TLDR Tech / InfoSec
VMkatz (GitHub Repo)
VMkatz is a ~2.5 MB static binary that extracts Windows credentials directly from VM memory snapshots and virtual disks across VMware, VirtualBox, Proxmox, and Hyper-V without exfiltrating disk images. It supports all 9 LSASS SSP providers via in-place decryption, native VMFS-6 raw SCSI access to bypass file locks on running ESXi VMs, and natively parses NTDS.dit ESE databases for full Active Directory hash extraction with no impacket or external dependencies.
Read the full story