Mimikatz

v2.2.0 (20231121)Benjamin Delpy (gentilkiwi)

The classic Windows credential-dumping tool. In the range it acts as an educational reference: it prints the modules and commands, then reports the authored artifacts the scenario provides (LSASS excerpts, cached ticket summaries) rather than touching a real LSASS process.

Category: Credential attack & password auditing
Package: mimikatz
Runs on: Windows
Commands: mimikatz

Prints the authored credential artifacts the scenario models. No LSASS process is opened and no ticket is stolen.

Install it

The scripts below install the real Benjamin Delpy (gentilkiwi) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-mimikatz.sh

No Linux build. Run this one on a Windows host in the range.

Windows installer (PowerShell)

Install-mimikatz.ps1

Mimikatz has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

No Linux build. Run this one on a Windows host in the range.

On Windows

Release archive

Unblock the download first
```
Unblock-File .\mimikatz.zip
```
Windows marks anything from the internet; unblock it or the extract fails.

Unpack it under C:\Tools

Expand-Archive .\mimikatz.zip -DestinationPath C:\Tools\mimikatz

Put it on PATH
```
setx PATH "$env:PATH;C:\Tools\mimikatz"
```

Check it worked

Confirm it resolves
```
where mimikatz
```
Check the version
```
mimikatz --version
```
The range reports 2.2.0 (20231121).

Remove it

Take it off again

Remove-Item -Recurse -Force C:\Tools\mimikatz

Inside the range

Tick it on the launch screen
Under Mimikatz's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
winget install --id mimikatz -e
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Mimikatz

Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Pentest: Purple-Team EmulationPlay both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Pentest: Defense Evasion and EDR SidestepOn an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Pentest: Ransomware Adversary EmulationEmulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.