nikaiw/VMkatz

Health v2 · maintenance only

Adoption not part of the score

1507 stars · 177 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

VMkatz is a Rust CLI tool that extracts Windows credentials (NTLM hashes, DPAPI keys, Kerberos tickets, LSA secrets, BitLocker keys) directly from VM memory snapshots and virtual disks. It runs in place on hypervisors or NAS devices, avoiding the need to exfiltrate large disk images.

Use cases

• extract ntlm hashes from vmware memory snapshots
• dump lsass credentials from vmdk or vmsn files
• get windows passwords from virtual disks without booting the vm
• pull kerberos tickets and dpapi master keys from vm snapshots
• extract sam hashes and lsa secrets from a windows vm disk offline
• harvest credentials on an esxi host during a red team engagement
• recover bitlocker keys from vm memory dumps

When to choose

• you need Windows credentials from VM files you can access but cannot or should not copy
• you want mimikatz-style extraction without running code on the live guest
• you work on ESXi, Proxmox, or NAS storage and need a small static binary
• you need offline SAM/LSA/DPAPI extraction from virtual disks

When to avoid

• you need to dump credentials from a running live system rather than snapshots or disks
• you need a general-purpose forensics suite rather than credential extraction
• you lack legal authorization to access the target VM files

Facets

cli-tool · maturity active

security cli developer-tools security penetration-testing windows windows cli cross-platform credential-extraction mimikatz lsass vmware esxi vmdk qcow2 red-team post-exploitation ntlm dpapi offline-forensics virtualization linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nikaiw/VMkatz")