# nikaiw/VMkatz

Extract Windows credentials directly from VM memory snapshots and virtual disks

Repository: https://github.com/nikaiw/VMkatz
Canonical: https://ross.abutalabs.com/products/vmkatz
Language: Rust
License: MIT
License Family: permissive
Topics: esxi, lsass, mimikatz, ntlm, offensive-security, post-exploitation, qcow2, vdi, vhdx, virtualbox, vmdk, vmware
Last push: 2026-06-07T18:29:44+00:00

## Health v2 (maintenance only)
Score: 69/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 79, longevity 13
- inputs: {"age_days": 195, "days_push": 87, "days_rel": 140, "gap_med": 4.5, "n_releases_24m": 7}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1507, forks 177 (observed 2026-08-28T04:04:55.220112+00:00)

## What it is
VMkatz is a Rust CLI tool that extracts Windows credentials (NTLM hashes, DPAPI keys, Kerberos tickets, LSA secrets, BitLocker keys) directly from VM memory snapshots and virtual disks. It runs in place on hypervisors or NAS devices, avoiding the need to exfiltrate large disk images.

## Use cases
- extract ntlm hashes from vmware memory snapshots
- dump lsass credentials from vmdk or vmsn files
- get windows passwords from virtual disks without booting the vm
- pull kerberos tickets and dpapi master keys from vm snapshots
- extract sam hashes and lsa secrets from a windows vm disk offline
- harvest credentials on an esxi host during a red team engagement
- recover bitlocker keys from vm memory dumps

## When to choose
- you need Windows credentials from VM files you can access but cannot or should not copy
- you want mimikatz-style extraction without running code on the live guest
- you work on ESXi, Proxmox, or NAS storage and need a small static binary
- you need offline SAM/LSA/DPAPI extraction from virtual disks

## When to avoid
- you need to dump credentials from a running live system rather than snapshots or disks
- you need a general-purpose forensics suite rather than credential extraction
- you lack legal authorization to access the target VM files

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cli, developer-tools
- domain: security, penetration-testing, windows
- platform: windows, cli, cross-platform
- tags: credential-extraction, mimikatz, lsass, vmware, esxi, vmdk, qcow2, red-team, post-exploitation, ntlm, dpapi, offline-forensics, virtualization, linux, macos

## Member repositories
- nikaiw/VMkatz (main) score 69

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:55.220112+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:32:37.782441+00:00, confidence not recorded.
  - readme: https://github.com/nikaiw/VMkatz (fetched 2026-08-28T04:04:55.220112+00:00, sha 67f8c767f390)
- Data as of 2026-08-30T08:39:29.467469+00:00.