Mimikatz Abusing Kerberos
To extract credentials from memory due to caching requirements of the Kerberos protocol
Last updated
To extract credentials from memory due to caching requirements of the Kerberos protocol
Last updated
We need SYSTEM (or local administrator) permissions to gain access to the hashes stored on a target Local Security Authority Subsystem Service (LSASS)
We must be local administrator or SYSTEM to dump the credentials, which means we will also have the SeLoadDriverPrivilege privilege and the ability to load any signed drivers.
We can load driver to disable PPL. (upload to victim and place in the same dir of mimikatz) *noisy*
