diff --git a/pages/common/impacket-secretsdump.md b/pages/common/impacket-secretsdump.md new file mode 100644 index 0000000000..b67d00ec28 --- /dev/null +++ b/pages/common/impacket-secretsdump.md @@ -0,0 +1,8 @@ +# impacket-secretsdump + +> This command is an alias of `secretsdump.py`. +> More information: . + +- View documentation for the original command: + +`tldr secretsdump.py` diff --git a/pages/common/secretsdump.py.md b/pages/common/secretsdump.py.md new file mode 100644 index 0000000000..16519d466e --- /dev/null +++ b/pages/common/secretsdump.py.md @@ -0,0 +1,25 @@ +# secretsdump.py + +> Dump NTLM hashes, plaintext passwords, and domain credentials from remote Windows systems. +> Part of the Impacket suite. +> More information: . + +- Dump credentials from a Windows machine using a username and password: + +`secretsdump.py {{domain}}/{{username}}:{{password}}@{{target}}` + +- Dump hashes from a machine using pass-the-hash authentication: + +`secretsdump.py -hashes {{LM_Hash}}:{{NT_Hash}} {{domain}}/{{username}}@{{target}}` + +- Dump credentials from Active Directory’s NTDS.dit file: + +`secretsdump.py -just-dc {{domain}}/{{username}}:{{password}}@{{target}}` + +- Extract credentials from a local SAM database using registry hives: + +`secretsdump.py -sam {{path/to/SAM}} -system {{path/to/SYSTEM}}` + +- Dump hashes from a machine without providing a password (if a valid authentication session exists, e.g. via Kerberos or NTLM SSO): + +`secretsdump.py -no-pass {{domain}}/{{username}}@{{target}}`