Dump LSASS, either to get the clear text password, or just the NTLM hashes (depending on the version of Windows being targeted). HKLMsystem – aka SYSKEY: contains keys that could be used to encrypt the LSA secret and SAM databaseĢ.HKLMsecurity: contains cached domain records LSA secrets/LSA keys.HKLMSAM: contains the NTLMv2 hashes of users passwords.Obtain the NTLM hash(s) for offline cracking and manipulation. Having obtained account login names and passwords, attackers can spread further through an organization’s network, access restricted data, and execute commands and programs with higher privileges.Īt a high level, a potential attacker will want to do the following:ġ. Just having access to a machine won’t satisfy an attacker when they can do far more with valid credentials at their disposal across multiple steps of the ‘ Kill Chain‘.Ĭonsequently, credential dumping is frequently used by attackers during lateral movement. Seeking clear text credentials via LSASS or acquiring the SAM for the NTLM or LSA keys for its secrets has great value to attackers. Although these are well-known and relatively simple credential stealing attacks, they are still used in the wild, which suggests that there are security teams overlooking these tried-and-trusted techniques. We will explain how attackers use these to get credentials from a Windows machine in order to highlight the importance of having these methods monitored by security teams. In this post, we will elaborate more generally about basic attacks against SAM, LSA secrets, SYSKEY and LSASS.

In our recent article Exploring an NTLM Brute Force Attack with Bloodhound, we explored how attackers are still abusing the NTLM authentication protocol.

Windows security essential