VMkatz

You are three weeks into a red team engagement. You land on a NAS attached to the virtualization cluster — hundreds of gigabytes of .vmdk, .vmsn, .sav sitting right there. But your link does 200 KB/s. Exfiltrating a single 100 GB disk would take six days.

VMkatz exists because you shouldn't have to exfiltrate what you can read in place. It extracts Windows credentials directly from VM files — memory snapshots, virtual disks, Veeam backups: NTLM hashes, Kerberos tickets, DPAPI master keys, LSA secrets, NTDS.dit, BitLocker keys, browser secrets.

Single static binary, ~3 MB. Drop it on the ESXi host, the Proxmox node, or the NAS. Point it at a VM folder and walk away with credentials, not disk images.

What It Extracts

From memory snapshots (LSASS)

All 9 SSP credential providers that mimikatz implements:

Provider	Data	Notes
MSV1_0	NT/LM hashes, SHA1	Physical-scan fallback for paged entries
WDigest	Plaintext passwords	Linked-list walk + .data fallback
Kerberos	AES/RC4/DES keys, tickets (.kirbi/.ccache)	AVL tree walk + ticket carving for freed sessions
TsPkg	Plaintext passwords	RDP sessions only
DPAPI	Master key cache (GUID + decrypted key)	SHA1 masterkey for offline DPAPI decrypt
SSP	Plaintext credentials	SspCredentialList in msv1_0.dll
LiveSSP	Plaintext credentials	Requires livessp.dll (rare post-Win8)
Credman	Stored credentials	Hash-table + single-list enumeration
CloudAP	Azure AD tokens	Typically empty for local-only logon

Plus: BitLocker FVEK extraction from memory (pool tag scan for FVEc/Cngb).

From virtual disks (offline)

• SAM hashes: Local account NT/LM hashes with account status (disabled, blank password)
• LSA secrets: Service account passwords, auto-logon credentials, machine account keys
• Cached domain credentials: DCC2 hashes (last N domain logons)
• DPAPI master keys: Hashcat-ready hashes ($DPAPImk$ — modes 15300/15310/15900/15910)
• NTDS.dit: Full Active Directory hash extraction from domain controller disks (native ESE parser)
• BitLocker decryption: Transparent disk decryption using FVEK extracted from memory

Supported Inputs

Format	Extensions	Source	Status
VMware snapshots	.vmsn + .vmem	Workstation, ESXi	Tested
VMware embedded snapshots	.vmsn (no .vmem)	ESXi suspend	Tested
VirtualBox saved states	.sav	VirtualBox	Tested
QEMU/KVM savevm states	auto-detected	Proxmox, QEMU	Tested
QEMU/KVM ELF core dumps	.elf	virsh dump	Tested
Hyper-V saved states	.vmrs	Hyper-V 2016+	Tested
Veeam backups	.vbk, .vib, .vrb	Veeam B&R	Tested
VMware virtual disks	.vmdk (sparse + flat)	Workstation, ESXi	Tested
VirtualBox virtual disks	.vdi	VirtualBox	Tested
QEMU/KVM virtual disks	.qcow2	QEMU, Proxmox	Tested
Hyper-V virtual disks	.vhdx, .vhd	Hyper-V	Tested
VMFS-5/6 raw SCSI devices	/dev/disks/...	ESXi (bypasses file locks)	Tested
LVM block devices	/dev/...	Proxmox LVM-thin	Tested
Raw registry hives	SAM, SYSTEM, SECURITY	reg save	Tested
Raw NTDS.dit	ntds.dit + SYSTEM	Domain controller	Tested
LSASS minidump	.dmp	procdump, Task Manager	Tested
VM directories	any folder	Auto-discovers all files	Tested

Target OS: Windows Server 2003 through Windows Server 2025 / Windows 11 24H2 (x86 PAE + x64).

