mimikatz-crypto

mimikatz crypto

Manipulate Windows cryptographic services and certificates, allowing you to list and export certificates and keys, even those marked as non-exportable. It generally requires elevated privileges, especially when accessing system keys. More information: https://github.com/gentilkiwi/mimikatz.

  • List cryptographic providers:

mimikatz "crypto::providers"

  • List keys in a cryptographic provider:

mimikatz "crypto::capi"

  • Export certificates and keys:

mimikatz "crypto::certificates /export"

windows

choco-list Display a list of packages with Chocolatey.
ping Send ICMP ECHO_REQUEST packets to network hosts.
print.win Print a text file to a printer.
measure-object Calculate the numeric properties of objects, and the characters, words, and lines in string objects, such as files of text.
date Display or set the system date.
tee-object Saves command output in a file or variable and also sends it down the pipeline.
explorer The Windows File Explorer.
systeminfo Display operating system configuration for a local or remote machine.
reg Manage keys and their values in the Windows registry.
wmic Interactive shell for detailed information about running processes.
ver Display the current Windows or MS-DOS version number.
octo Tools for Octopus Deploy.
rm In PowerShell, this command is an alias of `Remove-Item`.
clear-recyclebin Clear items from the Recycle Bin.
pwlauncher Manage the Windows To Go startup options.
mimikatz-dpapi Interact with the Windows Data Protection API (DPAPI).
cl The Microsoft C/C++ compiler for compiling and linking source code files.
expand Uncompress Windows Cabinet files.
set-date Change the system time on the computer to a time that you specify.
mimikatz Interact with Windows credentials, perform credential dumping, token manipulation, and more.
comp Compare the contents of two files or sets of files.
rmdir Remove a directory and its contents.
h This command is an alias of `Get-History`.
scoop The Scoop package manager.
ftype Display or modify file types used for file extension association.
choco-upgrade Upgrade one or more packages with Chocolatey.
pabcnetcclear Preprocess and compile PascalABC.NET source files.
get-location Print name of current/working directory.
eventcreate Create custom entries in the event log.
get-date Get the current date and time.
get-content Get the content of the item at the specified location.
get-help Display help information and documentation for PowerShell commands (aliases, cmdlets, and functions).
subst Associates a path with a virtual drive letter.
mimikatz-misc Miscellaneous system and utility commands.
findstr Find specified text within one or more files.
get-history Display PowerShell command history.
copy Copy files from one location to another.
netsh-interface-portproxy Configure and display the status of various network components.
nfsstat Display or reset the number of calls made to the NFS server.
repair-bde Attempt to repair or decrypt a damaged BitLocker-encrypted volume.
mimikatz-net Perform network and domain operations.
shutdown A tool for shutting down, restarting, or logging off a machine.
clear-history Delete entries from the PowerShell session command history.
compress-archive A cmdlet in PowerShell is used to create compressed (zipped) archive files.
find Find a specified string in files.
tzutil A tool for displaying or configuring the system time zone.
pswindowsupdate A PowerShell external module to manage Windows Update.
rpcinfo List programs via RPC on remote computers.
microsoft-edge The Microsoft Edge command-line utility is available as `msedge` on Windows and `microsoft-edge` for other platforms.
for Conditionally execute a command several times.
mkdir Create a directory.
more Display paginated output from `stdin` or a file.
ren This command is an alias of `Rename-Item`.
test-json Test whether a string is a valid JSON document.
move Move or rename files and directories.
choco-source Manage sources for packages with Chocolatey.
taskkill Terminate a process by its process ID or name.
where Display the location of files that match the search pattern.
assoc Display or change associations between file extensions and file types.
expand-archive A cmdlet in PowerShell is used to extract files from a compressed archive.
chrome This command is an alias of `chromium`.
select-string Finds text in strings and files in PowerShell.
nmake The Microsoft Program Maintenance Utility for building projects based on commands in a makefile.
sc Communicate with the Service Control Manager and services.
fc Compare the differences between two files or sets of files.
invoke-webrequest Perform a HTTP/HTTPS request to the Web.
bleachbit_console Clean junk files on the filesystem.
ghy This command is an alias of `Get-History`.
set-alias A PowerShell command to set or modify alias.
bleachbit This command is an alias of `bleachbit_console`.
install-module Install PowerShell modules from PowerShell Gallery, NuGet, and other repositories.
finger Return information about users on a specified system.
choco-push Push a compiled NuGet package (`.nupkg`) to a package feed.
cuninst This command is an alias of `choco uninstall`.
get-command List and get available commands in the current PowerShell session.
pwd In PowerShell, this command is an alias of `Get-Location`.
choco-install Install one or more packages with Chocolatey.
enable-pnpdevice The Enable-PnpDevice cmdlet enables a Plug and Play (PnP) device. You must use an Administrator account to enable a device.
ventoy2disk A tool to create bootable USB drives using ISO files on Windows systems.
reg-save Save a registry key, its subkeys and values to a native `.hiv` file.
resolve-path Resolve the wildcard characters in a path, and display the path contents.
ventoy This command is an alias of `Ventoy2Disk`.
