A penetration tester obtained access to an internal host of a given target. Which of the following is the BEST tool to retrieve the passwords of users of the machine exploiting a well-knows…

Mimikatz specifically targets a well-known architectural flaw in Windows where the LSASS (Local Security Authority Subsystem Service) process retains credential material - including NTLM hashes and in some configurations plaintext passwords - in memory to support single sign-on features like WDigest authentication. Because it reads directly from live system memory on an already-compromised host, no prior hash file is needed and no offline cracking is required. This makes it the definitive tool for post-exploitation credential harvesting on Windows systems.

John the Ripper is an offline password hash cracker that requires a pre-obtained hash file as input and cannot extract credentials directly from a live Windows process or memory space.

RainCrack is a rainbow table-based offline cracking tool that matches stored hashes against precomputed tables and has no capability to interface with live Windows system memory.

Hashcat is a GPU-accelerated offline hash cracking utility that requires pre-obtained hashes and cannot perform live credential extraction from a running operating system's memory.