📖 What is Mimikatz?
Mimikatz is a powerful post-exploitation tool used to extract plaintext passwords, hashes, PINs, and Kerberos tickets from memory (LSASS). It is widely used by attackers to perform credential harvesting and lateral movement within Windows environments.
"Modern Windows versions have implemented 'Credential Guard' to protect LSASS. If Mimikatz fails, look for ways to disable this protection or dump memory via other methods."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Mimikatz?
- ▸ Targets the Local Security Authority Subsystem Service (LSASS) to extract plaintext passwords, NTLM hashes, and Kerberos tickets stored in system memory.
- ▸ Facilitates Pass-the-Hash (PtH) attacks, allowing an attacker to authenticate to remote systems using a captured hash instead of the plaintext password.
- ▸ Enables the creation of Golden Tickets by compromising the KRBTGT account, granting the attacker unrestricted, persistent access to any resource in the domain.
- ▸ Requires administrative or SYSTEM-level privileges to access the memory space of critical processes, making privilege escalation a necessary precursor to its use.
- ▸ Supports Pass-the-Ticket (PtT) techniques, where extracted Kerberos tickets are injected into a session to impersonate users without requiring their credentials.
🎯 How does Mimikatz appear on the PT0-002 Exam?
You may be asked to identify the best tool for extracting NTLM hashes from a compromised Windows workstation to facilitate lateral movement via a Pass-the-Hash attack across a corporate network.
A scenario might describe an attacker who has compromised the KRBTGT account and wants to maintain persistent, high-level access. You will need to identify the creation of a Golden Ticket.
Expect questions where Mimikatz fails to extract credentials on a modern Windows system; you must recognize that Windows Defender Credential Guard is likely protecting the LSASS process from unauthorized memory access.
❓ Frequently Asked Questions
How does Mimikatz facilitate lateral movement?
By extracting NTLM hashes or Kerberos tickets from one compromised machine, an attacker can use those credentials to authenticate to other servers or workstations without ever knowing the user's actual plaintext password.
Why is Mimikatz often detected by antivirus or EDR solutions?
Because it interacts directly with the LSASS process and has well-known signatures, it is a primary target. PenTesters often use obfuscated versions or memory-only loaders to bypass these detections.
What is the difference between a Golden Ticket and a Silver Ticket?
A Golden Ticket mimics the KRBTGT account to provide access to any service in the domain, whereas a Silver Ticket targets a specific service account for a single resource.