What is the purpose of the sekurlsa::wdigest module in Mimikatz and how does it work at a high level?
The sekurlsa::wdigest module extracts plaintext credentials from the LSASS process by reading and decrypting stored WDigest data. It first elevates to Debug privileges, obtains a handle to lsass.exe, then locates the memory positions of wdigest.dll and lsasrv.dll. Using the IV, AES, and 3DES keys retrieved from lsasrv.dll, it decrypts the credential information found in wdigest.dll. This process is detailed in the Implementation of sekurlsa::wdigest in Mimikatz article.
Mimikatzsekurlsa::wdigestLSASScredential extractionWDigest