mimikatz

mimikatz

Interact with Windows credentials, perform credential dumping, token manipulation, and more. Requires administrator privileges and typically runs on Windows. More information: https://github.com/gentilkiwi/mimikatz.

  • Run mimikatz in interactive mode:

mimikatz

  • Enable debug privileges (needed for most operations):

mimikatz "privilege::debug"

  • List available logon sessions:

mimikatz "sekurlsa::logonpasswords"

  • Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory:

mimikatz "sekurlsa::logonpasswords"

  • Pass-the-Hash with a specific NTLM hash and launch a command:

mimikatz "sekurlsa::pth /user:{{username}} /domain:{{domain}} /ntlm:{{hash}} /run:{{cmd}}"

  • Dump local SAM database hashes:

mimikatz "lsadump::sam"

  • Extract Kerberos tickets and export to a file:

mimikatz "kerberos::list /export"

  • Exit mimikatz:

exit

windows

choco-list Display a list of packages with Chocolatey.
sc-query This command is an alias of `sc.exe query`.
print.win Print a text file to a printer.
measure-object Calculates the numeric properties of objects, and the characters, words, and lines in string objects, such as files of text.
date Display or set the system date.
tee-object Saves command output in a file or variable and also sends it down the pipeline.
explorer The Windows File Explorer.
systeminfo Display operating system configuration for a local or remote machine.
reg Manage keys and their values in the Windows registry.
wmic Interactive shell for detailed information about running processes.
sc-create This command is an alias of `sc.exe create`.
ver Display the current Windows or MS-DOS version number.
octo Command-line tools for Octopus Deploy.
rm In PowerShell, this command is an alias of `Remove-Item`.
clear-recyclebin Clear items from the Recycle Bin.
pwlauncher Manage the Windows To Go startup options.
mimikatz-dpapi Interact with the Windows Data Protection API (DPAPI).
expand Uncompress Windows Cabinet files.
set-date Changes the system time on the computer to a time that you specify.
mimikatz Interact with Windows credentials, perform credential dumping, token manipulation, and more.
comp Compare the contents of two files or sets of files.
rmdir Remove a directory and its contents.
scoop The Scoop package manager.
ftype Display or modify file types used for file extension association.
choco-upgrade Upgrade one or more packages with Chocolatey.
pabcnetcclear Preprocess and compile PascalABC.NET source files.
get-location Print name of current/working directory.
eventcreate Create custom entries in the event log.
get-date Get the current date and time.
get-content Get the content of the item at the specified location.
get-help Display help information and documentation for PowerShell commands (aliases, cmdlets, and functions).
subst Associates a path with a virtual drive letter.
mimikatz-misc Miscellaneous system and utility commands.
findstr Find specified text within one or more files.
get-history Display PowerShell command history.
netsh-interface-portproxy Configure and display the status of various network components.
nfsstat Display or reset the number of calls made to the NFS server.
repair-bde Attempt to repair or decrypt a damaged BitLocker-encrypted volume.
mimikatz-net Perform network and domain operations.
shutdown A tool for shutting down, restarting or logging off a machine.
find Find a specified string in files.
tzutil A tool for displaying or configuring the system time zone.
pswindowsupdate A PowerShell external module to manage Windows Update.
rpcinfo List programs via RPC on remote computers.
microsoft-edge The Microsoft Edge command-line utility is available as `msedge` on Windows and `microsoft-edge` for other platforms.
for Conditionally execute a command several times.
mkdir Create a directory.
more Display paginated output from `stdin` or a file.
test-json Test whether a string is a valid JSON document.
move Move or rename files and directories.
choco-source Manage sources for packages with Chocolatey.
taskkill Terminate a process by its process ID or name.
where Display the location of files that match the search pattern.
assoc Display or change associations between file extensions and file types.
chrome This command is an alias of `chromium`.
select-string Finds text in strings and files in PowerShell.
sc Communicate with the Service Control Manager and services.
fc Compare the differences between two files or sets of files.
invoke-webrequest Performs a HTTP/HTTPS request to the Web.
bleachbit_console Clean junk files on the filesystem.
bleachbit This command is an alias of `bleachbit_console`.
install-module Install PowerShell modules from PowerShell Gallery, NuGet, and other repositories.
finger Return information about users on a specified system.
choco-push Push a compiled NuGet package (`nupkg`) to a package feed.
cuninst This command is an alias of `choco uninstall`.
get-command List and get available commands in the current PowerShell session.
pwd In PowerShell, this command is an alias of `Get-Location`.
choco-install Install one or more packages with Chocolatey.
enable-pnpdevice The Enable-PnpDevice cmdlet enables a Plug and Play (PnP) device. You must use an Administrator account to enable a device.
reg-save Save a registry key, its subkeys and values to a native `.hiv` file.
resolve-path Resolves the wildcard characters in a path, and displays the path contents.
