> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/credential-dumping/mimikatz-general-information.md). # Mimikatz - General information ## List Mimikatz Modules and Commands Mimikatz modules can be listed by entering a non-existing module ```batch mimikatz # cajac:: ERROR mimikatz_doLocal ; "cajac" module not found ! standard - Standard module [Basic commands (does not require module name)] crypto - Crypto Module sekurlsa - SekurLSA module [Some commands to enumerate credentials...] kerberos - Kerberos package module [] ngc - Next Generation Cryptography module (kiwi use only) [Some commands to enumerate credentials...] privilege - Privilege module process - Process module service - Service module lsadump - LsaDump module ts - Terminal Server module event - Event module misc - Miscellaneous module token - Token manipulation module vault - Windows Vault/Credential module minesweeper - MineSweeper module net - dpapi - DPAPI Module (by API or RAW access) [Data Protection application programming interface] busylight - BusyLight Module sysenv - System Environment Value module sid - Security Identifiers module iis - IIS XML Config module rpc - RPC control of mimikatz sr98 - RF module for SR98 device and T5577 target rdm - RF module for RDM(830 AL) device acr - ACR Module ``` Then to list all commands under a module use a non-existing command such as `help` ```batch mimikatz # sid::help ERROR mimikatz_doLocal ; "help" command of "sid" module not found ! Module : sid Full name : Security Identifiers module lookup - Name or SID lookup query - Query object by SID or name modify - Modify object SID of an object add - Add a SID to sIDHistory of an object clear - Clear sIDHistory of an object patch - Patch NTDS Service ``` ## Mimikatz Modules ### Busylight module ```batch mimikatz # busylight::help ERROR mimikatz_doLocal ; "help" command of "busylight" module not found ! Module : busylight Full name : BusyLight Module list - status - single - off - test - ``` ### Crypto module ```batch mimikatz # crypto::help ERROR mimikatz_doLocal ; "help" command of "crypto" module not found ! Module : crypto Full name : Crypto Module providers - List cryptographic providers stores - List cryptographic stores certificates - List (or export) certificates keys - List (or export) keys containers sc - List smartcard readers hash - Hash a password with optional username system - Describe a Windows System Certificate (file, TODO:registry or hive) scauth - Create a authentication certitifate (smartcard like) from a CA certtohw - Try to export a software CA to a crypto (virtual)hardware capi - [experimental] Patch CryptoAPI layer for easy export cng - [experimental] Patch CNG service for easy export extract - [experimental] Extract keys from CAPI RSA/AES provider kutil tpminfo ``` ### Dpapi module ```batch mimikatz # dpapi::help ERROR mimikatz_doLocal ; "help" command of "dpapi" module not found ! Module : dpapi Full name : DPAPI Module (by API or RAW access) Description : Data Protection application programming interface blob - Describe a DPAPI blob, unprotect it with API or Masterkey protect - Protect a data via a DPAPI call masterkey - Describe a Masterkey file, unprotect each Masterkey (key depending) credhist - Describe a Credhist file create - Create a Masterkey file from raw key and metadata capi - CAPI key test cng - CNG key test tpm - TPM key test cred - CRED test vault - VAULT test wifi - WiFi test wwan - Wwan test chrome - Chrome test ssh - SSH Agent registry cache rdg - RDG saved passwords ps - PowerShell credentials (PSCredentials or SecureString) luna - Safenet LunaHSM KSP cloudapkd - cloudapreg - sccm - citrix - cache ``` ### Event module ```batch mimikatz # event::help ERROR mimikatz_doLocal ; "help" command of "event" module not found ! Module : event Full name : Event module drop - [experimental] patch Events service to avoid new events clear - Clear an event log ``` ### IIS module ```batch mimikatz # iis::help ERROR mimikatz_doLocal ; "help" command of "iis" module not found ! Module : iis Full name : IIS XML Config module apphost ``` ### Kerberos module ```batch mimikatz # kerberos::help ERROR mimikatz_doLocal ; "help" command of "kerberos" module not found ! Module : kerberos Full name : Kerberos package module Description : ptt - Pass-the-ticket [NT 6] list - List ticket(s) ask - Ask or get TGS tickets tgt - Retrieve current TGT purge - Purge ticket(s) golden - Willy Wonka factory hash - Hash password to keys ptc - Pass-the-ccache [NT6] clist - List tickets in MIT/Heimdall ccache ``` ### Lsadump module ```batch mimikatz # lsadump::help ERROR mimikatz_doLocal ; "help" command of "lsadump" module not found ! Module : lsadump Full name : LsaDump module sam - Get the SysKey to decrypt SAM entries (from registry or hives) secrets - Get the SysKey to decrypt SECRETS entries (from registry or hives) cache - Get the SysKey to decrypt NL$KM then MSCache(v2) (from registry or hives) lsa - Ask LSA Server to retrieve SAM/AD entries (normal, patch on the fly or inject) trust - Ask LSA Server to retrieve Trust Auth Information (normal or patch on the fly) backupkeys rpdata dcsync - Ask a DC to synchronize an object dcshadow - They told me I could be