mimikatz
Dumps LSASS credentials and manipulates Kerberos tickets on Windows.
The reference tool for stealing Windows credentials. It extracts passwords, hashes and Kerberos tickets from LSASS memory, and automates attacks such as pass-the-hash, pass-the-ticket, DCSync and Golden Ticket.
Family Credential dumping & theft
Flags sekurlsa::logonpasswords lsadump::dcsync
Concepts Dumping credentials from LSASS (Mimikatz), Pass-the-Hash, Golden Ticket, Overpass-the-Hash, DPAPI Secrets
Cheatsheet Post-exploitation & lateral
Installation
# Windows binary (x64/x86). Upload the .exe or load it in memoryUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- BlueHackTheBox