mirror of
https://github.com/Aryma-f4/Ares-mythic.git
synced 2026-06-12 22:54:11 +00:00
03d283cf49
This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes: - Renaming directories from `apollo` to `ares` - Updating documentation image references - Maintaining the same code functionality while changing the payload name - Adding new Ares-specific documentation files - Removing old Apollo documentation files The rename is done to reflect the new payload name while preserving all existing functionality.
54 lines
1.5 KiB
Markdown
54 lines
1.5 KiB
Markdown
+++
|
|
title = "mimikatz"
|
|
chapter = false
|
|
weight = 103
|
|
hidden = false
|
|
+++
|
|
|
|
{{% notice info %}}
|
|
Artifacts Generated: Process Create, Process Inject, Process Kill
|
|
{{% /notice %}}
|
|
|
|
## Summary
|
|
Execute one or more mimikatz commands.
|
|
|
|
### Arguments (Positional)
|
|
#### Command
|
|
The command you would like mimikatz to run. Some commands require certain privileges and may need the `token::elevate` Mimikatz command or the builtin equivalent [`getprivs`](/agents/apollo/commands/getprivs/) to be executed first.
|
|
|
|
The `mimikatz` binary takes space-separated commands. For example, if you wanted to ensure your token had the correct privileges before dumping LSASS, you could do `mimikatz token::elevate sekurlsa::logonpasswords` to first elevate your token before running `logonpasswords`. Due to this space-separated command list, if you wish to run a command that has arguments (or spaces in its command name), you'll need to encapsulate that command in _escaped_ quotes.
|
|
|
|
## Usage
|
|
```
|
|
mimikatz -Command [command]
|
|
```
|
|
|
|
Example
|
|
```
|
|
mimikatz sekurlsa::logonpasswords
|
|
mimikatz -Command sekurlsa::logonpasswords
|
|
|
|
# Running one or more commands with spaces in the command name
|
|
|
|
mimikatz -Command \"privilege::debug\" \"sekurlsa::pth /domain:DOMAIN /user:USERNAME /ntlm:HASH\" exit
|
|
```
|
|
|
|
## See Also
|
|
- [dcsync](/agents/apollo/commands/dcsync/)
|
|
- [pth](/agents/apollo/commands/dcsync/)
|
|
|
|
## MITRE ATT&CK Mapping
|
|
|
|
- T1134
|
|
- T1098
|
|
- T1547
|
|
- T1555
|
|
- T1003
|
|
- T1207
|
|
- T1558
|
|
- T1552
|
|
- T1550
|
|
|
|
### Resrouces
|
|
- [mimikatz](https://github.com/gentilkiwi/mimikatz)
|