anything I wanted, so I became a domain controller setntlm - Ask a server to set a new password/ntlm for one user changentlm - Ask a server to set a new password/ntlm for one user netsync - Ask a DC to send current and previous NTLM hash of DC/SRV/WKS packages mbc zerologon postzerologon ``` ### Misc module ```batch mimikatz # misc::help ERROR mimikatz_doLocal ; "help" command of "misc" module not found ! Module : misc Full name : Miscellaneous module cmd - Command Prompt (without DisableCMD) regedit - Registry Editor (without DisableRegistryTools) taskmgr - Task Manager (without DisableTaskMgr) ncroutemon - Juniper Network Connect (without route monitoring) detours - [experimental] Try to enumerate all modules with Detours-like hooks memssp skeleton compress lock wp mflt easyntlmchall clip xor aadcookie ngcsign spooler efs printnightmare sccm shadowcopies djoin citrix ``` ### Net module ```batch mimikatz # net::help ERROR mimikatz_doLocal ; "help" command of "net" module not found ! Module : net Full name : user - group - alias - session - wsession - tod - stats - share - serverinfo - trust - deleg - if - ``` ### Privilege module ```batch mimikatz # privilege::help ERROR mimikatz_doLocal ; "help" command of "privilege" module not found ! Module : privilege Full name : Privilege module debug - Ask debug privilege driver - Ask load driver privilege security - Ask security privilege tcb - Ask tcb privilege backup - Ask backup privilege restore - Ask restore privilege sysenv - Ask system environment privilege id - Ask a privilege by its id name - Ask a privilege by its name ``` ### Process module ```batch mimikatz # process::help ERROR mimikatz_doLocal ; "help" command of "process" module not found ! Module : process Full name : Process module list - List process exports - List exports imports - List imports start - Start a process stop - Terminate a process suspend - Suspend a process resume - Resume a process run - Run! runp - ``` ### Rpc module ```batch mimikatz # rpc::help ERROR mimikatz_doLocal ; "help" command of "rpc" module not found ! Module : rpc Full name : RPC control of mimikatz server connect close enum ``` ### Sekurlsa module ```batch mimikatz # sekurlsa::help ERROR mimikatz_doLocal ; "help" command of "sekurlsa" module not found ! Module : sekurlsa Full name : SekurLSA module Description : Some commands to enumerate credentials... msv - Lists LM & NTLM credentials wdigest - Lists WDigest credentials kerberos - Lists Kerberos credentials tspkg - Lists TsPkg credentials livessp - Lists LiveSSP credentials cloudap - Lists CloudAp credentials ssp - Lists SSP credentials logonPasswords - Lists all available providers credentials process - Switch (or reinit) to LSASS process context minidump - Switch (or reinit) to LSASS minidump context bootkey - Set the SecureKernel Boot Key to attempt to decrypt LSA Isolated credentials pth - Pass-the-hash krbtgt - krbtgt! dpapisystem - DPAPI_SYSTEM secret trust - Antisocial backupkeys - Preferred Backup Master keys tickets - List Kerberos tickets ekeys - List Kerberos Encryption Keys dpapi - List Cached MasterKeys credman - List Credentials Manager ``` ### Service module ```batch mimikatz # service::help ERROR mimikatz_doLocal ; "help" command of "service" module not found ! Module : service Full name : Service module start - Start service remove - Remove service stop - Stop service suspend - Suspend service resume - Resume service preshutdown - Preshutdown service shutdown - Shutdown service list - List services + - Install Me! - - Install Me! me - Me! ``` ### Sid module ```batch mimikatz # sid::help ERROR mimikatz_doLocal ; "help" command of "sid" module not found ! Module : sid Full name : Security Identifiers module lookup - Name or SID lookup query - Query object by SID or name modify - Modify object SID of an object add - Add a SID to sIDHistory of an object clear - Clear sIDHistory of an object patch - Patch NTDS Service ``` ### Sysenv module ```batch mimikatz # sysenv::help ERROR mimikatz_doLocal ; "help" command of "sysenv" module not found ! Module : sysenv Full name : System Environment Value module list - List ... get - Get ... set - Set ... del - Del ... ``` ### Token module ```batch mimikatz # token::help ERROR mimikatz_doLocal ; "help" command of "token" module not found ! Module : token Full name : Token manipulation module whoami - Display current identity list - List all tokens of the system elevate - Impersonate a token run - Run! revert - Revert to proces token ``` ### Ts module ```batch mimikatz # ts::help ERROR mimikatz_doLocal ; "help" command of "ts" module not found ! Module : ts Full name : Terminal Server module multirdp - [experimental] patch Terminal Server service to allow multiples users sessions remote logonpasswords - [experimental] try to get passwords from running sessions mstsc - [experimental] try to get passwords from mstsc process ``` ### Vault module ```batch mimikatz # vault::help ERROR mimikatz_doLocal ; "help" command of "vault" module not found ! Module : vault Full name : Windows Vault/Credential module list - list cred - cred ``` ## Resources Mimikatz - GitHub: Mimikatz - Wiki: Unofficial Guide to Mimikatz & Command Reference - ADSecurity.org: