Mimikatz

Mimikatz is the reference tool for working with Windows credentials and Kerberos. On a host where you already have local administrator or SYSTEM, it can read secrets the OS keeps in memory and in the local stores: NTLM hashes, Kerberos tickets, and (on older or misconfigured systems) cleartext passwords. It is the classic demonstration of why local admin on one machine so often becomes domain-wide compromise.

You will meet it on Active Directory boxes once you have admin on a host. It is also the single best teaching tool for defenders: understanding what Mimikatz can and cannot do is how you reason about Credential Guard, LSA Protection, and tiered admin.

What you will learn#

• What Mimikatz extracts, and the privileges it requires
• The handful of modules you actually use (sekurlsa, lsadump, kerberos)
• How to read its output and turn a hash/ticket into access
• The defenses that blunt or block it (the most useful part)
• Common mistakes and a commented cheat sheet

Legal and scope reminder#

Run Mimikatz only in labs you own or an engagement that explicitly authorizes credential extraction. It reads other users’ secrets, so scope and authorization must be unambiguous, and recovered credentials are sensitive material: store them securely and only for as long as the engagement needs. This guide stays at the level a defender or CTF player needs and points you at the mitigations.

Prerequisites#

• A Windows lab/VM you own (or an authorized AD lab). Modern Windows with Credential Guard will block most of this by design, which is the point.
• Local administrator or SYSTEM on the target; Mimikatz needs SeDebugPrivilege to touch LSASS.
• Basic AD literacy (NTLM, Kerberos TGT/TGS, domain vs local accounts).

TARGET/USER/DOMAIN are placeholders in an owned lab.

Lab setup#

Build an isolated AD lab you own (e.g. a DC + a member server in a private network).
Snapshot the VMs first so you can revert. Never point this at anything you do not own.

Installation#

Mimikatz is a Windows executable (and a PowerShell port, Invoke-Mimikatz). You run it on the Windows target after getting admin there. In CTFs it is commonly uploaded via your shell (for example with evil-winrm’s upload). Many EDRs flag the binary on sight, which is expected.

Update process#

Use a current build from the upstream project for your lab; newer builds track changes in how Windows stores secrets. Keep it in your lab tooling folder.

Check if it runs#

mimikatz.exe
mimikatz # version
mimikatz # privilege::debug      :: must return "Privilege '20' OK"

If privilege::debug fails, you are not admin/SYSTEM and the credential modules will not work.

First safe test#

On your own lab VM, confirm privilege and identity, which touches no other user:

mimikatz # privilege::debug
mimikatz # token::whoami

Success is Privilege '20' OK. Failure means insufficient rights or that LSA Protection / Credential Guard is blocking access (a valid, common result).

Core concepts#

• It needs admin/SYSTEM + SeDebugPrivilege to read LSASS.
• sekurlsa reads secrets from LSASS memory (hashes, tickets, sometimes cleartext via legacy WDigest).
• lsadump reads the local SAM and, with the right rights, performs DCSync (asking a DC to replicate a user’s hash, e.g. krbtgt).
• kerberos crafts/uses tickets (the basis of pass-the-ticket and golden/silver tickets, all in-lab concepts).
• Modern defenses change the game: Credential Guard, LSA Protection (RunAsPPL), and disabled WDigest remove most of what older boxes leak.

When this tool is useful#

• Authorized AD labs/CTFs: demonstrate that local admin on one host leads to domain credentials.
• Defensive validation: prove your Credential Guard / LSA Protection actually stops extraction.

When not to use this tool#

• Anywhere you are not explicitly authorized to read others’ credentials.
• When a quieter path exists (e.g. impacket secretsdump remotely with creds you already hold).
• On production without written approval; it is high-impact and heavily monitored.

Command anatomy#

mimikatz # <module>::<command> [options]
#          privilege::debug | sekurlsa::logonpasswords | lsadump::dcsync /user:..

• Commands are module::action. Start every session with privilege::debug.

Common modules#

Practical examples (owned lab only)#

:: Always start here
mimikatz # privilege::debug

:: Read logon secrets from LSASS (blocked when Credential Guard is on)
mimikatz # sekurlsa::logonpasswords

:: Local SAM hashes (requires SYSTEM)
mimikatz # lsadump::sam

:: DCSync a user's hash from the DC (requires replication rights you have in-lab)
mimikatz # lsadump::dcsync /user:DOMAIN\krbtgt

A common CTF flow is to dump a hash here, then use it elsewhere without cracking it, for example pass-the-hash into a shell with evil-winrm -H, or remotely with netexec.

