Red Teaming Experiments
linkedin
github
@spotheplanet
patreon
Search…
What is ired.team?
Pinned
Pentesting Cheatsheets
Active Directory & Kerberos Abuse
offensive security
Red Team Infrastructure
Initial Access
Code Execution
Code & Process Injection
Defense Evasion
Enumeration and Discovery
Privilege Escalation
Credential Access & Dumping
Dumping Credentials from Lsass Process Memory with Mimikatz
Dumping Lsass Without Mimikatz
Dumping Lsass without Mimikatz with MiniDumpWriteDump
Dumping Hashes from SAM via Registry
Dumping SAM via esentutl.exe
Dumping LSA Secrets
Dumping and Cracking mscash - Cached Domain Credentials
Dumping Domain Controller Hashes Locally and Remotely
Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy
Network vs Interactive Logons
Reading DPAPI Encrypted Secrets with Mimikatz and C++
Credentials in Registry
Password Filter
Forcing WDigest to Store Credentials in Plaintext
Dumping Delegated Default Kerberos and NTLM Credentials w/o Touching Lsass
Intercepting Logon Credentials via Custom Security Support Provider and Authentication Packages
Pulling Web Application Passwords by Hooking HTML Input Fields
Intercepting Logon Credentials by Hooking msv1_0!SpAcceptCredentials
Credentials Collection via CredUIPromptForCredentials
Lateral Movement
Persistence
Exfiltration
reversing, forensics & misc
Internals
Cloud
Neo4j
Dump Virtual Box Memory
AES Encryption Using Crypto++ .lib in Visual Studio C++
Reversing Password Checking Routine
Powered By
GitBook
Credentials in Registry
Internal recon, hunting for passwords in Windows registry
Execution
Scanning registry hives for the value
password
:
[email protected]
1
reg query HKLM
/
f password
/
t REG_SZ
/
s
2
# or
3
reg query HKCU
/
f password
/
t REG_SZ
/
s
Copied!
Observations
As a defender, you may want to monitor commandline argument logs and look for any that include
req query
and
password
strings:
References
Unsecured Credentials: Credentials in Registry, Sub-technique T1552.002 - Enterprise | MITRE ATT&CK®
Previous
Reading DPAPI Encrypted Secrets with Mimikatz and C++
Next
Password Filter
Last modified
3yr ago
Copy link
Contents
Execution
Observations
References