mimikatz icon indicating copy to clipboard operation
mimikatz copied to clipboard

ERROR kuhl_m_sekurlsa_acquireLSA ; Logon list

Open kmohamed2020 opened this issue 2 years ago • 10 comments

I have an issue while trying to extract the logonpasswords using Mimikatz even by creating a LSASS dump file and trying to extract the logonpasswords from it.

tried the last release of Mimikatz as shown in the below screenshot on windows 11

image

image

kmohamed2020 avatar Mar 07 '22 11:03 kmohamed2020

Same for windows 2022

image

image

0xJs avatar May 24 '22 16:05 0xJs

Same for me.

Testing on Windows 11 x64 (22H2), AV is shut down, I am running as Administrator and no LSA protection/ASR/Credential Guard enabled.

init5-SF avatar Jul 08 '23 21:07 init5-SF

Same thing. Someone solved it?

useragent23253 avatar Aug 05 '23 22:08 useragent23253

+1

k3rwin avatar Aug 30 '23 12:08 k3rwin

This pull request #432 may be the fix we're all looking for, but i have not yet checked if it works.

.########## .# UPDATE # .########## I've just tested the code from the above-linked pull request, apart from the required modification to the built environment in order to target W11, it works like a charm, tested in the latest W11 fully patched.

Compiling from sources requires Visual Studio, perfectly fine with the latest community 2022 release. Required modification in order to compile from sources:

  • Install MSVC for your compiler version (mine was the latest)
  • Retarget the project to your compiler version
  • Disable treating warnings as errors

Then compile ONLY the "mimikatz" sub-project as the other are not needed and requires further compilation effort.

ebalo55 avatar Oct 20 '23 04:10 ebalo55

I was trying to compile using VS2022 but got lots of errors. MFC already installed. Also tried change different options in compiler but nothing changed.

useragent23253 avatar Oct 20 '23 07:10 useragent23253

In my case vs22 defaulted to ARM infrastructure once I opened the project, I switched it back to x64 and also ensured to build in release mode in order to avoid the need to generate eventually missing debug symbols.

ebalo55 avatar Oct 20 '23 08:10 ebalo55

I did the same things, but got errors... Could u share your build? I'd like to test it on my VM.

useragent23253 avatar Oct 20 '23 11:10 useragent23253

I did the same things, but got errors... Could u share your build? I'd like to test it on my VM.

Here is the cloned repo: https://github.com/ebalo55/mimikatz

ebalo55 avatar Oct 20 '23 16:10 ebalo55

Thanks bro, working))

useragent23253 avatar Oct 23 '23 07:10 useragent23253