> For the complete documentation index, see [llms.txt](https://blog.mdsathees.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.mdsathees.in/adversary-experience/red-team-plot/credential-access.md).

# Credential Access

Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

![Credit: www.hackingarticles.in](https://1810415247-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMb0KlCGYrnfU4uKZkzyx%2Fuploads%2FOZqHhxsS3rPFeNLVBH1E%2Fimage.png?alt=media\&token=5d9372a2-25c8-4c2b-81ab-055b51760606)

1. [Credential Dumping: Wireless](https://www.hackingarticles.in/credential-dumping-wireless/)
2. [Credential Dumping: Group Policy Preferences (GPP)](https://www.hackingarticles.in/credential-dumping-group-policy-preferences-gpp/)
3. [Credential Dumping: Windows Credential Manager](https://www.hackingarticles.in/credential-dumping-windows-credential-manager/)
4. [Credential Dumping: WDigest](https://www.hackingarticles.in/credential-dumping-wdigest/)
5. [Credential Dumping: Security Support Provider (SSP)](https://www.hackingarticles.in/credential-dumping-security-support-provider-ssp/)
6. [Credential Dumping: SAM](https://www.hackingarticles.in/credential-dumping-sam/)
7. [Credential Dumping: Applications](https://www.hackingarticles.in/credential-dumping-applications/)
8. [Credential Dumping: NTDS.dit](https://www.hackingarticles.in/credential-dumping-ntds-dit/)
9. [Credential Dumping: Phishing Windows Credentials](https://www.hackingarticles.in/credential-dumping-phishing-windows-credentials/)
10. [Credential Dumping: Local Security Authority (LSA|LSASS.EXE)](https://www.hackingarticles.in/credential-dumping-local-security-authority-lsalsass-exe/)
11. [Credential Dumping: Clipboard](https://www.hackingarticles.in/credential-dumping-clipboard/)
12. [Credential Dumping: DCSync Attack](https://www.hackingarticles.in/credential-dumping-dcsync-attack/)
13. [Credential Dumping: LAPS](https://www.hackingarticles.in/credential-dumpinglaps/)
14. [Credential Dumping: Domain Cache Credential](https://www.hackingarticles.in/credential-dumping-domain-cache-credential/)
15. [Credential Dumping: Fake Services](https://www.hackingarticles.in/credential-dumping-fake-services/)
16. [Credential Dumping: Windows Autologon Password](https://www.hackingarticles.in/credential-dumping-windows-autologon-password/)
17. [Internal Monologue](https://www.hackingarticles.in/ntlm-downgrade-attack-internal-monologue/)

{% hint style="info" %}

**LSA**\
On Windows hosts, LSA handles authentication for users. It contains sensitive information that pentesters want to target, such as PC users’ cleartext passwords, service account passwords, Internet Explorer passwords, etc (we need SYSTEM privileges to dump this). But modern versions of Windows do not store domain users’ NTLM hashes as LSA secrets. Instead, Windows employs a subsystem process known as LSASS to handle it. So, it is always worth dumping LSA secrets, but not usually as valuable as LSASS.

**LSASS**\
LSASS is a sub-system process of the Windows LSA service (it is a sub-system rather than a sub-process because it runs globally). LSASS stores credential information such as NTLM hashes and even cleartext passwords for domain users. You will need local admin rights to dump LSASS on a host. This is where you make your money on most internal engagements, as you can dump passwords, use them to pivot, and repeat until you hopefully find a domain administrator hash. You can use many tools to do this, such as Lsassy, Mimikatz, PyPyKatz, ProcDump or even the Task Manager.

**SAM**\
The SAM file contains the password hashes of LOCAL users on a Windows host. This is useful for maintaining access to a single Windows computer, but usually not helpful when it comes to lateral movement since you will need passwords for DOMAIN users who can authenticate across the network, rather than to one host. However, Admin passwords are sometimes reused for domain users, so it is worth dumping as well.

**DCSync**

Impersonates a domain controller and requests a specific user’s NTLM password hash. We need the ‘Directory Services Replication’ privilege. By default, the necessary permissions are limited to Domain Admins, Enterprise Admins, and Network Administrator groups. This basically means that this attack is useful for persistence once you already pwned a domain, or if you get lucky and find a shadow administrator account on the network with domain replication permissions.\
\
**Linkedin Content Credit: Jake Murphy**
{% endhint %}