RedSnarf

RedSnarf is a pentesting and redteaming tool developed by Ed Williams for extracting hashes and credentials from Windows systems. It targets local SAM hashes, users with elevated privileges and their LSA secrets, MS cached credentials, and enables pass-the-hash attacks. The tool also identifies weak username/password combinations like administrator/Password01 and supports retrieving hashes across ranges with hash spraying capabilities.

Use cases include post-exploitation scenarios on workstations, servers, and domain controllers where authenticated access is obtained. It aids in credential dumping without triggering obvious alerts through OpSec safe methods. Additional utilities cover enumeration, registry manipulation, and integration with other tools like creddump7.

RedSnarf Version 0.5p provides a rich feature set for pentesting, including hash extraction via drsuapi or NTDSUtil, service account enumeration, and various credential validation options.

RedSnarf authenticates to Windows targets using provided credentials or hashes via SMB protocols and Impacket libraries. It extracts local SAM hashes, LSA secrets from elevated users, and cached domain credentials. For domain controllers, it uses methods like DRSUAPI or NTDSUtil to dump NTDS.dit. Pass-the-hash leverages NTLM hashes for lateral movement, while hash spraying tests multiple hashes across ranges. Enumeration queries LDAP, services, and registry keys; utilities execute PowerShell, clear logs, or deploy shells OpSec-safely.