Quick Start

# Extract LSASS credentials from a VMware snapshot
./vmkatz snapshot.vmsn

# With pagefile resolution for paged-out creds
./vmkatz --disk disk.vmdk snapshot.vmsn

# Extract SAM/LSA/DCC2 from a virtual disk
./vmkatz disk.vmdk

# Extract AD hashes from a domain controller disk
./vmkatz --ntds dc-disk.qcow2

# Point at a VM folder and let it find everything
./vmkatz /path/to/vm-directory/

# Extract from raw registry hives
./vmkatz SAM SYSTEM SECURITY

# Output as hashcat-ready hashes
./vmkatz --format hashcat snapshot.vmsn

# Export Kerberos tickets
./vmkatz --kirbi snapshot.vmsn        # .kirbi files
./vmkatz --ccache snapshot.vmsn       # .ccache file

# Export BitLocker FVEK for dislocker
./vmkatz --bitlocker-fvek /tmp/keys snapshot.vmsn

# Recursively scan all VMs under a path
./vmkatz -r /vmfs/volumes/datastore1/

# Parse LSASS minidump
./vmkatz lsass.dmp

# Extract from Hyper-V saved state
./vmkatz guest.vmrs

# Extract from Veeam backup (build with --features veeam)
./vmkatz backup.vbk
./vmkatz --veeam-list backup.vbk               # List disk images
./vmkatz --veeam-extract backup.vbk            # Extract raw disk

Output Formats

Format	Flag	Description
text	--format text (default)	Full credential dump with session metadata
brief	--format brief	Compact one-line-per-credential summary
ntlm	--format ntlm	DOMAIN\user:::hash::: pwdump format
hashcat	--format hashcat	Raw hashes: mode 1000 (NTLM), 2100 (DCC2), 15300/15900 (DPAPI)
csv	--format csv	Machine-readable, all fields

Deployment on ESXi

# Cross-compile for ESXi (musl static)
cargo build --release --target x86_64-unknown-linux-musl

# Upload and run
scp target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/
/tmp/vmkatz /vmfs/volumes/datastore1/MyVM/MyVM-Snapshot1.vmsn

When VIB protection (execInstalledOnly) is enabled, use the Python loader — no need to disable the setting:

scp tools/vmkatz_loader.py target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/
python /tmp/vmkatz_loader.py /tmp/vmkatz /vmfs/volumes/datastore1/MyVM/snapshot.vmsn

See docs/esxi.md for VIB bypass details, VMFS raw device access, and auto-discovery.

Build Features

VMkatz is modular. Features can be enabled/disabled at compile time:

Feature	Description	Default
vmware	VMware .vmsn/.vmem snapshot support	Yes
vbox	VirtualBox .sav saved-state support	Yes
qemu	QEMU/KVM ELF core dumps + Proxmox savevm	Yes
hyperv	Hyper-V .vmrs/.bin/.raw dump support	Yes
sam	Disk extraction (SAM/LSA/DCC2) + disk format handlers	Yes
ntds.dit	NTDS.dit AD extraction. Requires sam	Yes
carve	Degraded extraction from partial/truncated memory	Yes
dump	Process memory dump as minidump	Yes
vmfs	VMFS-5/6 raw parser for ESXi SCSI devices. Requires sam	Yes
chrome	Browser secrets extraction (Chromium + Firefox). Requires sam	No
veeam	Veeam VBK/VIB/VRB backup support. Requires sam	No

cargo build --release                                              # Full build
cargo build --release --no-default-features --features vmware      # VMware only
cargo build --release --no-default-features --features "sam ntds.dit"  # Disk only
cargo build --release --features chrome                            # Add chrome module
cargo build --release --features veeam                             # Add Veeam backup support

Browser secrets (experimental)

The optional chrome module extracts saved passwords, cookies, and autofill from Chromium-family browsers (Chrome, Edge, Brave, Vivaldi, Opera) via offline DPAPI decryption. Build with --features chrome, enable with --chrome.