
Switch to MINIDUMP : 'c:\temp\lsass.dmp'

mimikatz # sekurlsa::logonPasswords full
Opening : 'c:\temp\lsass.dmp' file for minidump...
ERROR kuhl_m_sekurlsa_acquireLSA ; Minidump pInfos->ProcessorArchitecture (9) != PROCESSOR_ARCHITECTURE_INTEL (0)

C’est pourtant marqué : https://github.com/gentilkiwi/mimikatz/wiki/module-~-sekurlsa#minidump
Tu veux utiliser le minidump avec une version de mimikatz différente de celle de l’architecture d’origine.
(tu as fait ton dump sous un Windows x64, utilise mimikatz x64)

Merci de ta réponse, Quoiqu’il en soit BRAVO pour ton travail, je pense que mon Pb vient du fait de la compilation sous VS 2013 qui est peut être par défaut en 32 bits….

[…] ProcDump // Windows Sysinternals – here Mimikatz // Blog de Gentil Kiwi – here The Volatility Foundation // Homepage – here Vmss2core // VMWare Labs – here VMware […]

[…] 鸟人博客 […]

[…] in Las Vegas, NV in early August, Skip Duckwell & Benjamin Delpy spoke about a method (using mimikatz) to generate your own kerberos tickets (aka the Golden Ticket). Key to this is that you need the […]

Fantastic tool…. How would i be able to invoke the DLL to call and return the vales from c# any ideas???

[…] tools such as Metasploit (an attack toolkit that includes a backdoor named Meterpreter) and Mimikatz (a password dumper) worked well, but I was a paranoid attacker and was worried that running these […]

[…] Active Directory domain’s KRBTGT password hash (typically dumped from a Domain Controller). Mimikatz (English translated site) fully supports generating Golden […]

[…] or secrets, as well as to create tokens based on those hashes. Additionally, researchers such as Gentil Kiwi have even discovered that LSASS contains plain-text passwords using reversible symmetric […]

Hi
i have a win8 laptop and passwords is not showing no more just the ntlm hash
no plain text password

[…] this TGT has an invalid PAC signature since the DC didn’t generate it! Benjamin Delpy’s Mimikatz presentation at Passwords 2014 describes the MS14-068 exploit (slide below extracted from his […]

[…] )) не мог до сих пор. Сегодня наткнулся на программу mimikatz, с которой легко можно узнать пасс админа )) как-то […]

[…] 下载地址：http://blog.gentilkiwi.com/mimikatz 本站备份：mimikatz 国人编译版本：GetPassword_x64 […]

[…] v ##’ http://blog.gentilkiwi.com/mimikatz […]

La commande : sekurlsa::longonpasswords a comme résultat: ERROR mimikatz_doLocal ; « logonPasswords » command of « sekurlsa » module not found!

« longonpasswords »

[…] implanting the skeleton key remotely using Mimikatz the following events are logged on the Domain Controller. Event Id 4673 Sensitive Privilege […]

When i attempt to load the CNG service on Windows 8.1, i get a nice error.

ERROR kull_m_patch_genericProcessOrServiceFromBuild ; kull_m_patch (0x00000000)

I’ve got no AV running, or anything. Any ideas?

Already patched =) (or last patch did not work :()

Par : Liryc

Par : gentilkiwi

Par : Liryc

Par : How Attackers Extract Credentials (Hashes) From LSASS » AD Security

Par : mimikatz | H!Ang Blog（￣▽￣）～■

Par : KRBTGT: Active Directory’s Domain Kerberos Account » AD Security

Par : Jeff

Par : Owning Networks and Evading Incident Response with PowerShell » Active Directory Security

Par : MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege » Active Directory Security

Par : The Evolution of Protected Processes Part 1: Pass-the-Hash Mitigations in Windows 8.1 » Active Directory Security

Par : D

Par : Exploiting MS14-068 Vulnerable Domain Controllers Successfully with the Python Kerberos Exploitation Kit (PyKEK) » Active Directory Security

Par : День взлома публичных терминалов. |Бредоблог

Par : 抓取windows密码的神器mimikatz | linux爱好者

Par : 12 Days of HaXmas: MS14-068, now in Metasploit! | IT Security News

Par : maurice

Par : gentilkiwi

Par : Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest » Active Directory Security

Par : Ian

Par : gentilkiwi