Wyniki wyszukiwania dla: mimikatz

Mimikatz can be a tool not only for hackers. During migrations to Cloud from IaaS many times I need to export the certificate to reuse on the cloud – most of them -p private kay is protected against the export. But it is easy to do with Mimikatz. Moreover, it is easier than using certificates MMC. Here is a step by step process:

1. Disable Antivirus including Windows Defender using gpedit.msc.

1. Execute gpupdate /force.
2. Download Mimikatz https://blog.gentilkiwi.com/mimikatz – binaries.
3. Execute:

crypto::capi

privilege::debug

crypto::cng

crypto::certificates /systemstore:local_machine /store:my /export

If you cannot find your certificate here:

Get-ChildItem Cert:\LocalMachine\My

Just instead of looking where it is go to IIS Management or simply open webpage, export certificate without the private key, import it to the LocalMachine using mmc.exe/certificate. At this point, the certificate has not private key associated, but you can download DigiCert utility run this utility as an administrator, choose the certificate to right-click, and repair the certificate. In that way, private kay that exists on the machine will be found and you can export the certificate with a private key once again using:

crypto::certificates /systemstore:local_machine /store:my /export

The certificate will have the password: mimikatz.

During migrations to Cloud from IaaS many times I need to access the SQL or other subsystems using an existing password that is stored in the registry for service.

How to do it step by step.

1. Disable Antivirus including Windows Defender and real-time protection using gpedit.msc. See here: https://rzetelnekursy.pl/?s=mimikatz&id=m
2. Execute gpupdate /force.
3. Download and unzip tools. This tool is provided by Paula Januszkiewicz company CQURE. The tool with password was widely distributed during Microsoft Ignite Conferences and similar. I have no right to distribute it, but I can use it for you – just contact me.
4. Download and unzip psexec from pstools package: https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
5. Execute as an Administrator PsExec.exe -i -d -s cmd.exe. Now we have bigger permissions than Administrator – SYSTEM.
6. Execute CQSecretsDumper.exe /service servicename

   

Go ahead with your dumped password and do not forget to enable Antivirus.