VMkatz (extract Windows credentials from VMs) in v1.5.2 released
By SecBurg
VMkatz extracts Windows credentials like NTLM hashes, Kerberos tickets, DPAPI master keys and LSA secrets directly from VM memory snapshots, virtual disks and Veeam backups - as a single static binary that runs right on hosts like ESXi, Proxmox or a NAS, so the VM files don’t have to be exfiltrated first.
The new version v1.5.2 is a big roll-up release. Credential extraction got a lot of fixes for MSV, Kerberos, WDigest and Credential Manager across Windows versions from Vista to Windows 11 24H2 (x86 and x64), and krbtgt keys can now be extracted from the KDC service on domain controllers. The NTDS column mapping for unicodePwd and dBCSPwd was swapped and is now corrected.
On the disk side, NTFS partitions on GPT disks are detected, directory enumeration works on a degraded MFT, and VMFS mode can now extract NTDS and DPAPI master keys.
Other highlights:
New `--ls` option for directory listings
New `--partition` option to scope the whole pipeline to one partition (VMFS mode requires `--vmdk` with it)
Registry signature carve is now opt-in via `--registry-carve`
DWM/UMFD virtual-account cleartext is suppressed in the output
CI hardening and main.rs split into CLI modules
See the full list of changes on the release page.
Happy hacking! :-)