Mimikatz | What is this changing

Last updated 6 days ago

Cobalt Strike has a built-in version of Mimikatz that we can use to extract various credential types. However, there are some differences with how it behaves in Beacon compared to the console version. Each time you execute Mimikatz in Beacon, it does so in a new temporary process which is then destroyed. This means you can't run two "related" commands, such as:

Since CS 4.8, you can chain multiple commands together by separating them with a semi-colon.

Beacon also has its own command convention using the ! and @ symbols as "modifiers".

The ! elevates Beacon to SYSTEM before running the given command, which is useful in cases where you're running in high-integrity but need to impersonate SYSTEM. In most cases, ! is a direct replacement for token::elevate. For example:

The @ impersonates Beacon's thread token before running the given command, which is useful in cases where Mimikatz needs to interact with a remote system, such as with dcsync. This is also compatible with other impersonation primitives such as make_token and steal_token. For example:

Last updated 6 days ago