mimikatz使用方法

最新推荐文章于 2025-03-17 20:00:16 发布

TYW----子曰小玖

最新推荐文章于 2025-03-17 20:00:16 发布

阅读量2.3k

点赞数

分类专栏： mimikatz

本文链接：https://blog.csdn.net/wxh0000mm/article/details/105842998

版权

mimikatz 专栏收录该内容

7 篇文章

订阅专栏

Home

gentilkiwi edited this page on 8 Sep 2014 · 36 revisions

mimikatz is a tool I've made to learn C and make somes experiments with Windows security.

It's well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory.
mimikatz can also perform pass-the-hash, pass-the-ticket, build Golden tickets, play with certificates or private keys, vault, ... maybe make coffee?

Its symbol/icon is a kiwi, sometimes the animal, but mostly the fruit!

  .#####.   mimikatz 2.0 alpha (x64) release "Kiwi en C" (Apr 26 2014 00:25:11)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'                                    with  14 modules * * */

How can you get it?

sources (Visual Studio solution) on GitHub/mimikatz - see GitHub/mimikatz/README # build
binaries are availables on GitHub/mimikatz/releases

Basics

mimikatz comes in two flavors: x64 or Win32, depending on your windows version (32/64 bits).
Win32 flavor cannot access 64 bits process memory (like lsass), but can open 32 bits minidump under Windows 64 bits.
Some operations need administrator privileges, or SYSTEM token, so be aware of UAC from Vista version.

After launching mimikatz:

  .#####.   mimikatz 2.0 alpha (x64) release "Kiwi en C" (Apr 26 2014 00:25:11)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'                                    with  14 modules * * */


mimikatz #

... you have the command prompt mimikatz #, you can type instructions like exit, cls, crypto::certificates

Instructions can be in the form: modulename::commandname arguments..., eg:

kerberos::tgt
crypto::certificates /systemstore:local_machine /store:my /export
cls

see Module section below for others.
commands from standard module can be typed without modulename; cls is the same as standard::cls (see module ~ standard)

You can quit mimikatz with exit command.
For remote execution, see howto ~ remote execution

Command line

You can pass instructions on mimikatz command line, those with arguments/spaces must be quoted.

C:\security\mimikatz\x64>mimikatz log version "crypto::certificates /systemstore:local_machine" exit

  .#####.   mimikatz 2.0 alpha (x64) release "Kiwi en C" (Apr 26 2014 00:25:11)
 .## ^ ##.
 ## / \ ##  /* * *
 ## \ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)
  '#####'                                    with  14 modules * * */


mimikatz(commandline) # log
Using 'mimikatz.log' for logfile : OK

mimikatz(commandline) # version

mimikatz 2.0 alpha (arch x64)
NT     -  Windows NT 6.1 build 7601 (arch x64)

mimikatz(commandline) # crypto::certificates /systemstore:local_machine
 * System Store  : 'local_machine' (0x00020000)
 * Store         : 'My'

 0. example.nirvana.local
        Key Container  : example.nirvana.local
        Provider       : Microsoft Software Key Storage Provider
        Type           : CNG Key (0xffffffff)
        Exportable key : NO
        Key size       : 2048

mimikatz(commandline) # exit
Bye!

Instructions from command line are marked with (commandline) on the prompt.