Got Privs? Crack Those Hashes!

This Black Hills InfoSec blog post explains techniques used during penetration tests to obtain Active Directory credential material: it reviews common local privilege escalation vectors, warns about crashing LSASS when dumping hashes, and provides step-by-step guidance to create an IFM backup via NTDSUTIL on a Domain Controller to safely extract NTDS.DIT/SAM/SYSTEM for offline hash extraction and cracking (using Impacket/secretsdump and hashcat), plus cleanup recommendations and a mention of DCSYNC as another approach.