tools / credential attacks / lazagne

LaZagne

Post-exploitation credential recovery tool that extracts stored passwords from browsers, WiFi, email clients, Windows credentials, databases, and sysadmin tools. Works on both Windows and Linux.

Windows Linux
LevelBeginner. A quick post-exploitation step once you have a shell, regardless of privilege level.
Know firstThat LaZagne reads credentials saved for the user it runs as, not every user on the machine.
You will learn torecover saved passwords from browsers and other applications, and know whose credentials you are actually reading.

What is it?

LaZagne is a credential harvester. After you gain access to a machine, LaZagne searches for passwords that applications have stored, browser saved passwords, WiFi passwords, email credentials, database connection strings, and more.

The key insight: users save passwords everywhere. Browsers auto-save login forms. Email clients remember IMAP credentials. WiFi profiles store PSKs. Database tools save connection strings. LaZagne knows where each application stores these secrets and how to decrypt them.

This is different from Mimikatz, which pulls credentials from memory (LSASS). LaZagne pulls credentials from stored locations on disk: browser databases, registry keys, config files. You can think of it as:

  • Mimikatz = credentials in memory (what's being used right now)
  • LaZagne = credentials on disk (what's been saved for later use)

Running both gives you the most complete picture of available credentials on a compromised host.

Run this first

Run it with no arguments to check every supported source at once.

cmd: your first run
C:\> lazagne.exe all
  • all checks every module: browsers, WiFi, Windows credentials, databases and more.

It prints whatever it finds for the current user. If you are SYSTEM or a different account, re-run it as the target user, because LaZagne only reads that account's saved credentials.

When do you use it?

LaZagne is a post-exploitation tool. You run it after you have a shell on a machine. The typical scenario:

Run LaZagne when
  • You've compromised a workstation and want to find passwords the user has saved in browsers, email, etc.
  • You need lateral movement credentials: saved passwords often work on other machines (password reuse)
  • Mimikatz didn't find what you need: the user logged in with a smart card or the password isn't in LSASS memory
  • You're on a Linux box: LaZagne works on Linux too, finding credentials in .ssh, browsers, databases, etc.
  • You want application-specific creds: database connection strings, FTP/SFTP saved sessions, email server passwords
The credential stacking strategy

On every compromised Windows host, run these in order: 1) Mimikatz (LSASS memory), 2) LaZagne (stored creds), 3) SessionGopher (saved sessions). Each finds different credentials. A browser password from LaZagne might be the same password used for their domain account, password reuse is extremely common.

Running LaZagne

Windows: run all modules

cmd: Windows
# Run all modules: this is what you want 99% of the time
C:\> lazagne.exe all

# Output to a file (useful for large amounts of found creds)
C:\> lazagne.exe all -oN

# -oN creates a file in the current directory with results
# Format: credentials_YYYY-MM-DD_HH-MM-SS.txt

Specific modules only

cmd: targeted modules
# Only browser passwords
C:\> lazagne.exe browsers

# Only WiFi passwords
C:\> lazagne.exe wifi

# Only Windows credential manager
C:\> lazagne.exe windows

# Only sysadmin tools (FileZilla, WinSCP, etc.)
C:\> lazagne.exe sysadmin

# Only database tools
C:\> lazagne.exe databases

Linux

bash: Linux
# Run all modules on Linux
$ python3 laZagne.py all

# Linux checks: .ssh keys, browser passwords, database configs,
# /etc/shadow (if readable), gnome keyring, etc.

Key modules and what they find

ModuleWhat it searchesWhy it matters
browsersChrome, Firefox, Edge, IE saved passwordsUsers save everything: email, banking, internal apps, VPNs. Often reuses same password for domain account
wifiSaved WiFi PSKsCorporate WiFi passwords can be WPA2-Enterprise creds (domain creds!)
windowsCredential Manager, Vault, DPAPIWindows stores RDP passwords, mapped drive creds, and cached tokens here
sysadminFileZilla, WinSCP, PuTTY, OpenVPNIT staff save server passwords in these tools. Gold for lateral movement
databasesSQL Server, MySQL Workbench, pgAdmin, SQLiteDatabase connection strings contain passwords for production databases
mailsOutlook, Thunderbird stored credentialsEmail passwords; might be domain creds. Also look at sent emails for other passwords
gitGit credential storesGitHub/GitLab tokens and passwords. Can access source code repos

