Stealing Credentials
Last updated
Was this helpful?
Last updated
Was this helpful?
Find other things that Mimikatz can do in .
This protections could prevent Mimikatz from extracting some credentials.
Note: Some AV may detect as malicious the use of procdump.exe to dump lsass.exe, this is because they are detecting the string "procdump.exe" and "lsass.exe". So it is stealthier to pass as an argument the PID of lsass.exe to procdump instead of the name lsass.exe.
We just have to keep in mind that this technique can only be executed as SYSTEM.
This files should be located in C:\windows\system32\config\SAM and C:\windows\system32\config\SYSTEM. But you cannot just copy them in a regular way because they protected.
The easiest way to steal those files is to get a copy from the registry:
Download those files to your Kali machine and extract the hashes using:
You can perform copy of protected files using this service. You need to be Administrator.
vssadmin binary is only available in Windows Server versions
But you can do the same from Powershell. This is an example of how to copy the SAM file (the hard drive used is "C:" and its saved to C:\users\Public) but you can use this for copying any protected file:
The Ntds.dit file is a database that stores Active Directory data, including information about user objects, groups, and group membership. It includes the password hashes for all users in the domain.
The important NTDS.dit file will be located in: %SystemRoom%/NTDS/ntds.dit This file is a database Extensible Storage Engine (ESE) and is "officially" composed by 3 tables:
Data Table: Contains the information about the objects (users, groups...)
Link Table: Information about the relations (member of...)
SD Table: Contains the security descriptors of each object
Windows uses Ntdsa.dll to interact with that file and its used by lsass.exe. Then, part of the NTDS.dit file could be located inside the lsass memory (you can find the lastet accessed data probably because of the performance impruve by using a cache).
The hash is cyphered 3 times:
Decrypt Password Encryption Key (PEK) using the BOOTKEY and RC4.
Decrypt tha hash using PEK and RC4.
Decrypt the hash using DES.
PEK have the same value in every domain controller, but it is cyphered inside the NTDS.dit file using the BOOTKEY of the SYSTEM file of the domain controller (is different between domain controllers). This is why to get the credentials from the NTDS.dit file you need the files NTDS.dit and SYSTEM (C:\Windows\System32\config\SYSTEM).
Available since Windows Server 2008.
Once you have obtained the files NTDS.dit and SYSTEM you can use tools like secretsdump.py to extract the hashes:
You can also extract them automatically using a valid domain admin user:
Finally, you can also use the metasploit module: post/windows/gather/credentials/domain_hashdump or mimikatz lsadump::lsa /inject
Extract credentials from the SAM file
Extract credentials from the SAM file
Use the that I have created to search for passwords and hashes inside the victim.
As Procdump from is a legitimate Microsoft tool, it's not detected by Defender. You can use this tool to dump the lsass process, download the dump and extract the credentials locally from the dump.
This process is done automatically with : ./spraykatz.py -u H4x0r -p L0c4L4dm1n -t 192.168.1.0/24
There’s a DLL called comsvcs.dll, located in C:\Windows\System32 that dumps process memory whenever they crash. This DLL contains a function called MiniDumpW that is written so it can be called with rundll32.exe.
The first two arguments are not used, but the third one is split into 3 parts. First part is the process ID that will be dumped, second part is the dump file location, and third part is the word full. There is no other choice.
Once these 3 arguments has been parsed, basically this DLL creates the dump file, and dumps the specified process into that dump file.
Thanks to this function, we can use comsvcs.dll to dump lsass process instead of uploading procdump and executing it. (This information was extracted from )
You can automate this process with .
Code from the book:
Finally, you could also use the to make a copy of SAM, SYSTEM and ntds.dit.
More information about this:
You could also use the **trick to copy the ntds.dit file. Remember that you will also need a copy of the SYSTEM file (again, [dump it from the registry or use the volume shadow copy](./#stealing-sam-and-system) **trick).
For big NTDS.dit files it's recommend to extract it using .
Download the binary from . you can use this binary to extract credentials from several software.
This tool can be used to extract credentials from the memory. Download it from:
Download it from: and just execute it and the passwords will be extracted.
********