CmdID

CmdID / Commands

secretsdump.py

Dump NTLM hashes, plaintext passwords, and domain credentials from remote Windows systems. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Dump NTLM hashes, plaintext passwords, and domain credentials from remote Windows systems. Part of the Impacket suite.

Dump credentials from a Windows machine using a username and password

secretsdump.py domain/username:password@targetIdentify

Dump hashes from a machine using pass-the-hash authentication

secretsdump.py -hashes LM_Hash:NT_Hash domain/username@targetIdentify

Dump credentials from Active Directory's NTDS.dit file

secretsdump.py -just-dc domain/username:password@targetIdentify

Extract credentials from a local SAM database using registry hives

secretsdump.py -sam path/to/SAM -system path/to/SYSTEMIdentify

Dump hashes from a machine without providing a password (if a valid authentication session exists, e.g. via Kerberos or NTLM SSO)

secretsdump.py -no-pass domain/username@targetIdentify