So earlier this week the twitter flow went bananas when Remko did a blog about how to extract the password in clear text from a VMware vmem file with the add-on from Benjamin, Mimikatz that extends the windebug.

I wanted to test if it works also in Hyper-V and it is not so much difference, the main difference is how to create the dump file and here I use the vm2dmp (thanks to Yusuf for supplying me with a vm2dmp.exe that works with 2012!!) with the right switches, in this case the VM is in saved state but you can also use snapshots or just the vsv and bin file.

And then when importing the dump into the windbg I can with the commands get the password for the user that was logged in on the Win 7 VM

I have tested this on a Windows 7 virtual machine and also on a Windows Server 2012 R2 virtual machine both running on Hyper-V 2012. This highlights the importance once more that it is crucial to make sure that only the right people have access to the virtualization hosts and the storage where the VM´s resides!