Example workflow#

1. Get local admin/SYSTEM on a lab host (separate privesc step).
2. privilege::debug  -> confirm SeDebugPrivilege.
3. sekurlsa::logonpasswords  -> collect NTLM hashes / tickets present.
4. Use a recovered hash with pass-the-hash (evil-winrm -H / netexec) to reach the
   next host; or lsadump::dcsync for krbtgt if you have the rights.
5. Document each credential, where it came from, and where it was used.

Reading and interpreting output#

• Each session block shows a logged-on user with NTLM, SHA1, and (legacy) wdigest cleartext if present.
• Empty/blocked output usually means Credential Guard or LSA Protection is active, or you lack SeDebugPrivilege.
• A DCSync result returns the target’s NTLM hash; krbtgt’s hash is the keys to the whole domain (golden-ticket territory, lab-only).

Common mistakes#

• Skipping privilege::debug and wondering why everything is empty.
• Expecting cleartext on modern Windows (WDigest is off by default now).
• Forgetting that EDR/AV flags the binary instantly; this is not a stealthy tool.
• Treating a dumped hash as needing a crack; pass-the-hash often skips that.
• Storing recovered credentials carelessly.

Troubleshooting#

Tools that pair well#

• impacket secretsdump for the same goals remotely with creds you hold.
• netexec to spray/validate recovered hashes across hosts.
• evil-winrm to use a hash via pass-the-hash (-H).
• hashcat if you do choose to crack an NTLM hash to a password.

Automation and note taking#

mimikatz # log lab-mimikatz.txt        :: write session output to a file

Treat the log as sensitive evidence: record host, account, and how each credential was used, then handle per the engagement’s data rules.

Blue-team visibility#

This is the section that matters most. Mimikatz is loud and well understood by defenders: EDR signatures, Sysmon process-access events on LSASS (Event 10), suspicious SeDebugPrivilege use, and replication (DCSync) requests from non-DC hosts. The durable defenses are Credential Guard, LSA Protection (RunAsPPL), disabling WDigest, tiered administration, and monitoring DCSync. Understanding Mimikatz is mostly valuable for building and validating these.

Safer or lower-noise usage#

• Prefer remote secretsdump with held credentials over touching LSASS directly.
• Only extract what the engagement needs; do not mass-dump.
• Work in snapshots you can revert; never on production without approval.

Alternatives#

• impacket secretsdump: remote SAM/LSA/NTDS dump with valid creds (often quieter).
• pypykatz: a Python reimplementation that parses LSASS dumps offline.
• Native LSASS dump + offline parse: capture a dump, analyze it off the host.

Mimikatz is the canonical interactive tool; the alternatives suit remote or offline workflows.

Deprecated and legacy notes#

• WDigest cleartext is a legacy artifact (pre-2014 defaults); modern Windows hides it.
• Many techniques Mimikatz pioneered are now reimplemented in impacket/pypykatz.

Quick reference cheat sheet#

:: Owned lab only. Start every session with privilege::debug.
privilege::debug
sekurlsa::logonpasswords          :: hashes/tickets from LSASS (Cred Guard blocks)
sekurlsa::tickets /export         :: export Kerberos tickets
lsadump::sam                      :: local SAM hashes (SYSTEM)
lsadump::dcsync /user:DOMAIN\krbtgt   :: replicate a hash from the DC (rights needed)
log lab-mimikatz.txt              :: save session output

Mini decision tree#

• Have local admin, need domain creds: privilege::debug then sekurlsa::logonpasswords.
• Got a hash, need access: pass-the-hash with evil-winrm -H or netexec.
• Have creds already, want it quieter/remote: use impacket secretsdump instead.
• Output empty: Credential Guard / LSA Protection is doing its job; note it.

Final checklist#

• Owned lab or explicit authorization for credential extraction
• privilege::debug confirmed
• Only required credentials extracted, stored securely
• Defenses (Cred Guard / LSA Protection) noted where they blocked you
• No production or third-party targets

Final summary#

Mimikatz shows why one local-admin host endangers a whole domain, and why Credential Guard and LSA Protection exist. The first command is always privilege::debug; the most important thing to internalize is that a recovered hash is often used directly (pass-the-hash) rather than cracked. Pair it with impacket and netexec for remote workflows, and study the blue-team section as much as the commands.