Red Teaming Experiments

Red Teaming Experiments

Credential Access & Dumping

Here are the articles in this section:

Dumping Credentials from Lsass.exe Process Memory

Local Security Authority (LSA) credential dumping with in-memory Mimikatz using powershell.

Dumping Lsass.exe to Disk Without Mimikatz and Extracting Credentials

Dumping LSASS without Mimikatz with MiniDumpWriteDump == Reduced Chances of Getting Flagged by AVs

Evasion, Credential Dumping

Dumping Hashes from SAM via Registry

Security Accounts Manager (SAM) credential dumping with living off the land binary.

Dumping SAM via esentutl.exe

Dumping LSA Secrets

Dumping and Cracking mscash - Cached Domain Credentials

Dumping Domain Controller Hashes Locally and Remotely

Dumping NTDS.dit with Active Directory users hashes

Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy

Network vs Interactive Logons

This lab explores/compares when credentials are susceptible to credential dumping.

Reading DPAPI Encrypted Secrets with Mimikatz and C++

T1214: Credentials in Registry

Internal recon, hunting for passwords in Windows registry

T1174: Password Filter

Credential Access

Forcing WDigest to Store Credentials in Plaintext

Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching LSASS

Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages

Credential Access, Persistence

Pulling Web Application Passwords by Hooking HTML Input Fields

Credential Access, Keylogger

Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials

Hooking, Credential Stealing

Credentials Collection via CredUIPromptForCredentials

Weak Service Permissions

Dumping Credentials from Lsass.exe Process Memory

Last updated 2 years ago