4. Dumping Credentials

Dumping SAM

SAM file typically cannot be access if Windows is running

c:\\Windows\\System32\\config\\sam

So we exploit it via

  • meterpreter

  • mimikatz

  • Volume Shadow Copy Service / Registry Hives

Meterpreter Method

meterpreter > getuid
Server username: THM\\Administrator
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:98d3b784d80d18385cea5ab3aa2a4261:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:ec44ddf5ae100b898e9edab74811430d:::
CREDS-HARVESTIN$:1008:aad3b435b51404eeaad3b435b51404ee:443e64439a4b7fe780db47fc06a3342d:::

Volume Shadow Copy Service / Registry Hives

C:\\Users\\Administrator>wmic shadowcopy call create Volume='C:\\'

Executing (Win32_ShadowCopy)->create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ReturnValue = 0;
        ShadowID = "{D8A11619-474F-40AE-A5A0-C2FAA1D78B85}";
};

Getting info from registry hives

With either the Shadow Copy or SAM from the Registry Hive, we need to decrypt it with the key found in c:\\Windows\\System32\\Config\\system.

Once we get both pieces of information, we move them to the attacker machine to decrypt the information

Dumping LSASS

LSASS contains password hashes

Before dumping LSASS, we need to disable LSA Protection using mimikatz

Creating a dump file via GUI

Dumping via SysinteralsSuite

Dumping via mimikatz

Dumping from Windows Credential Manager

vaultcmd to find any stored credentials

/listproperties to check if there are any stored credentials in the vault

Extract out the password using Get-WebCredentials.ps1

Using cmdkey, we can see which credentials are already stored in the session

Knowing this, we can use runas /savecred to ride on this saved credential in the session for authentication on the domain THM.red

Dumping credentials on the Credential Manager using mimikatz

Dumping from Domain Controller

NTDS

New Technologies Directory Services (NTDS) is a database containing all Active Directory data, including objects, attributes, credentials

NTDS is located in C:\\Windows\\NTDS

Decrypting the NTDS file requires a system Boot Key which is stored in the C:\Windows\System32\config\SECURITY

In essence, we need these 3 files

  • C:\\Windows\\NTDS\\ntds.dit

  • C:\\Windows\\System32\\config\\SYSTEM

  • C:\\Windows\\System32\\config\\SECURITY

Using ntdsutil.exe, this will dump out all 3 files we need in C:\\temp

Get those files on the attacker machines, and decrypt it with impacket to get the hashes

DCSync

Now we analyze the file with grep

impacket

Local Administrator Password Solution (LAPS)

We can check if LAPS is installed by finding the admpwd.dll path

Find Groups that can interact with the LAPS

Finding users in the group

Once we compromise bk-admin, we can then use it to access LAPS

Kerberoasting

Kerberoasting attack involves requesting a Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS).

Using the TGS, we can attempt to brute force the password

We need the SPN (Service Principal Name) accounts such as IIS User, MSSQL, etc

Once we find the SPN user, we can send a single request to get a TGS ticket for the srv-user user using the -request-user argument.

After getting the TGS, we can attempt to crack it to get the password

NTLM Relaying

Responder

On the attacker

On the victim, run this. Responder should get the NTLM hash of the account which you can crack or pass

NTMLRelayx

On the attacker

On the victim, run this. NTLMRelay can capture NTLMv2 which we can crack or relay to authenticate to another server and execute code

Other methods

Powershell history file

Passwords in Registry

Unattended Windows Installations

  • C:\Unattend.xml

  • C:\Windows\Panther\Unattend.xml

  • C:\Windows\Panther\Unattend\Unattend.xml

  • C:\Windows\system32\sysprep.inf

  • C:\Windows\system32\sysprep\sysprep.xml

Saved Credentials

You can’t see the passwords, but you can ride on them

IIS Configuration

Software: PuTTY

Previous3. Enumerating Active DirectoryNext5. Lateral Movement

Last updated