robocopy Robust File and Folder Copy.
popd Changes the current directory to the directory stored by the `pushd` command.
start-service Starts stopped services.
clear-host Clears the screen.
get-filehash Calculate a hash for a file.
get-childitem List items in a directory.
mimikatz-crypto Manipulate Windows cryptographic services and certificates.
reg-export Export the specified subkeys and values to a `.reg` file.
wsl-open Open a file or URL from within Windows Subsystem for Linux in the user's default Windows GUI application.
ri In PowerShell, this command is an alias of `Remove-Item`.
msiexec Install, update, repair, or uninstall Windows programs using MSI and MSP package files.
reg-import Import all available keys, subkeys, and values from a `.reg` file.
mount Mount Network File System (NFS) network shares.
clear In PowerShell, this command is an alias of `Clear-Host`.
es Command-line interface for Everything, a fast file and folder search tool for Windows.
measure-command Measures the time it takes to run script blocks and cmdlets.
wsl Manage the Windows Subsystem for Linux.
sl In PowerShell, this command is an alias of `Set-Location`.
add-appxpackage A PowerShell utility to add a signed app package (`.appx`, `.msix`, `.appxbundle` and `.msixbundle`) to a user account.
choco-new Generate new package specification files with Chocolatey.
fondue Install optional Windows features.
invoke-item Open files in their respective default programs.
set-service Starts, stops, and suspends a service, and changes its properties.
pwsh-where This command is an alias of `Where-Object`.
setx Set persistent environment variables.
cls Clears the screen.
gal In PowerShell, this command is an alias of `Get-Alias`.
choco-apikey Manage API keys for Chocolatey sources.
curl In PowerShell, this command may be an alias of `Invoke-WebRequest` when the original `curl` program (<https://curl.se>) is not properly installed.
showmount Display information about NFS filesystems on Windows Server.
sort-object Sorts objects by property values.
diskpart Disk, volume and partition manager.
bcdboot Configure or repair boot files.
vol Display information about volumes.
chkdsk Check file system and volume metadata for errors.
clip Copy input content to the Windows clipboard.
set-acl Changes the security descriptor of a specified item, such as a file or a registry key.
slmgr.vbs Install, activate, and manage Windows licenses.
clist This command is an alias of `choco list`.
iscc Compiler for Inno Setup installers.
mimikatz-privilege Manage privileges for mimikatz operations.
reg-add Add new keys and their values to the registry.
cd Display the current working directory or move to a different directory.
tracert Receive information about each step in the route between your PC and the target.
certutil A tool to manage and configure certificate information.
ospp.vbs Install, activate, and manage volume licensed versions of Microsoft Office products.
xcopy Copy files and directory trees.
remove-item Delete files, folders, as well as registry keys and subkeys.
set Display or set environment variables for the current instance of CMD.
set-location Display the current working directory or move to a different directory.
query Display information about user sessions and process.
attrib Display or change attributes of files or directories.
iwr In PowerShell, this command is an alias of `Invoke-WebRequest`.
get-wuhistory Get the history of installed updates from Windows Update. Part of external `PSWindowsUpdate` module.
prompt Change the default DOS style prompt in a command window.
ipconfig Display and manage the network configuration of Windows.
path Display or set the search path for executable files.
mklink Create symbolic links.
choco-search Search for a local or remote package with Chocolatey.
cipher Display or alter the encryption of directories and files on NTFS volumes.
mimikatz-kerberos Interact with Kerberos tickets.
rdpsign A tool for signing Remote Desktop Protocol (RDP) files.
remove-appxpackage A PowerShell utility to remove an app package from user accounts.
color Set the console foreground and background colors.
virtualboxvm Manage VirtualBox virtual machines.
vcvarsall Setup the environment variables required for using the Microsoft Visual Studio tools.
replace Replace files.
cmdkey Create, show, and delete stored user names and passwords.
mimikatz-sekurlsa Extract credentials and secrets from memory.
nvm Install, uninstall, or switch between Node.js versions.
slmgr This command is an alias of `slmgr.vbs`.
msedge Modern web browser developed by Microsoft based on the Chromium web browser developed by Google.
mimikatz-lsadump Dump secrets from the Windows Local Security Authority (LSA).
reg-copy Copy keys and their values in the registry.
sdelete Securely delete file/directory from disk, or clean the free space on a volume/physical disk.
reg-load Load saved subkeys into a different subkey in the registry.
tree Display a graphical tree of the directory structure for a path.
rd This command is an alias of `rmdir` on the Command Prompt and `Remove-Item` in PowerShell.
fsutil Display information about file system volumes.
py Python Launcher for Windows that runs with specified Python version.
psexec Execute a command-line process on a remote machine.
reg-restore Restore a key and its values from a native `.hiv` file.
forfiles Select files to execute a specified command on.
