LogoLogo
search
Ctrlk
NetExec GithubNetexec Lab
LogoLogo
  • Welcome
  • News
  • Logo & Banner
  • flask-vialNetExec Lab
  • Getting Started
    • Installation
    • Selecting & Using a Protocol
    • Target Formats
    • Using Credentials
    • Using Kerberos
    • Using Certificates
    • Using Modules
    • DNS options
    • Database General Usage
    • BloodHound Integration
    • Audit Mode
    • Ignore OpSec Warnings
    • Logging
  • SMB protocol
    • Generate hosts file
    • Generate krb5.conf file
    • Generate TGT
    • Scan for Vulnerabilities
    • Enumeration
    • Password Spraying
    • Authentication
    • Command Execution
    • Spidering Shares
    • Get and Put Files
    • Obtaining Credentials
      • Dump SAM
      • Dump LSA
      • Dump NTDS.dit
      • Dump LSASS
      • Dump DPAPI
      • πŸ†•Dump with BackupOperator Priv
      • πŸ†•Dump SCCM
      • πŸ†•Dump Token Broker Cache
      • Dump WIFI password
      • Dump KeePass
      • Dump Veeam
      • Dump WinSCP
      • πŸ†•Dump PuTTY
      • πŸ†•Dump VNC
      • πŸ†•Dump mRemoteNG
      • πŸ†•Dump Notepad
      • πŸ†•Dump Notepad++
      • πŸ†•Dump Remote Desktop Credential Manager
      • πŸ†•Dump Event Log Creds(4688)
    • Defeating LAPS
    • Checking for Spooler & WebDav
    • Steal Microsoft Teams Cookies
    • Impersonate logged-on Users
    • Change User Password
    • Dump User Local Security Questions
  • LDAP protocol
    • Authentication
    • Enumerate Domain Users
    • Enumerate Domain Groups
    • πŸ†•Query LDAP
    • ASREPRoast
    • Find Domain SID
    • Kerberoasting
    • πŸ†•Find Misconfigured Delegation
    • Unconstrained Delegation
    • Admin Count
    • Machine Account Quota
    • Get User Descriptions
    • Dump gMSA
    • Exploit ESC8 (ADCS)
    • Extract Subnet
    • Check LDAP Signing
    • Read DACL Rights
    • Extract gMSA Secrets
    • Bloodhound Ingestor
    • πŸ†•List DC IP / Enum Trust
    • πŸ†•Abuse Domain Trust: Raisechild
    • Enumerate Domain Trusts
    • πŸ†•Enumerate SCCM
    • πŸ†•Enumerate Entra ID
  • πŸ†•Dump PSO
  • WINRM protocol
    • Password Spraying
    • Authentication
    • Command Execution
    • Defeating LAPS
    • Obtaining Credentials
  • MSSQL protocol
    • Password Spraying
    • Authentication
    • MSSQL PrivEsc
    • MSSQL Command Execution
    • MSSQL Upload & Download
    • Execute via xp_cmdshell
    • πŸ†•Enumerate Users by Bruteforcing RID
    • MSSQL Linked Servers
  • SSH protocol
    • Password Spraying
    • Authentication
    • Command Execution
    • Get and Put Files
  • FTP protocol
    • Password Spraying
    • πŸ†•File Listing, etc
    • πŸ†•File Upload & Download
  • RDP Protocol
    • Password Spraying
    • Screenshot (connected)
    • Screenshot Without NLA (not connected)
    • πŸ†•Command Execution
  • WMI Protocol
    • Password Spraying
    • Authentication
    • Command Execution
  • NFS Protocol
    • πŸ†•Enumeration
    • Download and Upload Files
    • πŸ†•Escape to root file system
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
githubEdit
  1. SMB protocol

Obtaining Credentials

The following examples use a username and plaintext password, although user/hash combos work as well.

Dump SAMchevron-rightDump LSAchevron-rightDump NTDS.ditchevron-rightDump LSASSchevron-rightDump DPAPIchevron-rightπŸ†•Dump SCCMchevron-rightDump Veeamchevron-rightπŸ†•Dump Token Broker Cachechevron-rightDump WIFI passwordchevron-rightDump WinSCPchevron-rightπŸ†•Dump VNCchevron-rightπŸ†•Dump mRemoteNGchevron-rightπŸ†•Dump Remote Desktop Credential Managerchevron-rightπŸ†•Dump PuTTYchevron-right
PreviousGet and Put Fileschevron-leftNextDump SAMchevron-right

Last updated 1 year ago

Was this helpful?

Was this helpful?