hello benjamin,
i have found out that due to the newly release of windows 10 (version 2004) build SO 20170.1000 once i try to access the LSASS i get key import as error:
.#####. mimikatz 2.2.0 (x64) #19041 Jul 15 2020 18:37:46
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
/ \ ## /*** Benjamin DELPY gentilkiwi ( benjamin@gentilkiwi.com )
well i have uploaded the execution of the /cab command elsewhere im not sure this is what needed in order to update sekurlsa module to work with. let me know if need anything else , please.
hello benjamin, i have found out that due to the newly release of windows 10 (version 2004) build SO 20170.1000 once i try to access the LSASS i get key import as error:
.#####. mimikatz 2.2.0 (x64) #19041 Jul 15 2020 18:37:46 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
/ \ ## /*** Benjamin DELPY
gentilkiwi( benjamin@gentilkiwi.com )\ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/
mimikatz # privilege::debug Privilege '20' OK
mimikatz # sekurlsa::logonpasswords ERROR kuhl_m_sekurlsa_acquireLSA ; Key import
mimikatz # version /full /cab
mimikatz 2.2.0 (arch x64) Windows NT 10.0 build 20170 (arch x64) msvc 191627041 0
lsasrv.dll : 10.0.20170.1000 msv1_0.dll : 10.0.20170.1000 tspkg.dll : 10.0.20170.1000 wdigest.dll : 10.0.20170.1000 kerberos.dll : 10.0.20170.1000 dpapisrv.dll : 10.0.20170.1000 cryptdll.dll : 10.0.20170.1000 samsrv.dll : 10.0.20170.1000 rsaenh.dll : 10.0.20170.1000 ncrypt.dll : 10.0.20170.1000 ncryptprov.dll : 10.0.20170.1000 wevtsvc.dll : 10.0.20170.1000 termsrv.dll : 10.0.20170.1000
CAB: mimikatz_x64_sysfiles_20170 -> lsasrv.dll -> msv1_0.dll -> tspkg.dll -> wdigest.dll -> kerberos.dll -> dpapisrv.dll -> cryptdll.dll -> samsrv.dll -> rsaenh.dll -> ncrypt.dll -> ncryptprov.dll -> wevtsvc.dll -> termsrv.dll
mimikatz # exit
i will attach the output of /cab command in order to be helpful to update for this new release mimikatz_x64_sysfiles_20170_00.zip
well i have uploaded the execution of the /cab command elsewhere im not sure this is what needed in order to update sekurlsa module to work with. let me know if need anything else , please.