Question

During a post-exploitation phase, you have SYSTEM-level access on a Windows 10 workstation belonging to a domain user. You want to harvest plaintext credentials and NTLM hashes of accounts that have recently authenticated interactively on this host, without triggering a domain-wide replication event. Which technique best meets this goal?

Accepted Answer

Dump the contents of LSASS process memory on the local host and parse it for cached credential material

Answer

Perform a DCSync against the domain controller to request replication of all account secrets

Answer

Forge a golden ticket using the krbtgt hash to impersonate any domain user

Answer

Run RID cycling against the local SAM to enumerate all domain accounts