Which tool is used to extract authentication credentials from memory (LSASS) on Windows, and has a Meterpreter module?

• A. Aircrack-ng
• B. Mimikatz
• C. Hydra
• D. Ncrack

Answer: (B)

Extracting credentials from LSASS memory on Windows is a credential-dumping task that relies on reading the Local Security Authority Subsystem Service’s memory to recover sensitive data like plaintext passwords, hashes, and Kerberos tickets. Mimikatz is specifically designed for this purpose, capable of pulling those credentials directly from LSASS. In Metasploit, there is a Meterpreter module that uses Mimikatz to perform credential dumping on a compromised Windows host, making it a go-to choice for post-exploitation credential access. The other tools serve different purposes: Aircrack-ng focuses on wireless network cracking, while Hydra and Ncrack are used for brute-forcing credentials against network services rather than extracting memory-stored credentials or integrating with Meterpreter.