Mimikatz

What it does

Mimikatz dumps plaintext passwords, hashes, and Kerberos tickets from Windows memory, enabling pass-the-hash and pass-the-ticket attacks. It's a cornerstone of Active Directory compromise.

Common use cases

• •Dump plaintext passwords and NTLM hashes from a compromised Windows host for lateral movement.
• •Extract Kerberos TGT and TGS tickets to perform pass-the-ticket across the domain.
• •Forge Silver Tickets to impersonate any service account within Active Directory.

Key features

• •Extracts credentials from LSASS memory including WDigest, Kerberos, and NTLM.
• •Supports pass-the-hash and pass-the-ticket for authentication without plaintext passwords.
• •Forges Kerberos Golden and Silver Tickets for domain persistence.
• •Operates from a reflective DLL loader to avoid disk writes.

Source