As an aside, we're going to be taking a look at doing passwords retrieval on the actual system
itself, but a little bit deeper, going into some of the actual programs on the system.
Up to this point, we've been looking at passwords logging into the actual system itself for users,
groups, and other kinds of credentialed access for the system inside the operating system.
While that is fun, there are other passwords that are stored on the system.
And for instance, let's say like wireless settings or other network settings,
maybe even passwords to different websites or things like that. There's a whole slew of different
passwords and authorization methods on systems other than the actual username password to log
in. So I want to take a look at one of the tools for this, and this is going to be a
kind of a unique demonstration because I'm not going to be able to demonstrate everything about
it inside of our lab. And I'll show you some stuff from my personal system, but there's
going to be a lot of blurring. So follow me on this. On our side screen here, I have a folder
called LaZagdi, is what we're going to call it. LaZagdi or LZ, right? Landing font. And I have
the link for this below, and I'll show you the page here in a second. This runs in multiple types
of operating systems and requires Python as a backing method for it because it's all Python
scripts, right? So this runs in either Windows, POSIX based or Mac. And what we're taking a look
at is the actual Windows folder of this. And I'm going to also have the commands for this below as
well. It's as simple as downloading it from the actual GitHub, putting it in a folder somewhere
on the system, going to the appropriate folder of the operating system you're on and running
the actual LZ.py. It's LaZagdi.py or LaZagdi.py. So in order to do this, you also need to run it
in administrative mode. So we're going to run PowerShell inside of administrator real quick,
and then we're going to go on over to that actual folder where the Windows is inside of the LZ
master. And I want to show you here real quick too, when it downloads and you extract it, this
is what it looks like in the entire folder. So I'm going inside the Windows and that's the folder
path we're copying because we're in a Windows operating system. So we'll change directory to
that real quick. There we go. And now the command is as simple as Python, space, the
tab again, the py file, space, all, and then you say dash O, lowercase O, uppercase N.
And this is the output type. The O represents output, the uppercase N in that represents the
actual kind of output. We're going to say normal, and it'll output it in a text file. And you can
see that I've already ran this before. The credentials file that you see right there,
the second file, that text file, that's the actual naming convention for that text output.
Now, when you run this, you're going to hit enter, and you can see that it's going through
the actual system itself and it's retrieving passwords from predefined locations. And we'll
go through some of those predefined locations momentarily. And this does or can take a few
minutes to run depending on the amount of passwords, the amount of users, and various
other tidbits of information on the specified system that you're working on. So if we go back
to our folder, that second one with the timestamp of now when I'm doing it is on the actual,
or in text document, I'm going to open that up and you'll see the output that we had inside of
the PowerShell. Now, first thing you can notice here is that it does a complete hash dump for us.
This is just another tool of many that does hash dumping for us. And we've seen that before,
although still impressive, follow me. We also have LSA secrets. And if you scroll down more,
you have generated keys for LDAP and some other different things, which might be good if you're
doing a certificate impersonation. NKLM certificates, and this is not populated fully
because this is a workstation and not on a domain, but, and hint. So then you scroll down and you
start to see Vault right here. Now I'm going to show you the one that I did on mine. Again,
going to be a whole lot of blurring, but as you can see here that you have actual username and
passwords that for accounts that you don't normally see, and this is in the Vault of
Microsoft Store. So I went in earlier to install Python on the actual Windows 10 system here,
and that's the actual username and password that it generated for that connection.
So what does this look like on a normal system? Well, I'm glad you asked. Let me pull this up
from my system real quick. Blur, blur, blur, blur, blur. And I'm specifically blurring this
out for a reason because this is on my personal system, but I'm going to walk you through what
it found. As you can see, it's slightly moving behind the scenes. So it has a bunch of my
Adobe cloud information, my username and password for the actual Adobe cloud with, and along with
the actual Adobe dummy credentials, meaning the stuff behind the scenes where it does detection
for software updates. And I also have inside the vault, the Microsoft Store credentials,
but if I scroll down, I also have, and I'm highlighting it even though you can't see it,
but you can see that I'm highlighting something, right? It has Wi-Fi credentials along with the
SSID. So you see SSID number one, authentication type, in this case, WPA2PSK, protected to true,
and then the actual password for the actual network itself. So being able to get onto that
network. Now it's not just the one for here. I've taken this system somewhere else before,
and it's connected over Wi-Fi that way too. And it also has right here, you can't see it,
but you see the blue that I have an open VPN account on here as well. I have my own VPN server
and all the information for the username password is in here, along with the actual
certificate from that I've been issued for myself. Now, what you see right here is the beginning,
or that blur blue right there is the beginning of Google Chrome output,
meaning that it's already recovering passwords that stored inside the Google vault.
Now that's really impressive and all, and we're back to the one that's inside of our in-depth lab,
but the information that you take away from this is that this is just one of many tools
that you could use to be able to get passwords from a system outside of the actual system login.