Penetration testing

Mimikatz: Walkthrough [updated 2019]

Security researchers have been obsessed with Windows security since the beginning of time. Various tools have been released over the years which try to weaken the security/bypass it in some way or the other. Mimikatz is a tool written in `C` as an attempt to play with Windows security. Its primary function is to gather credentials of a Windows machine. Mimikatz is available for both 32-bit as well as for 64-bit Windows machines.

During a pentest, it is considered to be a post-exploitation tool. It can perform various credential gathering techniques such as:

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

• Pass the Hash
• Pass the Ticket
• Over-Pass the Hash (Pass the Key)
• Kerberos Golden Ticket
• Kerberos Silver Ticket
• Pass the Cache
• Attacking the Kerberos Session Ticket

Developed by Benjamin Delpy, the official GitHub repository can be found at https://github.com/gentilkiwi/mimikatz. Delpy gives us the option to directly download the binaries at https://github.com/gentilkiwi/mimikatz/releases or build our own using Microsoft Visual Studio 2010, 2012, or 2013.

To synchronize with the latest updates, the following links are helpful:

• GIT URL: https://github.com/gentilkiwi/mimikatz.git
• ZIP file URL: https://github.com/gentilkiwi/mimikatz/archive/master.zip

Offensive Security has already integrated the version 1 of Mimikatz as a meterpreter script which allows easy access to its complete feature set without the hassle of the attacker uploading scripts to the target machine. However, the latest version of Mimikatz (v2) can be found at the links mentioned above.

Dumping clear text credentials

Once downloaded/built, run Mimikatz as an administrator. Depending on the Windows machine you are using (32-bit or 64-bit), run Mimikatz accordingly. This is what it will look like when it starts:

Before we start dumping passwords, we need to start the logging process and debug privilege. To start the logging process, we simply write 'log.'

The file Mimikatz.log will be created, when running the first time, and all Input/output communication would be stored in it for future reference. Next, we debug privilege. To do that, simply write 'privilege::debug'. The debug privilege allows debugging a process that they normally wouldn't have access to.

Note: ERROR kuhl_m_privilege_simple; RtlAdjustPrivilege (20) c0000061 means that you do not have the require privilege to run the command. Try running Mimikatz as an administrator.

The 'version' command will tell us the details of the windows machine being used:

Typically, instructions are in the following format:

Modulename::commandName arguments

To check the clear text passwords 'sekurlsa::logonpasswords' command is used:

And there you have it, password in NTLM and clear text.

Mimikatz with Meterpreter

As stated earlier, Offensive Security has added v1 of Mimikatz as a meterpreter script with easy access to all its features. Let us see how it works. We start by loading Mimikatz in meterpreter by running the following command: "load mimikatz."

It is imperative to know here that we should run this command only when we have the Administrator privileges. Once loaded, we can start by checking the version and to confirm that mimikatz has been loaded successfully. We can do that with the following command: "mimikatz_command –f version":

Next, we can try running the "msv" command to see if we get anything:

We can see that we are provided with the LM and NTLM hashes but not with a clear text password. We can now run "mimikatz_command –f samdump::hashes" to see what it returns:

Followed by running "mimikatz_command –f sekurlsa::searchPasswords":

which returns the password in clear text.

Another module of Mimikatz is called the Service module. This module helps us to list, start, stop, or remove services running on the machine:

"mimikatz_command –f service::"

As we can see that this command lists all the services that are currently running.

Another module of Mimikatz is called the Crypto module. This module helps us to list and export any certificates and their corresponding private keys that may be stored on the compromised machine. This is possible even if they are marked as non-exportable.

Uncovering mines in Minesweeper

Mimikatz's another great module helps you read the location of the mines straight from memory. Never lose a game again! It is worth noting that the command works once you start the game.

Simply type: "minesweeper::infos":

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Conclusion

Mimikatz is a great post-exploitation tool which provides a bunch of useful features that otherwise may require two-three different tools. Though a lot of syntax changes have been done in v2, the learning curve is not steep at all.