You got access to vsphere and want to compromise the Windows hosts running on that ESX? 💡 1) Create a clone into a new template of the target VM 2) Download the VMDK file of the template from the storage 3) Parse it with Volumiser, extract SAM/SYSTEM/SECURITY (1/3)
4) Pypykatz get NT Hash for machine account plus LSA secrets and cached credentials 🔥 5) Silver Ticket authentication to the target live system with the NT Hash -> Win 😎 6) Alternatively crack cached credentials (2/3)
7) Grabbing DPAPI blobs from the host with volumiser is also possible 8) Use pypykatz for LSA secrets, decrypt DPAPI blobs with DPLoot Credits for tooling to: @_EthicalChaos_ @SkelSec @_zblurx 🥰 (3/3)
@ShitSecure Another way is to look for snapshots of a target VM and get the memory .vmem file. After converting the memory dump it should open in WinDbg and extract some secrets with Mimikatz extension.
@joaovarelas How to convert the dump?
@ShitSecure Btw, you can save the trouble of cloning and just pause the VM and take vmsn/vmem files, then dump lsass, you'll have issues with exfil (if that's a problem concerns you) 13cube have an excellent video about this topic https://youtu.be/P0yw93GJsYU?s... It's an indirect form of dma
@ShitSecure Except when bitlocker is enabled with vtpm
@ShitSecure People still use VM 😅
@ShitSecure 😎