search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.48k stars 3.74k forks source link

"sekurlsa::tickets /export" seems to corrupt (at least) one byte in resulting ccache file #414

Closed symmetrisch closed 1 year ago

symmetrisch commented 1 year ago

I compared two ticket dumps, one with Rubeus (Rubeus.exe monitor /interval:1 /filteruser:DC01$), one with mimikatz (sekurlsa::minidump lsass.DMP sekurlsa::tickets /export). The resulting ccache file (impacket-ticketConverter) is almost identical, but - in my example - one byte is corrupt and prevents proper usage with, e.g., export KRB5CCNAME=

xxd dc01.ccache.rubeus rubeus.hex
xxd dc01.ccache.mimikatz mimikatz.hex

diff rubeus.hex mimikatz.hex

9c9
< 00000080: 0012 0000 0020 6f3d 9c8a 2fbc f668 5e7e  ..... o=../..h^~
---
> 00000080: 0001 0000 0020 6f3d 9c8a 2fbc f668 5e7e  ..... o=../..h^~

May also be the "fault" of impacket-ticketConverter - however it works with Rubeus...