Edit

Mimikatz

About

Mimikatz is an incredibly effective offensive security tool developed by gentilkiwi. It is a post-exploitation tool that dumps passwords from memory, as well as hashes, PINs and Kerberos tickets. Other useful attacks are pass-the-hash, pass-the-ticket or building Golden Kerberos tickets. This makes post-exploitation lateral movement within a network easy for attackers. Mimikatz is a very powerful tool when attacking,or defending Windows Systems, it can also play with certificates or private keys, vault and more.

Mimikatz can only dump credentials and password hashes if it is executed from the context of a privilege user, like local admin.

Links

​Mimikatz github(source)​

​Mimikatz binaries

Usage

  • Get debug rights (this or Local System rights is required for many Mimikatz commands).

privilege::debug

sekurlsa

  • Lists all available provider credentials. This usually shows recently logged on user and computer credentials.

sekurlsa::logonpasswords
sekurlsa::logonpasswords full

  • Dump and export Kerberos tickets from memory

  • Pass the hash - PTH

kerberos

  • Dump and export Kerberos tickets from memory associated with active user sessions

  • Pass the ticket - PTT

  • Create a Golden Ticket

ekeys

  • Dump encryption keys from the system's memory

DPAPI

  • Extract and decrypt credentials protected by DPAPI (Data Protection API) from memory

Golden/Silver Tickets

TGT

  • Interact with and manipulate Kerberos tickets

Last updated