Conclusion

Recap

In this room, we discussed the various approaches to obtaining users' credentials, including the local computer and Domain Controller, which conclude the following:

• We discussed accessing Windows memory, dumping an LSASS process, and extracting authentication hashes.
• We discussed Windows Credentials Manager and methods to extract passwords. 
• We introduced the Windows LAPS feature and enumerated it to find the correct user and target to extract passwords.
• We introduced AD attacks which led to dumping and extracting users' credentials.

The following tools may be worth trying to scan a target machine (files, memory, etc.) for hunting sensitive information. We suggest trying them out in the enumeration stage.

• Snaffler
• Seatbelt
• Lazagne