Mimikatz
Extract Windows credentials from memory.
Windowshigh
pkg: (windows binary)
Mimikatz dumps plaintext passwords, hashes, PINs and Kerberos tickets from LSASS, and performs pass-the-hash/ticket attacks.
Syntax
mimikatz # {module}::{command}
Example
mimikatz # sekurlsa::logonpasswords
Dumps cached credentials and hashes for logged-on users from LSASS memory.
Advantages
- Iconic Windows credential tool
- PtH/PtT/Kerberos attacks
- Deep LSASS/DPAPI access
Disadvantages
- Heavily flagged by AV/EDR
- Requires admin/SeDebug
- Windows-only, high noise
Tags
#windows#credentials#lsass
Official docs: Mimikatz ↗
Related commands
Frequently asked questions
What is Mimikatz used for?
Mimikatz dumps plaintext passwords, hashes, PINs and Kerberos tickets from LSASS, and performs pass-the-hash/ticket attacks.
What is an example Mimikatz command?
A common example is: mimikatz # sekurlsa::logonpasswords — Dumps cached credentials and hashes for logged-on users from LSASS memory.
Is Mimikatz part of a standard install?
Mimikatz runs on Windows. Install the (windows binary) package.
What category of security tool is Mimikatz?
Mimikatz is a Post-Exploitation tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.