vmkatz

VMkatz has been tested across 7 Windows versions and 5 hypervisors/platforms. It supports extracting LSASS credentials, SAM/LSA/DCC2 hashes, and NTDS.dit from various artifacts including memory snapshots (.vmsn, .sav, .vmem, QEMU savevm) and virtual disks (.vmdk, .vdi, .vhdx, LVM block devices, VMFS-6 raw).

Key Capabilities by Platform

• VMware (Workstation/ESXi): Supports LSASS extraction from .vmsn snapshots. When combined with a .vmdk or .vmem file, it can resolve paged-out credentials. It also supports SAM/LSA/DCC2 extraction from .vmdk files and raw VMFS-6 volumes (even while the VM is running).
• VirtualBox: Supports LSASS extraction from .sav files and SAM/LSA/DCC2 from .vdi disks.
• Proxmox/QEMU: Supports extraction from LVM block devices (including live/stopped VMs and Domain Controllers) and QEMU savevm states. It can extract Kerberos and DPAPI keys from QEMU snapshots.
• Hyper-V: Supports modern .vmrs saved states (via a native parser) and legacy .bin/.raw dumps. VHDX disk extraction is supported.
• Folder Mode: In VMware environments, pointing at a VM folder allows for auto-discovery of .vmsn and .vmdk files.

The project is organized into several functional modules:

• memory/: Defines PhysicalMemory and VirtualMemory traits.
• paging/: Handles address translation, page table walking, and pagefile resolution.
• windows/: Manages EPROCESS discovery and Windows version offset tables.
• lsass/: The core orchestrator for LSASS extraction, including crypto providers (MSV1_0, WDigest, Kerberos, etc.) and BitLocker FVEK extraction.
• sam/: Handles registry hive parsing, bootkey extraction, SAM/LSA/DCC2 decryption, and NTFS reading.
• disk/: Contains handlers for various virtual disk formats (VMDK, VDI, QCOW2, VHD, VHDX, RAW, VMFS).
• ntds/: Provides the ESE (JET Blue) database parser for NTDS.dit extraction.
• qemu/, vmware/, vbox/, hyperv/: Hypervisor-specific memory layer implementations.