robocopy Robust File and Folder Copy.
popd Change the current directory to the directory stored by the `pushd` command.
start-service Start stopped services.
lib The Microsoft Library Manager for creating and managing static libraries of object files.
rename-item Powershell command to rename an item.
clear-host Clears the screen.
get-filehash Calculate a hash for a file.
get-childitem List items in a directory.
mimikatz-crypto Manipulate Windows cryptographic services and certificates, allowing you to list and export certificates and keys, even those marked as non-exportable.
reg-export Export the specified subkeys and values to a `.reg` file.
wsl-open Open a file or URL from within Windows Subsystem for Linux in the user's default Windows GUI application.
cleanmgr Clear unnecessary files from the computer's hard disk.
ri In PowerShell, this command is an alias of `Remove-Item`.
msiexec Install, update, repair, or uninstall Windows programs using MSI and MSP package files.
reg-import Import all available keys, subkeys, and values from a `.reg` file.
mount Mount Network File System (NFS) network shares.
clear In PowerShell, this command is an alias of `Clear-Host`.
es Command-line interface for Everything, a fast file and folder search tool for Windows.
measure-command Measures the time it takes to run script blocks and cmdlets.
wsl Manage the Windows Subsystem for Linux.
sl In PowerShell, this command is an alias of `Set-Location`.
add-appxpackage A PowerShell utility to add a signed app package (`.appx`, `.msix`, `.appxbundle` and `.msixbundle`) to a user account.
choco-new Generate new package specification files with Chocolatey.
fondue Install optional Windows features.
invoke-item Open files in their respective default programs.
set-service Start, stop, and suspend a service, and changes its properties.
pwsh-where This command is an alias of `Where-Object`.
setx Set persistent environment variables.
cls Clears the screen.
gal In PowerShell, this command is an alias of `Get-Alias`.
choco-apikey Manage API keys for Chocolatey sources.
curl In PowerShell, this command may be an alias of `Invoke-WebRequest` when the original `curl` program (<https://curl.se>) is not properly installed.
showmount Display information about NFS filesystems on Windows Server.
sort-object Sorts objects by property values.
diskpart Disk, volume, and partition manager.
bcdboot Configure or repair boot files.
history This command is an alias of `Get-History`.
vol Display information about volumes.
chkdsk Check filesystem and volume metadata for errors.
powercfg Configure power settings and manage power schemes.
clip Copy input content to the Windows clipboard.
set-acl Change the security descriptor of a specified item, such as a file or a registry key.
gcb This command is an alias of `Get-Clipboard`.
slmgr.vbs Install, activate, and manage Windows licenses.
clist This command is an alias of `choco list`.
iscc Compiler for Inno Setup installers.
mimikatz-privilege Manage privileges for mimikatz operations.
reg-add Add new keys and their values to the registry.
cd Display the current working directory or move to a different directory.
tracert Receive information about each step in the route between your PC and the target.
certutil A tool to manage and configure certificate information.
ospp.vbs Install, activate, and manage volume licensed versions of Microsoft Office products.
xcopy Copy files and directory trees.
remove-item Delete files, folders, as well as registry keys and subkeys.
set Display or set environment variables for the current instance of CMD.
set-location Display the current working directory or move to a different directory.
query Display information about user sessions and process.
attrib Display or change attributes of files or directories.
iwr In PowerShell, this command is an alias of `Invoke-WebRequest`.
get-wuhistory Get the history of installed updates from Windows Update. Part of external `PSWindowsUpdate` module.
prompt Change the default DOS style prompt in a command window.
ipconfig Display and manage the network configuration of Windows.
path Display or set the search path for executable files.
mklink Create symbolic links.
choco-search Search for a local or remote package with Chocolatey.
cipher Display or alter the encryption of directories and files on NTFS volumes.
mimikatz-kerberos Interact with Kerberos tickets.
rdpsign A tool for signing Remote Desktop Protocol (RDP) files.
remove-appxpackage A PowerShell utility to remove an app package from user accounts.
color Set the console foreground and background colors.
virtualboxvm Manage VirtualBox virtual machines.
vcvarsall Setup the environment variables required for using the Microsoft Visual Studio tools.
replace Replace files.
cmdkey Create, show, and delete stored user names and passwords.
mimikatz-sekurlsa Extract credentials and secrets from memory.
nvm Install, uninstall, or switch between Node.js versions.
clhy This command is an alias of `Clear-History`.
slmgr This command is an alias of `slmgr.vbs`.
rni This command is an alias of `Rename-Item`.
msedge Modern web browser developed by Microsoft based on the Chromium web browser developed by Google.
mimikatz-lsadump Dump secrets from the Windows Local Security Authority (LSA).
reg-copy Copy keys and their values in the registry.
sdelete Securely delete file/directory from disk, or clean the free space on a volume/physical disk.
reg-load Load saved subkeys into a different subkey in the registry.
tree Display a graphical tree of the directory structure for a path.
rd This command is an alias of `rmdir` on the Command Prompt and `Remove-Item` in PowerShell.
fsutil Display information about filesystem volumes.
py Python Launcher for Windows that runs with specified Python version.
