WEBVTT

00:00:01.440 --> 00:00:03.490
There may be times when you do not have Mimikatz

00:00:03.490 --> 00:00:04.950
installed on a victim's machine.

00:00:05.540 --> 00:00:06.440
In these cases,

00:00:06.450 --> 00:00:09.050
you might need to use one of the many ways available to

00:00:09.050 --> 00:00:11.810
create a memory dump of the LSASS process,

00:00:11.820 --> 00:00:13.080
exfiltrate the file,

00:00:13.080 --> 00:00:17.630
and then open it with Mimikatz running on a computer that you fully control.

00:00:17.660 --> 00:00:20.610
Please note that you need to use the same platform when

00:00:20.610 --> 00:00:22.760
you're trying to read these files in Mimikatz.

00:00:22.840 --> 00:00:23.740
In this demonstration,

00:00:23.740 --> 00:00:29.310
I will leverage the Task Manager to dump the LSASS process memory into a file.

00:00:29.320 --> 00:00:31.730
I will then open that file with Mimikatz and use the

00:00:31.730 --> 00:00:34.670
logonpasswords command to pull the information out.

00:00:35.540 --> 00:00:35.810
All right,

00:00:35.810 --> 00:00:39.850
so what about a situation to where you possibly cannot

00:00:39.850 --> 00:00:44.510
run Mimikatz on a target system, but you have your own Windows 10 running,

00:00:44.520 --> 00:00:48.720
maybe a 64‑bit Windows 10 instance, and you have full access to that one,

00:00:48.730 --> 00:00:51.560
and you're pretty sure that you can exfiltrate some data?

00:00:52.240 --> 00:00:54.760
Well, you can use the Task Manager,

00:00:55.740 --> 00:00:58.730
and then go to the Local Security Authority Process,

00:00:59.540 --> 00:01:01.850
and you can create a dump file.

00:01:02.640 --> 00:01:07.350
So let's go ahead and do that, and the file is located right here.

00:01:07.350 --> 00:01:09.000
So I'm going to copy this.

00:01:12.040 --> 00:01:14.560
Okay, then we'll go ahead and exit out of here.

00:01:16.940 --> 00:01:19.770
Run Mimikatz as administrator.

00:01:19.770 --> 00:01:22.270
Maximize the screen here.

00:01:23.140 --> 00:01:26.550
And typically you would be running the commands for Mimikatz on

00:01:26.550 --> 00:01:28.930
the system that you have full control of,

00:01:28.940 --> 00:01:31.350
which you had exfiltrated the file to.

00:01:31.360 --> 00:01:36.460
In this case, we're going to leverage Minidump to read this file.

00:01:37.440 --> 00:01:38.010
There we go.

00:01:38.010 --> 00:01:41.810
And you'll notice that it says Switch to MINIDUMP,

00:01:41.820 --> 00:01:43.130
and it tells you which file,

00:01:43.140 --> 00:01:45.270
and then you can run the commands that you need to run.

00:01:46.840 --> 00:01:52.550
So we'll simply use logonpasswords, and we'll scroll all the way to the top here.

00:01:52.720 --> 00:01:55.270
And you can see that as the command was run,

00:01:55.640 --> 00:01:58.070
Mimikatz opened the

00:01:58.080 --> 00:02:02.970
C:\Users\LEE~1.GLO\AppData\Local\Temp\lsass file that we

00:02:02.970 --> 00:02:03.590
created.

00:02:03.600 --> 00:02:05.690
So this could have been on your own system,

00:02:05.700 --> 00:02:08.960
and it would have been able to get all of the information that

00:02:08.960 --> 00:02:11.670
had clear text passwords currently in memory.