Mimikatz: Beginner's Guide

Mimikatz is an open source application that allows users to view and store authentication credentials such as Kerberos tickets. Its toolset works with the current version of Windows and includes a collection of different network attacks to help assess vulnerabilities.

mimikatz3

Attackers commonly use Mimikatz for credential theft and privilege escalation because in most cases the protection as well as anti-virus systems will not detect or prevent the attack. Instead, penetration testers use Mimikatz to find and exploit vulnerabilities in your networks so you can fix them.

What can Mimikatz do?

mimikatz

Mimikatz first demonstrated how to exploit a unique vulnerability in the Windows authentication system. It now exposes many different kinds of vulnerabilities where it can perform credential harvesting techniques, including:

  • Pass-the-hash: Windows is used to store password data in NTLM hashes. Attackers use Mimikatz to get through this very thing hash string on the target computer to connect. Attackers don't even need to crack the password – they just need to use the hash string as it is.
  • Pass-the-ticket: Newer versions of Windows store the password data in a file called ticket. Mimikatz allows a user to pass a Kerberos ticket to another computer and connect with that user's ticket. It is similar to the pass-the-hash method.
  • Overpass-the-hash (pass-the-key): Another version of pass-the-hash, but this technique passes a unique key obtained from a domain controller to impersonate a user.
  • Kerberost golden tickets: This is a pass-the-ticket attack, but it is a specific ticket for one account called KRBTGT, which is the account that encrypts all other tickets. A golden ticket gives you unlimited administrator credentials for any computer on the network.
  • Kerberost silver tickets: Another pass-the-ticket, but a silver ticket takes advantage of a Windows feature that makes it easier for you to use services on the network. Kerberos grants a user a ticket-granting server (TGS) ticket, and the user can use this ticket to authenticate to service accounts on the network. Microsoft doesn't always audit a TGS after it's released, so it's easy to get around any safeguards.
  • Pass-the-cache: Finally an attack that doesn't exploit Windows! The pass-the-cache attack is generally the same as pass-the-ticket, but this one uses the cached and encrypted login data on a Mac/UNIX/Linux system.

Where can you download Mimikatz?

Download Mimikatz files and source code from GitHub by Benjamin Delpy. It offers various download options from executable to source code. You will need to compiles to Microsoft Visual Studio 2010 or some newer version.

How do you use Mimikatz?

Step 1: Run Mimikatz as administrator.

Mimikatz must be “run as administrator” to work properly, even if you are already using an administrator account.

Step 2: Check the version of Mimikatz.

There are two versions of Mimikatz:

  • 32bit
  • 64bit

Make sure you are running the correct version for your Windows installation. Run the “version” command to get information about the Mimikatz executable, Windows version, and if any of Windows that will prevent Mimikatz from running properly.

Step 3: Extract the “clear text passwords” from memory.

The securlsa module in Mimikatz allows you to dump passwords from memory. To use the sekurlsa module commands, you must have admin or SYSTEM privileges.

First, run the command:

mimikatz # privilege::debug

The output will show if you have the appropriate permissions to continue.

Then start logging operations so you can refer back to your work.

mimikatz # log nameoflog.log

And finally, export all clear text passwords stored on this computer.

mimikatz # sekurlsa::logonpasswords

Using other Mimikatz modules

The crypto module allows you to access the CryptoAPI on Windows, which allows you to list and export certificates and their private keys, even if they are marked as non-exportable.

The Kerberos module accesses the Kerberos API so you can play with this functionality by exporting and manipulating Kerberos tickets.

The service section allows you to start, stop, disable, etc. Windows services.

And finally, the coffee command returns an ASCII art of coffee. Because we all need more coffee :D

How to defend against Mimikatz?

mimikatz1

Defending against Mimikatz can be difficult because in order for an attacker to execute it, they have already gained root access to a Windows machine. Often you may only be limiting the damage the attacker has already done. Here are some of the ways you can defend against Mimikatz attacks.

  • Restrict admin privileges. This can be done by restricting administrator privileges to only the users who need them.
  • Disable password-caching. Windows stores the password hashes of access used through y system. Mimikatz can then access these saved passwords, so it's important to change your default settings to cache recent passwords. This can be accessed through Settings Windows Settings > Local Policy > Security Options > Interactive Logon.
  • Turn off debug privileges. Windows default settings allow administrators to debug the system, which Mimikatz can exploit. Disabling debugging privileges on machines is a best practice to protect your system.
  • Configure additional local security authority (LSA) protection. Upgrading to Windows 11 can help mitigate the types of authentication attacks enabled by Mimikatz. However, when this is not possible, Microsoft provides additional LSA configuration elements that help reduce the attack surface.

Even with everything summarized in this article, there is so much more to know and learn about Mimikatz. In future guides we will look in detail at all forms of attacks with Mimikatz.

iGuRu.gr The Best Technology Site in Greecefgns

every publication, directly to your inbox

Join the 2.100 registrants.
Mimikatz,mimikatz github,mimikatz logonpasswords,mimikatz download,mimikatz for linux

Written by Anastasis Vasileiadis

Translations are like women. When they are beautiful they are not faithful and when they are faithful they are not beautiful.

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).