This room focuses on harvesting credentials from an internal foothold. It covers where credentials live on Windows systems and in AD environments, how to extract them from local files, registry, SAM, LSASS memory, and related stores, and why credential access is a key step for lateral movement and impersonation.
Core idea: once you have system access, credentials become one of the highest-value targets because they let you move, blend in, and escalate without relying only on exploits.
Credentials harvesting is the process of obtaining usernames, passwords, hashes, tickets, or any authentication material that can be reused.
Legitimate credentials are especially useful because they support quieter lateral movement and make attacker behaviour harder to distinguish from real users.
The room highlights several places where credentials may appear inside a compromised environment:
Practical takeaway: credential access is not one technique, it is a collection of many collection points across disk, registry, memory, and the network.
Some of the fastest wins come from careless storage.
password can surface insecure storage.These techniques are low-noise and should usually be checked before memory dumping.
Password managers and saved application credentials are another strong source of secrets.
Misconfiguration, weak protection, or local compromise can expose these stores to an attacker.
Windows stores local account information in the Security Account Manager (SAM) database.
hashdump can dump hashes in memory.This is one of the classic starting points for local credential dumping.
The room demonstrates two native ways to extract the files needed for local hash recovery.
sam and system from it.reg save to export HKLM\sam and HKLM\system.Once transferred off-host, tools like secretsdump.py can decrypt and extract local hashes.
LSASS is one of the highest-value processes on a Windows system because it handles authentication material.
Why it matters: dumping LSASS can provide far more than local SAM hashes because it captures active authentication context rather than only static local account storage.
The room shows multiple ways to capture LSASS memory for offline or direct analysis.
Because this is a well-known technique, defensive products often monitor or block it, so expect real-world friction here.
Mimikatz is a central post-exploitation tool for Windows credential access.
privilege::debug enables required access.sekurlsa::logonpasswords can extract live credential material from LSASS.This is one of the most direct ways to move from local admin access into reusable credential material.
The room also reminds you that not all credential harvesting is purely local.
reg save are useful native paths for collecting SAM/SYSTEM offline.hashdump, and Impacket secretsdump.py are the main tools to remember from this room.