src/
├── main.rs              CLI dispatch, format detection, output formatting
├── lib.rs               Crate root — feature-gated module declarations
├── error.rs             VmkatzError type
├── utils.ts             Endian helpers, hex, UTF-16LE decode, mmap helpers
├── memory/
│   └── reader.rs        PhysicalMemory and VirtualMemory traits
├── pe/                  PE header parser (exports, sections, data directories)
├── minidump.rs         MDMP parser — VirtualMemory trait over minidump regions
├── discover.rs          Directory/recursive auto-discovery of VM files
├── paging/
│   ├── mod.rs           4-level x64 page table walker (CR3 → PTE)
│   ├── translate.ts     Address translation core
│   ├── entry.rs         Page table entry decoding
│   ├── ept.rs           Extended Page Table scanner (VBS/nested Hyper-V)
│   ├── filebacked.rs    DLL section mapping from disk
│   └── pagefile.rs      Pagefile.sys fault resolution from disk
├── windows/
│   ├── process.rs       EPROCESS discovery (System process, process enumeration)
│   └── offsets.rs       EPROCESS offset tables (WinXP SP3 → Win11 24H2, x64 + x86 PAE)
├── lsass/
│   ├── finder.rs        Main extraction orchestrator (PhysicalMemory + minidump paths)
│   ├── crypto.rs        LSASS decryption (AES-CBC, 3DES-CBC, DES-X-CBC, RC4)
│   ├── patterns.rs      Signature patterns for crypto key discovery in DLL sections
│   ├── types.rs         Credential, LogonSession, DpapiCredential structs
│   ├── msv.rs           MSV1_0 provider (NT/LM/SHA1 hashes)
│   ├── wdigest.rs      WDigest provider (plaintext passwords)
│   ├── kerberos.rs     Kerberos provider (tickets, passwords, ticket carving)
│   ├── tspkg.rs        TsPkg provider (RDP plaintext)
│   ├── dpapi.rs        DPAPI provider (master key cache)
│   ├── ssp.rs          SSP provider (plaintext credentials)
│   ├── livessp.rs      LiveSSP provider (plaintext, rare post-Win8)
│   ├── credman.rs      Credential Manager (stored credentials)
│   ├── cloudap.rs      CloudAP provider (Azure AD tokens)
│   ├── bitlocker.rs    BitLocker FVEK extraction from memory (pool tag scan)
│   └── carve.rs        [feature: carve] Degraded extraction for partial memory
├── dump.rs             [feature: dump] Process memory → minidump writer
├── vmware/             [feature: vmware] VMware .vmsn/.vmem/.vmss layer
├── vbox/              [feature: vbox] VirtualBox .sav layer
├── qemu/               [feature: qemu] QEMU ELF core dump + Proxmox savevm layer
├── hyperv/             [feature: hyperv] Hyper-V .vmrs/.bin/.raw layer (native VMRS parser)
├── sam/
│   ├── mod.rs           Orchestration, disk extraction entry point
│   ├── hive.rs          Windows registry hive parser (regf format)
│   ├── bootkey.rs       Bootkey extraction from SYSTEM hive
│   ├── hashes.rs        SAM hash decryption (AES-CBC, RC4, MD5, DES)
│   ├── lsa.rs           LSA secrets decryption (DPAPI system keys, service passwords)
│   ├── cache.rs         Cached domain credentials (DCC2)
│   ├── dpapi_masterkey.rs  DPAPI master key file parser (hashcat 15300/15900)
│   ├── aes_xts.rs       AES-XTS sector decryption (for BitLocker)
│   ├── bitlocker_decrypt.rs  BitLocker transparent decrypting Read+Seek wrapper
│   ├── partition.rs    MBR/GPT partition table parser
│   ├── ntfs_reader.rs   NTFS file reader (SAM/SYSTEM/SECURITY discovery)
│   ├── ntfs_fallback.rs NTFS fallback parser (no external crate)
│   └── disk_fallbacks.rs Fallback hive search for non-standard layouts
│   └── vmdk_scan.rs     Sparse VMDK descriptor + extent parser
├── disk/
│   ├── vmdk.rs          VMware sparse/flat VMDK
│   ├── vdi.rs          VirtualBox VDI (+ differencing chain)
│   ├── qcow2.rs         QEMU QCOW2 (+ backing files)
│   ├── vhd.rs           Hyper-V VHD (legacy)
│   ├── vhdx.rs         Hyper-V VHDX
│   ├── raw.rs           Raw/block device passthrough
│   └── vmfs.rs          [feature: vmfs] VMFS-5/6 raw parser (LVM → SFD → FDC → FD → data)
└── ntds/
    └── [feature: ntds.dit] NTDS.dit ESE database parser

VMkatz uses a multi-layered approach to extract credentials from virtual machine snapshots or virtual disks:

1. Memory Abstraction: It uses a PhysicalMemory trait to abstract different hypervisor formats (VMware, VirtualBox, QEMU, Hyper-V), exposing guest physical memory as a flat address space.
2. Process Discovery: It scans physical memory for EPROCESS structures using signature matching (System\0 at the ImageFileName offset) across 18 known Windows versions (WinXP SP3 through Win11 24H2).
3. Address Translation: It performs page table walking (4-level x64 or 3-level PAE) using the kernel DTB (CR3) to translate virtual addresses to physical ones, supporting TLB caches, large pages, and pagefile fault resolution.
4. LSASS Extraction: It locates lsass.exe, maps its virtual address space, enumerates DLLs (like lsasrv.dll, msv1_0.dll, etc.) via PEB/LDR, and decrypts credentials in-memory using various algorithms (AES, 3DES, RC4, etc.). This also works on LSASS minidumps (.dmp).
5. Disk Extraction: It parses virtual disk containers (VMDK, VDI, QCOW2, VHDX, etc.) to find Windows partitions. It can detect BitLocker-encrypted volumes, walk the NTFS MFT to find SAM, SYSTEM, and SECURITY hives, and decrypt hashes using the boot key.
6. NTDS Extraction: For domain controllers, it locates NTDS.dit and the SYSTEM hive, parses the ESE (JET Blue) database, extracts the PEK (Password Encryption Key), and decrypts NT/LM hashes for all AD accounts.

