Mimikatz is a post-exploitation tool written by Benjamin Delpy (gentilkiwi). It’s now well known for extracting plaintexts passwords, hash, PIN code and kerberos tickets from memory. Mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.
It comes in two flavors: x64 or Win32, depending on your windows version (32/64 bits). The Win32 flavor cannot access 64 bits process memory (like lsass) but can open 32 bits minidump under Windows 64 bits. Some operations need administrator privileges or SYSTEM token, so be aware of UAC from Vista version.
And windbg together, it can even read the virtual machine system password credentials.
- library mimilib
- driver mimidrv
vault & lsadump
The latest version of mimikatz has been released on Github.