Windows, Linux, and Active Directory CTF Notes
search
Ctrlk
  • Table of Content
  • Word of Wisdom
  • Enumerationchevron-right
  • Active Directorychevron-right
    • Working Directory and Files
    • First Recon
    • User Reconchevron-right
    • Init Cred Acesschevron-right
    • Init NTLMv2 Theft
    • Kerberos Quick Winchevron-right
    • Domain Reconchevron-right
    • AD Attack Recon
    • Bloodhound Walkthroughchevron-right
    • Kerberos Attackchevron-right
    • ACL Abusechevron-right
    • Group Policy Abusechevron-right
    • Logon Script Abuse
    • ADCS attacks
    • KrbRelayUp
    • Azure Connect Exploit
    • gMSA account
    • Dumping Domain Credentialschevron-right
      • Secretdump.py
      • ntdsutil.exe - no credential required
      • Diskshadow - No credential required
      • vssadmin - no credential required
      • Wmic and Vssadmin Shadow Copy
      • Mimikatz
  • Windows Privchevron-right
  • Linux Privchevron-right
  • Credential Accesschevron-right
  • Pivoting / Networkchevron-right
  • File Transferchevron-right
  • Web Attackschevron-right
  • Database Attackschevron-right
  • Metasploitchevron-right
  • File Enum & Huntingchevron-right
  • Unix Commandschevron-right
  • Code Analysischevron-right
  • Reverse Shellchevron-right
  • Remote Access & Lateral Movement
  • RCE Collectionchevron-right
  • Compilingchevron-right
  • Interactive Shell
  • Reverse Shell
  • Post Exploitationchevron-right
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Active Directory

Dumping Domain Credentials

Secretdump.pychevron-rightntdsutil.exe - no credential requiredchevron-rightDiskshadow - No credential requiredchevron-rightvssadmin - no credential requiredchevron-rightWmic and Vssadmin Shadow Copychevron-rightMimikatzchevron-right
PreviousgMSA accountchevron-leftNextSecretdump.pychevron-right