Mimikatz

What is

Mimikatz is a Windows post-exploitation tool capable of interacting with several Windows authentication mechanisms and security components.

It is commonly used to extract authentication material from memory, manipulate authentication tokens, interact with Kerberos tickets, and perform other credential-related operations.

One of its most well-known capabilities is interacting with the Local Security Authority Subsystem Service (LSASS) to retrieve authentication material associated with logged-on users.

Depending on the Windows version, authentication configuration, and available security protections, this material may include credentials, password-derived secrets, Kerberos-related information, or other authentication artifacts.

Mimikatz does not rely on a single technique. It provides multiple modules for interacting with different Windows security mechanisms, making it a useful tool for understanding how credentials and authentication material are handled by Windows.

In a typical Active Directory assessment, Mimikatz can therefore be used after obtaining administrative access to a Windows machine to determine what authentication material is available and whether privileged accounts have authenticated to the compromised host.

Requirements

The exact requirements depend on the Mimikatz module and operation being performed.

For the sekurlsa functionality described in this document, the following conditions are generally required:

• Administrative or equivalent privileges on the target machine.
• Access to the target’s LSASS process and the authentication material stored within it.
• A compatible Mimikatz build for the target Windows architecture.
• A user must have authenticated to the machine for relevant authentication material to be available.

Additional Mimikatz functionality may have different requirements.

For example, Kerberos ticket manipulation and credential extraction do not necessarily depend on exactly the same privileges or Windows security controls.

How to

Summary

The basic workflow is:

Detailed

1. Run Mimikatz

The first step is to start the Mimikatz executable.

Running mimikatz.exe opens its interactive console, where the different Mimikatz modules and commands can be executed.

The executable should be run from an elevated context when performing operations that require access to protected Windows processes.

Once the console is open, Mimikatz displays its prompt and is ready to receive commands.

2. Enable Debug Privilege

Many Mimikatz operations require the SeDebugPrivilege Windows privilege.

This privilege allows a process to obtain extensive access to other processes, including protected processes when the appropriate conditions are met.

Mimikatz can request this privilege with privilege::debug.

A successful result indicates that the current Mimikatz process has obtained the required debug privilege.

If the operation fails, the current process may not have sufficient administrative privileges.

It is important to understand that having administrator membership and successfully obtaining SeDebugPrivilege are related but distinct concepts. Windows security controls can restrict how these privileges are assigned or used.

3. Dump authentication material

Once the required privilege is available, the sekurlsa module can be used to inspect authentication material associated with logon sessions.

One commonly used command is sekurlsa::logonpasswords.

This command instructs Mimikatz to inspect the authentication information maintained by LSASS.

The exact information returned depends on the Windows version, authentication mechanisms, credential protections, and security configuration of the target.

A result may contain information associated with several logon sessions.

For example, the output can identify:

• The authentication package associated with a session.
• The username.
• The domain.
• The logon session.
• Password-derived authentication material.
• Kerberos-related information.
• NTLM-related information, where available.

The presence of a user’s logon session does not necessarily mean that their plaintext password will be available.

Modern versions of Windows include several protections that can prevent or limit the exposure of credential material in LSASS.

Understanding the attack

The basic flow can be represented as:

                User authentication
                       |
                       v
              Windows authentication
                 components
                       |
                       v
                     LSASS
                       |
             Authentication material
                       |
                       v
              Compromised machine
                       |
                       v
                 Mimikatz
                       |
                       v
              Credential extraction

When a user authenticates to Windows, the operating system creates and maintains authentication state for the resulting logon session.

The Local Security Authority Subsystem Service (LSASS) is a critical Windows process responsible for enforcing local security policy and handling important authentication-related operations.

Depending on the authentication protocol and Windows configuration, LSASS may maintain authentication material associated with active logon sessions.

An attacker who obtains sufficient privileges on the machine may attempt to access this process and extract authentication material from it.

Mimikatz provides functionality for interacting with these authentication mechanisms.

The sekurlsa module is particularly relevant because it interacts with authentication material maintained by LSASS.

The important point is that Mimikatz does not magically recover every user’s password.

What can be extracted depends on:

• The Windows version.
• The authentication protocol used.
• Whether the user is currently logged on.
• The type of logon session.
• Credential protection mechanisms.
• The privileges of the Mimikatz process.
• Security products and configuration on the target.

LSASS and credential material

LSASS can maintain different types of authentication material depending on the authentication mechanisms used by the system.

For example, Active Directory environments commonly use both NTLM and Kerberos.

NTLM authentication may result in password-derived material being available to authentication components, while Kerberos authentication involves tickets and session keys.

Mimikatz provides different modules and commands for interacting with these mechanisms.

This is why the tool is commonly associated with both credential dumping and Kerberos attacks.

Why administrative access matters

Accessing LSASS is heavily restricted because compromising this process can expose sensitive authentication material.

An attacker who has obtained sufficiently privileged access to a Windows machine may therefore attempt to access LSASS and extract whatever authentication material is available.

This creates an important security boundary:

Normal User
    |
    | Limited permissions
    v
Windows System

Administrator
    |
    | Elevated privileges
    v
Protected system resources
    |
    v
LSASS

Modern Windows security controls can further restrict access to LSASS, meaning that administrative access alone does not guarantee successful credential extraction.

Common problems

privilege::debug fails

If Mimikatz cannot obtain SeDebugPrivilege, verify that the process is running with sufficient privileges.

The current Windows security configuration may also restrict the use of debug privileges.

Check the current user context and whether the command prompt or Mimikatz process was started with administrative privileges.