T /Using Mimikatz non-interactively

1

Hi,

I have a scenario which makes it impossible to use mimikatz interactively. I thought I could just pass instructions as arguments in the command line, e.g.:

.\mimikatz.exe “base64 /out:true” exit

This runs, but the spaces in the argument seem to lead to “base64” and “/out:true” being executed separately. The same thing happens if I try “kerberos::list /export” - “kerberos::list” executes correctly, but “/export” is run completely separately (and obviously fails).

Am I missing something really obvious here? I’ve had a hunt around on Google and struggled to find any examples of commands that involve spaces.

Thanks

2

I found a solution - putting it here in case it’s helpful for anyone else. From Powershell just use the following format:

$results = .\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit

And then simply use $results to read the output

2 Likes
3

Hello! Thanks for the forum post! I found your post via a google search and will leave this for anyone who finds it in a similar fashion.

The above for me did not preserve new lines, so the output was all a bit gobbled (sorry if it was the intention, for me it was to just use it non-interactively). What worked for me is to pipe it to file, like so:

.\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit > mimikatz.txt

Use type mimikatz.txt to view the output, the newlines should be there and it should be nice and readable.