# 5 Looting

## After system/admin:

1. Go for sam dump on windows using reg.exe [https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/#extract-credentials-from-sam-and-security-hives-from-registry](https://xapax.github.io/security/#attacking_active_directory_domain/active_directory_privilege_escalation/credential_extraction/#extract-credentials-from-sam-and-security-hives-from-registry)
2. REF:
   1. [https://github.com/mubix/post-exploitation-wiki](https://github.com/mubix/post-exploitation-wiki)
