Mimikatz

Mimikatz is a Windows application that allows you to retrieve valid passwords from a hibernation file or RAM dump. A list of active users is displayed, and it is possible to retrieve keys in plain text. Administrator rights are required to access all functions.

Principle of operation

To protect passwords, Windows stores them in encrypted form. The complexity of the algorithm practically eliminates the possibility of picking up the password with the help of a classic bruteforce. However, some services use the key in clear form during their work. This feature is used by the application to access the password. The vulnerability makes it possible to extract the required area without complex manipulations and immediately get the information in clear form. At the same time, there is no need to use complex calculations.

Password interception

After downloading the application to your PC, open the directory and select the executable file according to the system bitness. It is necessary to run it as an administrator. Then in a special window enter the command "privilege::debug", then "sekurlsa::logonPasswords full". As an answer, a list of active users will be displayed, next to each will be the corresponding password. To capture the key that is in the memory dump you should use PowerShell application. After launching the terminal, you must enter the construct "Get-Process lsass | Out-Minidump". This will initiate the saving of an image with the DMP extension in the system directory. This file should be transferred to another PC and use the command "sekurlsa::minidump", the correct dump name should be specified as an argument. At the last step you need to enter the command "sekurlsa::logonPasswords", which will display a set of logins and passwords.

Features

• the application allows you to retrieve passwords of active users;
• memory dump is used to retrieve keys;
• peculiarities of some Windows components are used;
• DMP image file is used as an intermediate result;
• administrator rights are required to work;
• the program can be downloaded for free.