On ESXi 7.0+ where execInstalledOnly is set to 1, unsigned binaries cannot be executed directly. You can bypass this by using the provided vmkatz_loader.py. The loader maps the vmkatz binary into anonymous memory pages, which ESXi allows even when execve is blocked for unsigned files.

Requirements:

• Upload both the vmkatz binary and tools/vmkatz_loader.py to the ESXi host.
• Compatible with ESXi 6.5+ (Python 2.7), 6.7+ (Python 3.5), and 8.0+ (Python 3.8).

Usage:

# Upload both files
scp tools/vmkatz_loader.py target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/

# Run through the loader
python3 /tmp/vmkatz_loader.py /tmp/vmkatz /tmp/path/to/snapshot.vmsn

# Upload both files
scp tools/vmkatz_loader.py target/x86_64-unknown-linux-musl/release/vmkatz root@esxi:/tmp/

# Run through the loader (no need to disable execInstalledOnly)
python3 /tmp/vmkatz_loader.py /tmp/vmkatz /vmfs/volumes/datastore1/MyVM/snapshot.vmsn

# Works on ESXi 6.5+ (Python 2.7), 6.7+ (Python 3.5), 8.0+ (Python 3.8)
python /tmp/vmkatz_loader.py /tmp/vmkatz --vmfs-list

VMkatz is a single static binary used to extract Windows secrets (NTLM hashes, DPAPI keys, Kerberos tickets, etc.) directly from VM memory snapshots and virtual disks without needing to exfiltrate the entire disk image.

Common tasks include:

• Extracting LSASS credentials from a VMware snapshot.
• Extracting SAM/LSA/DCC2 from a virtual disk.
• Extracting Active Directory hashes from a domain controller disk.
• Pointing the tool at a VM directory for auto-discovery.
• Parsing LSASS minidumps.

# Extract LSASS credentials from a VMware snapshot
./vmkatz snapshot.vmsn

# With pagefile resolution for paged-out creds
./vmkatz --disk disk.vmdk snapshot.vmsn

# Extract SAM/LSA/DCC2 from a virtual disk
./vmkatz disk.vmdk

# Extract AD hashes from a domain controller disk
./vmkatz --ntds dc-disk.qcow2

# Point at a VM folder and let it find everything
./vmkatz /path/to/vm-directory/

# Extract from raw registry hives
./vmkatz SAM SYSTEM SECURITY

# Output as hashcat-ready hashes
./vmkatz --format hashcat snapshot.vmsn

# Export Kerberos tickets
./vmkatz --kirbi snapshot.vmsn        # .kirbi files
./vmkatz --ccache snapshot.vmsn       # .ccache file

# Export BitLocker FVEK for dislocker
./vmkatz --bitlocker-fvek /tmp/keys snapshot.vmsn

# Recursively scan all VMs under a path
./vmkatz -r /vmfs/volumes/datastore1/

# Parse LSASS minidump
./vmkatz lsass.dmp

The carving process is designed to be resilient to memory corruption or incomplete snapshots through a tiered approach:

• Level 1: EPROCESS Discovery: The scanner looks for the lsass.exe\0\0\0\0\0\0 pattern in physical memory to identify the EPROCESS structure. It validates the candidate by checking the PID, DTB (Directory Table Base), and the PEB (Process Environment Block). If a valid LSASS process is found, it attempts a full credential extraction.
• Level 2: Signature-based Carving: If no valid LSASS process is identified, the tool switches to scanning every 4KB physical page for specific byte patterns:
  • MSSK keys: BCRYPT_KEY81 structures used for crypto.
  • Primary credential signatures: ANSI_STRING patterns (specifically 0x0008_0007) associated with MSV credentials.
  • DPAPI entries: Signatures for DPAPI master keys.
  • Session metadata: Scanning for LIST_ENTRY structures (like LIST_63, LIST_65, etc.) to recover usernames, domains, and logon times associated with discovered LUIDs.