Cred Hunting

First part is big bunch of commands from cmd and powershell. Want more delailed info? Use AI. And second big part is just a lot of different techniques and tools. Happy Hunting)

CMD

# Search file
C:\> findstr /s /i flag n:\*.*
C:\> dir n:\*flag* /s /
# Search for Strings within Files
C:\> findstr /si password *.xml *.ini *.txt *.config
C:\> findstr /spin "password" *.*
C:\> cd c:\Users\rio\Documents & findstr /SI /M "password" *.xml *.ini *.txt
C:\> findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.git *.ps1 *.yml
# Search for File Extensions
C:\> dir /S /B *pass*.txt == *pass*.xml == *pass*.ini == *cred* == *vnc* == *.config*
C:\> where /R C:\ *.config

POWERsHELL

# Searching for Files (by Name or Pattern)
PS C:\> Get-ChildItem -Recurse -Path N:\ -Include *flag* -File
PS C:\> Get-ChildItem C:\ -Recurse -Include *.rdp, *.config, *.vnc, *.cred -ErrorAction Ignore
#$ Searching for strings within files
PS C:\> Get-ChildItem -Recurse -Path C:\ | Select-String "flag" -List
PS C:\> Select-String -Path C:\Users\rio\Documents\*.txt -Pattern password

Powershell History File

Powershell Credentials

They are often used for automation and scripting, and usually protected with DPAPI. But If we have gained command execution in the context of this user or can abuse DPAPI, then we can recover the cleartext credentials from encrypted.xml.

SAM Registry Hives Copy

If we have local admin access on target, we could copy three registry SAM hives, which would help us to dump and crack hashes

Registry Hive
Description

HKLM\sam

Hashes associated with local account passwords

HKLM\system

System bootkey, which is encryption/decryption key for SAM

HKLM\security

Cached credentials for domain accounts, it is not 100% needed, but would help a lot

For dumping hives we would use reg.exe as admin

Running secretsdump.py

Remote Dumping

Dumping LSA Secrets Remotely

Dumping SAM Remotely

Dumping NTDS.dit Remotely

LSASS Dumping

Rundll32.exe & Comsvcs.dll Method

IMPORTANT: Anitivirus would see this as malicious activity. The point of method is that we use rundll32.exe to call an exported function of comsvcs.dll which also calls the MiniDumpWriteDump (MiniDump) function to dump the LSASS process memory to a specified directory (C:\lsass.dmp). But to do this we'll need a LSASS PID. with tasklist /svc in cmd or Get-Process lsass in powershell. With PID we could dump LSASS memory.

Shadow Copy of C:

NTDS.dit

Cmdkey Saved Credentials

  • cmdkey can be used to create, list, and delete stored usernames and passwords.

  • Credentials stored for Remote Desktop (RDP) or other remote hosts can be exploited.

Listing Saved Credentials:

  • Saved credentials will be used when connecting via RDP.

  • Can be exploited using runas:

Browser Credentials

Retrieving Saved Credentials from Chrome

Using SharpChrome [LINK] to extract saved passwords:

  • Chrome credential storage can be found at:

    • AES state key: C:\Users\rio\AppData\Local\Google\Chrome\User Data\Local State

    • Login data: C:\Users\rio\AppData\Local\Google\Chrome\User Data\Default\Login Data

  • Credentials can be extracted and reused.

Password Managers

  • Targets include KeePass, 1Password, Thycotic, and CyberArk.

  • KeePass databases (.kdbx) files can be extracted and cracked.

Extracting KeePass Hash:

Cracking KeePass Hash with Hashcat:

  • MailSniper [LINK] can be used to search domain-joined email accounts for passwords.

LaZagne

LaZagne [LINK] is versatile tool which retrieves credentials from browsers, chat clients, databases, sysadmin tools, etc.

Run all modules:

SessionGopher

Extracting Remote Access Credentials

  • Extracts saved PuTTY, WinSCP, FileZilla, and RDP credentials.

Running SessionGopher [LINK]

Windows Registry

Windows AutoLogon

Stored in:

Retrieve:

PuTTY Saved Credentials

Stored in:

Retrieve:

WiFi Passwords

Listing Saved Wireless Networks:

Retrieving Saved Wireless Passwords:

COOKIES

Firefox

Copy Firefox Cookies Database

Extract cookies from database

For this we'll be using cookieextractor.py script [LINK]

  • After this we could use Cookie Editor browser extenstion to paste stolen cookie into our session

Chrome

Chromium-based browsers also use sqlite databases but usually encrypts it with DPAPI, which is commonly used to encrypt data using information from the current user account or computer. To get cookie value we need to decrypt from compromised user session. SharpChromium script [LINK] will help us with it

Invoke-SharpChromium

CLIPBOARD

For this we are using Invoke-ClipboardLogger script [LINK]

INTERESTING FILES

PreviousPivotingNextPrivilege Escalation

Last updated