How to Extract Windows Usernames, Passwords, Wi-Fi Keys & Other User Credentials with LaZagne « Null Byte :: WonderHowTo

After exploiting a vulnerable target, scooping up a victim's credentials is a high priority for hackers, since most people reuse passwords. Those credentials can get hackers deeper into a network or other accounts, but digging through the system by hand to find them is difficult. A missed stored password could mean missing a big opportunity. But the process can largely be automated withLaZagne.LaZagne is good for both hackers and pentesters. And the benefit of LaZagne is that it works on Linux, Windows, and macOS, so anyone can practice using it, and it applies to almost every target. LaZagne is included in the remote access toolPupyas a post exploitation module, but we can also use it on its own.Don't Miss:How to Use Pupy a Linux Remote Access ToolThere's alsoa standalone Windows PE(Preinstallation Environment) of LaZagne, which makes an excellent addition to the windows-binaries folder in Kali Linux.LaZagne is still in active development and currently supports enumerating passwords from a large set of Windows applications. While definitely still useful, it's a little bit lacking on Linux. A list of the supported applications is below.Image by AlessandroZ/GitHubThere's some interesting stuff on there that many password recovery tools might overlook. For example, some games. The odds of running across a host withRogue's Taleinstalled might be low, but if it's there, it's good to have a tool that can recover a password for it. Having a shell is great, but having actual credentials is better! With that said, let's take a look at LaZagne.Step 1: Get LaZagneIf you're looking to use LaZagne on a Linux machine, Alessandro (the author) recommends using the Pupy module. He seems to be focusing his development time on the Windows version of LaZagne, so we'll be grabbing the standalone Windows version here.The reason for using the standalone version on Windows hosts is pretty straightforward — Python isn't installed by default on Windows. Using the standalone version guarantees we will be able to use LaZagne across Windows hosts.Don't Miss:Capturing WPA Passwords by Targeting Users with a Fluxion AttackYou can download the standalone versionon GitHub. Once you have it, use the terminal to extract it and move it to your windows-binaries folder in Kali Linux with the commands below.unzip Windows.zipcd Windowscp laZagne.exe /usr/share/windows-binaries/First, weunzipthe archive, thenchange directoriesinto the unzipped directory, then wecopyLaZagne into the windows-binaries directory on our Kali Linux system.Now that we have LaZagne in our windows-binaries collection, let's take a look at actually using LaZagne.Step 2: Enumerate PasswordsLaZagne is a post-exploitation tool, which means that in order to use it, we'll need to already have access to a host via a shell, or at the minimum, command execution.Don't Miss:'Beast' Cracks Billions of Passwords in SecondsLaZagne is non-interactive and can be run in even the most bare-minimum of shells. Since the focus of this article is the standalone Windows PE, let's go ahead and have a look at some of the options.There's a lot of available modules here. In order to gather Wi-Fi or Windows credentials, we'll need to run as administrator, but even without administrator access, we can still gather up some passwords.Don't Miss:How to Create Stronger PasswordsWe could specify which module we want to use, but LaZagne includes a convenientalloption. Obviously, I want all the passwords I can get my hands on, so I'll be using LaZagne with thealloption.lazagne allLooks like we collected quite a few credentials. Another interesting feature of LaZagne is a rudimentary brute-forcing capability. If LaZagne is passeda wordlist, it will attempt to brute-force Mozilla master passwords, system hashes, etc. To pass a dictionary file, simply add the path argument.lazagne all -path wordlist.txtThat's all there is to it!Don't Miss:How to Crack Passwords, Part 1 (Principles & Technologies)Step 3: Defend Against the AttackAs you can see, it only took a moment to pull several passwords. This tool shows how important it isto use secure passwordsand to never reuse passwords in other accounts whenever possible. An attacker gaining access to one of your passwords shouldn't mean they have access to all of your accounts.Since this tool exists as part of a post-exploit framework, you can expect it to pop up in other tools as an effective way of burrowing into a user's system or life. To defend against this, it's best to ensure you also ensure your antivirus is up to date, as one of our Null Byte users reports it's almost instantly detected by most antivirus programs. You must be an administrator to do dump Windows hashes, so limiting access to admin accounts can also help.Future Growth & ApplicationsThis tool is a piece of cake to work with, and it gets results, extracting passwords from web applications that have been saved in browsers as well as databases, email accounts, wireless configurations, and chat clients. The modular design means that adding your own targets to this utility shouldn't be too difficult.This is a tool I'd personally like to see expanded to cover even more applications, and I expect it will if development stays steady. I'm excited to see where it goes!If you have any questions or comments, you can post away here, or you can also reach me on Twitter at@0xBarrow. As always, follow us on social media for more tips and tricks!Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Barrow/Null ByteRelatedHow To:Find Saved WiFi Passwords in WindowsHow To:Recover a Lost WiFi Password from Any DeviceHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Recover Forgotten Wi-Fi Passwords in WindowsHow To:Map Networks & Connect to Discovered Devices Using Your PhoneHow To:Stealthfully Sniff Wi-Fi Activity Without Connecting to a Target RouterHow To:Connect to Protected Wi-Fi Hotspots for Free Without Any PasswordsHow To:Find Stored Usernames, Emails, & Passwords on SafariHow To:Use Acccheck to Extract Windows Passwords Over NetworksHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow to Hack Wi-Fi:Stealing Wi-Fi Passwords with an Evil Twin AttackHow To:Easily Share Your Complicated Wi-Fi Password Using Your Nexus 5How to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Manage Stored Passwords So You Don't Get HackedHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Find & Share Local Wi-Fi Passwords for Free Internet Everywhere You GoHow To:Break into Router Gateways with PatatorHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Build an FTP Password Sniffer with Scapy and PythonSPLOIT:How to Make an SSH Brute-Forcer in PythonHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Intercept Images from a Security Camera Using WiresharkHow to Meterpreter:Obtaining User Credentials with PowerShellHow To:Everything You Need to Disable in Windows 10How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToHow To:Crack Wi-Fi Passwords with Your Android Phone and Get Free Internet!How To:Load Kali Linux on the Raspberry Pi 4 for the Ultimate Miniature Hacking StationHow To:Crack Wi-Fi Passwords—For Beginners!How To:Protect Yourself from the KRACK Attacks WPA2 Wi-Fi VulnerabilityAndroid for Hackers:How to Exfiltrate WPA2 Wi-Fi Passwords Using Android & PowerShellHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:log on Windows 7 with username & passwordHow To:Carve Saved Passwords Using CainHow To:Remove a Windows Password with a Linux Live CDHow To:Get Free Wi-Fi from Hotels & MoreHow To:Add Ctrl+Alt+Delete to Windows 7 Logon