Skip to content

Back to the catalog

nikaiw/VMkatz
github.comrepo

nikaiw/VMkatz

VMkatz is a static Rust binary that reimplements mimikatz's credential-extraction logic against offline VM artifacts — .vmsn snapshots, .vmdk/.qcow2 disks, or raw registry hives — instead of live LSASS. It supports all nine mimikatz SSP credential providers plus SAM/LSA/DCC2 dumping, DPAPI master-key extraction in hashcat format, a native ESE parser for NTDS.dit, Kerberos ticket export (kirbi/ccache), and BitLocker FVEK recovery/decryption via memory pool-tag scanning. It's designed to run directly on ESXi/Proxmox hosts or NAS storage (with a Python loader to bypass ESXi's execInstalledOnly VIB protection), letting operators pull credentials in place rather than exfiltrating hundreds of GB of disk images.

TL;DR Rust tool that dumps mimikatz-style Windows credentials (NTLM, DPAPI, Kerberos, NTDS.dit, BitLocker keys) directly from VM snapshots/disks on ESXi/Proxmox/NAS without exfiltrating the images.
Open original ↗

Technologies named here

Techniques named here

  • LSASS credential extraction from VM memory snapshots
  • SAM hash extraction
  • LSA secrets extraction
  • Cached domain credentials extraction
  • DPAPI master key extraction
  • NTDS.dit parsing
  • BitLocker FVEK extraction from memory
  • Kerberos ticket export
  • Pagefile resolution for paged-out credentials
  • VMFS raw device access / VM folder auto-discovery
  • VIB protection bypass
  • In-place credential extraction instead of disk exfiltration

Related in Offensive Security