psexec Execute a command-line process on a remote machine.
reg-restore Restore a key and its values from a native `.hiv` file.
sal This command is an alias of `Set-Alias`.
forfiles Select files to execute a specified command on.
reg-unload Remove data from the registry that was loaded using the `reg load` command.
exit Quit the current CMD instance or the current batch file.
netsh-wlan Manage wireless networks.
cmstp Manage connection service profiles.
sfc Scan the integrity of Windows system files.
mimikatz-standard Basic commands and mimikatz environment management.
get-acl Get the security descriptor for a resource, such as a file or registry key.
if Perform conditional processing in batch scripts.
mimikatz-token List and manipulate security tokens.
gcrane-completion Generate the autocompletion script for gcrane for the specified shell.
pushd Place a directory on a stack so it can be accessed later.
wait-process Waits for the processes to be stopped before accepting more input.
where-object Selects objects from a collection based on their property values.
psversiontable A read-only variable (as `$PSVersionTable`) to get the current PowerShell version.
gpupdate Check and apply Windows Group Policy settings.
sdelete64 This command is the 64 bit version of `sdelete`.
powershell Command-line shell and scripting language designed especially for system administration.
logoff Terminate a login session.
whoami Display details about the current user.
ni In PowerShell, this command is an alias of `New-Item`.
get-clipboard A PowerShell command to get content from clipboard.
choco-feature Interact with features with Chocolatey.
choco-outdated Check for outdated packages with Chocolatey.
reg-delete Delete keys or their values from the registry.
netsh Manage Windows network settings.
gl In PowerShell, this command is an alias of `Get-Location`.
ftp Interactively transfer files between a local and remote FTP server.
choco-pin Pin a package at a version with Chocolatey.
winget Windows Package Manager.
get-dedupproperties Get Data Deduplication information.
scoop-bucket Manage buckets: Git repositories containing files which describe how scoop installs applications.
vol.py Forensics framework used to analyze volatile memory (RAM) dumps.
type Display the contents of a file.
runas Run a program as another user.
vswhere Locate Visual Studio 2017 and newer installations.
psping A ping tool that includes TCP ping, latency, and bandwidth measurement.
pnputil Manage the driver store and driver packages on Windows.
mimikatz-vault Extract credentials stored in the Windows Credential Vault.
del Delete one or more files.
choco-info Display detailed information about a package with Chocolatey.
out-string Output input objects as a string.
mimikatz-event Manage Windows Event Log records.
new-item Create a new file, directory, symbolic link, or a registry entry.
doskey Manage macros, windows commands and command-lines.
reg-compare Compare keys and their values in the registry.
driverquery Display information about installed device drivers.
getmac Display the MAC addresses of a system.
takeown Take ownership of a file or directory.
sls This command is an alias of `Select-String`.
get-wusettings Get the current Windows Update Agent configuration. Part of external `PSWindowsUpdate` module.
time Display or set the system time.
move-item Move or rename files, directories, registry keys, and other PowerShell data items.
stop-service Stop running services.
choco The Chocolatey package manager.
tskill Ends a process running in a session on a Remote Desktop Session Host.
chromium Open-source web browser principally developed and maintained by Google.
scb This command is an alias of `Set-Clipboard`.
reg-query Display the values of keys and subkeys in the registry.
w32tm Query and control the w32time time synchronization service.
tasklist Display a list of currently running processes on a local or remote machine.
choco-pack Package a NuGet specification into a `.nupkg` file.
show-markdown Show a Markdown file or string in the console in a friendly way using VT100 escape sequences or in a browser using HTML.
msg Send a message to a user or session.
get-wuapiversion Get the Windows Update Agent version. Part of external `PSWindowsUpdate` module.
title Set the title of the command prompt window.
pathping A trace route tool combining features of `ping` and `tracert`.
choice Prompt user to select a choice and return the selected choice index.
chdir This command is an alias of `cd` in Command Prompt, and subsequently `Set-Location` in PowerShell.
get-alias List and get command aliases in the current PowerShell session.
set-volume Set or change the filesystem label of an existing volume.
wget In PowerShell, this command may be an alias of `Invoke-WebRequest` when the original `wget` program (<https://www.gnu.org/software/wget>) is not properly installed.
pipwin A tool to install unofficial Python package binaries on Windows.
mimikatz-service Manage Windows services through mimikatz.
mv In PowerShell, this command is an alias of `Move-Item`.
cinst This command is an alias of `choco install`.
dir List directory contents.
cmd The Windows command interpreter.
choco-uninstall Uninstall packages with Chocolatey.
test-netconnection Display diagnostic information for a connection.
mimikatz-process Manage process privileges and tokens.
set-clipboard PowerShell command to set content to clipboard.
netstat Display active TCP connections, ports on which the computer is listening, network adapter statistics, the IP routing table, IPv4 statistics and IPv6 statistics.
mi In PowerShell, this command is an alias of `Move-Item`.
cpush This command is an alias of `choco push`.
uwfmgr Unified Write Filter (UWF).
net System utility to view and modify network-related settings.