reg-unload Remove data from the registry that was loaded using the `reg load` command.
exit Quit the current CMD instance or the current batch file.
cmstp Manage connection service profiles.
sfc Scans the integrity of Windows system files.
mimikatz-standard Basic commands and mimikatz environment management.
get-acl Get the security descriptor for a resource, such as a file or registry key.
if Performs conditional processing in batch scripts.
mimikatz-token List and manipulate security tokens.
gcrane-completion Generate the autocompletion script for gcrane for the specified shell.
pushd Place a directory on a stack so it can be accessed later.
wait-process Waits for the processes to be stopped before accepting more input.
where-object Selects objects from a collection based on their property values.
psversiontable A read-only variable (as `$PSVersionTable`) to get the current PowerShell version.
gpupdate Check and apply Windows Group Policy settings.
sdelete64 This command is the 64 bit version of `sdelete`.
powershell Command-line shell and scripting language designed especially for system administration.
logoff Terminate a login session.
whoami Display details about the current user.
ni In PowerShell, this command is an alias of `New-Item`.
choco-feature Interact with features with Chocolatey.
choco-outdated Check for outdated packages with Chocolatey.
reg-delete Delete keys or their values from the registry.
gl In PowerShell, this command is an alias of `Get-Location`.
ftp Interactively transfer files between a local and remote FTP server.
sc-delete This command is an alias of `sc.exe delete`.
choco-pin Pin a package at a version with Chocolatey.
winget Windows Package Manager.
get-dedupproperties Get Data Deduplication information.
scoop-bucket Manage buckets: Git repositories containing files which describe how scoop installs applications.
vol.py Forensics framework used to analyze volatile memory (RAM) dumps.
type Display the contents of a file.
vswhere Locate Visual Studio 2017 and newer installations.
psping A ping tool that includes TCP ping, latency and bandwidth measurement.
azcopy A file transfer tool for uploading to Azure Cloud Storage Accounts.
mimikatz-vault Extract credentials stored in the Windows Credential Vault.
del Delete one or more files.
choco-info Display detailed information about a package with Chocolatey.
out-string Outputs input objects as a string.
mimikatz-event Manage Windows Event Log records.
new-item Create a new file, directory, symbolic link, or a registry entry.
doskey Manage macros, windows commands and command-lines.
reg-compare Compare keys and their values in the registry.
driverquery Display information about installed device drivers.
getmac Display the MAC addresses of a system.
sc-config This command is an alias of `sc.exe config`.
takeown Take ownership of a file or directory.
sls This command is an alias of `Select-String`.
get-wusettings Get the current Windows Update Agent configuration. Part of external `PSWindowsUpdate` module.
time Display or set the system time.
move-item Move or rename files, directories, registry keys, and other PowerShell data items.
stop-service Stops running services.
choco The Chocolatey package manager.
tskill Ends a process running in a session on a Remote Desktop Session Host.
chromium Open-source web browser principally developed and maintained by Google.
reg-query Display the values of keys and subkeys in the registry.
w32tm Query and control the w32time time synchronization service.
tasklist Display a list of currently running processes on a local or remote machine.
choco-pack Package a NuGet specification into a `nupkg` file.
show-markdown Shows a Markdown file or string in the console in a friendly way using VT100 escape sequences or in a browser using HTML.
msg Send a message to a user or session.
get-wuapiversion Get the Windows Update Agent version. Part of external `PSWindowsUpdate` module.
title Set the title of the command prompt window.
pathping A trace route tool combining features of `ping` and `tracert`.
choice Prompt user to select a choice and return the selected choice index.
chdir This command is an alias of `cd` in Command Prompt, and subsequently `Set-Location` in PowerShell.
get-alias List and get command aliases in the current PowerShell session.
set-volume Sets or changes the file system label of an existing volume.
wget In PowerShell, this command may be an alias of `Invoke-WebRequest` when the original `wget` program (<https://www.gnu.org/software/wget>) is not properly installed.
pipwin A tool to install unofficial Python package binaries on Windows.
mimikatz-service Manage Windows services through mimikatz.
mv In PowerShell, this command is an alias of `Move-Item`.
cinst This command is an alias of `choco install`.
dir List directory contents.
cmd The Windows command interpreter.
choco-uninstall Uninstall packages with Chocolatey.
test-netconnection Display diagnostic information for a connection.
mimikatz-process Manage process privileges and tokens.
netstat Display active TCP connections, ports on which the computer is listening, network adapter statistics, the IP routing table, IPv4 statistics and IPv6 statistics.
mi In PowerShell, this command is an alias of `Move-Item`.
cpush This command is an alias of `choco push`.
uwfmgr Unified Write Filter (UWF).
net System utility to view and modify network-related settings.