Basic Mimikatz Usage Cheat Sheet by wbtaylor

This is the main module of mimikatz, it contains quick commands to operate with the tool. For this particular one, no need to prefix command by the module name (but it works too), eg: exit is the same as standa­rd:­:exit.

This module, one of the oldest, plays with CryptoAPI functions. Basically it's a little certutil that benefit of token impers­ona­tion, patch legacy CryptoAPI functions and patch CNG key isolation service.

This module can be used without any privilege. It permits to play with official Microsoft Kerberos API and to create offline 'Golden tickets', free, long duration TGT tickets for any users

This module dumps passwords saved in the Windows Vault.

This module deals with the Windows Event logs (to clear footprints after compro­mise).

This module deals with Windows processes. It can also be used for process injection and parent process spoofing.

some functi­ona­lities in this module are similar to the Windows net commands. Enumer­ating sessions and servers configured with different types of Kerberos delega­tions is also included.

This command list all providers: CryptoAPI, then CNG if available (NT 6).

This command lists smartc­ard­/token reader(s) on, or deported to, the system. When the CSP is available, it tries to list keys on the smartcard.

This command lists certif­icates and properties of theirs keys. It can export certif­icates too.

This patch modify a CryptoAPI function, in the mimikatz process, in order to make unexpo­rtable keys, exportable (no specifig right other than access to the private key is needed) This is only useful when the keys provider is one of: Microsoft Base Crypto­graphic Provider v1.0, Microsoft Enhanced Crypto­graphic Provider v1.0, Microsoft Enhanced RSA and AES Crypto­graphic Provider, Microsoft RSA SChannel Crypto­graphic Provider, Microsoft Strong Crypto­graphic Provider

Enumerates vault creden­tials

(exper­ime­ntal) Patch Terminal Server service to allow multiple users

Quits mimikatz, after cleaning routines.

Gives the Answer to the Ultimate Question of Life, the Universe, and Everyt­hing.

Sleeps an amount of millis­econds (1000 ms by default).

Switches from file writing on the disk, to Base64 output instead.

Change or display current directory

Lists all available provider creden­tials. This usually shows recently logged on user and computer creden­tials.

List and export Kerberos tickets of all sessions.

Read masterkeys from memory

Switches (or reinits) to LSASS process context

Respon­sible for collecting password hashes from the LSASS address space

List Kerberos creden­tials for all authen­ticated users (including services and computer account)

Get Domain Kerberos service account (KRBTG­T)p­assword data

List Creden­tials Manager

Clear an event log

Install Mimikatz service (‘mimi­kat­zsvc’)

List Services

Removes the specified service (It must be used with caution)

Shuts down a specified service by sending a SERVIC­E_C­ONT­ROL­_SH­UTDOWN signal

Stops a specified service by sending a SERVIC­E_C­ONT­ROL­_STOP signal

Can be used to dump the Azure Panel's session cookie from login.m­ic­ros­oft­onl­ine.com

Launches the command prompt

(Exper­ime­ntal) Tries to enumerate all modules with Detour­s-like hooks

Locks the screen. It can come in handy with misc::­memssp

Identifies Windows minifi­lters inside mimikatz, without using fltmc.exe. It can also assist in finger­pri­nting security products, by altitude too (Gathers details on loaded drivers, including driver altitude)

Can be used to dump the NGC key (Windows Hello keys) signed with the symmetric pop key.

Launches the registry editor

Used to list the available shadow copies on the system

Mimikat's implem­ent­ation of the MS-RPRN abuse (Print­erBug), an authen­tic­ation coercion technique

Sets up a wallpaper

Ask for debug privilege for mimikatz process.

This command dumps the Security Account Managers (SAM) database. It contains NTLM, and sometimes LM hash, of users passwords.

Used to perform a password reset without knowing the user's current password. It can be useful during an active directory Access Control (ACL) abuse scenario

Ask a DC to synchr­onize an object (get password data for account). No need to run code on DC.

Dumps the DPAPI backup keys from the Domain Controller

Used to change the password of a user

Pass-t­he-­Ticket. Typically used to inject a stolen or forged Kerberos ticket (golde­n/s­ilv­er/­trust).

Displays inform­ations about the TGT of the current session.

Purges all tickets of the current session.

Used to impers­onate a token. Used to elevate permis­sions to SYSTEM (default) or find a domain admin token on the box using the Windows API.

Revert to previous token

Display current identity

Lists all the exported functions from the DLLs each running process is using. If a /pid is not specified, then exports for mimika­tz.exe will be displayed

Lists all running processes. It uses the NtQuer­ySy­ste­mIn­for­mation Windows Native API function

Starts a process by using the Create­Process Win32 API function. The PID of the process is also displayed

Suspends a process by using the NtSusp­end­Process Windows Native API function

Runs a subprocess under a parent process (Default parent process is LSASS.e­xe). It can also be used for lateral movement and process spoofing

Displays more inform­ation about the local group member­ships including Remote Desktop Users, Distri­buted COM Users, etc

Displays the local groups

Displays inform­ation about the logged in server

Displays the available shares

Displays the current time

Displays the local users