Reading the output

output: example LaZagne results
|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! MUSIC EDITION !                         |
|                                                                    |
|====================================================================|

########## User: jsmith ##########

------------------- Chromium passwords -----------------

[+] Password found !!!
URL: https://mail.corp.local/owa
Login: jsmith@corp.local
Password: Summer2024!

[+] Password found !!!
URL: https://gitlab.corp.local
Login: j.smith
Password: Summer2024!

[+] Password found !!!
URL: https://vpn.corp.local
Login: jsmith
Password: C0rpVPN#2024

------------------- Wifi passwords ---------------------

[+] Password found !!!
SSID: CORP-WIFI
Password: WirelessKey2024!

------------------- Windows credentials ----------------

[+] Password found !!!
Target: Domain:target=TERMSRV/fileserver01
Username: CORP\jsmith
Password: Summer2024!

[+] 5 passwords have been found.
What to look for in the output
  • Password reuse: same password on multiple sites = likely their domain password too
  • Internal URLs: mail.corp.local, gitlab.corp.local reveal internal services you might not have found yet
  • VPN credentials: could provide network access from outside
  • Database passwords: direct access to production data
  • Saved RDP credentials: the TERMSRV entries in Windows Credential Manager mean they RDP to those servers. Those are your next targets

What to do with found credentials

Every password LaZagne finds is a potential lateral movement opportunity:

  1. Test for domain password reuse: if they saved "Summer2024!" in Chrome, try it against their domain account with kerbrute or crackmapexec
  2. Try saved creds on other machines: crackmapexec smb 10.10.10.0/24 -u jsmith -p 'Summer2024!'
  3. Access new services: VPN creds, database creds, and git tokens open entirely new attack surfaces
  4. Add to your password list: build a custom wordlist from all found passwords for targeted cracking
  5. Check the URL list: internal URLs in browser passwords reveal services you might not have enumerated

LaZagne vs Mimikatz

FeatureLaZagneMimikatz
Source of credsStored on disk (browser DBs, registry, config files)In memory (LSASS process)
Requires adminNo: can find current user's saved passwords as standard userYes: needs SeDebugPrivilege to dump LSASS
Type of credsPlaintext passwords from applicationsNTLM hashes, Kerberos tickets, sometimes plaintext
Works offlineYes: reads files and registryNo: needs running LSASS process
Cross-platformWindows + LinuxWindows only
Detection riskLower: reads files, doesn't touch LSASSHigher: accessing LSASS triggers most EDRs
Run both, always

LaZagne and Mimikatz complement each other. Mimikatz gets you hashes for pass-the-hash attacks and Kerberos tickets. LaZagne gets you plaintext passwords for password spraying and accessing web apps. Run LaZagne first (doesn't need admin), then Mimikatz after you escalate.

Common mistakes

Things that go wrong
  • Running as wrong user: LaZagne finds credentials for the current user. If you're running as SYSTEM, you won't find jsmith's browser passwords. Run as the target user, or run with -u to specify another user's profile
  • Skipping it because you have admin: Even with admin/SYSTEM, LaZagne finds credentials that Mimikatz doesn't, browser passwords, WiFi keys, application-specific creds
  • Not checking internal URLs: The URLs in browser passwords are enumeration gold, they reveal internal services, hostnames, and applications
  • Ignoring "weak" finds: A WiFi password or a git token might seem unimportant, but corporate WiFi can use domain creds, and git tokens access source code with hardcoded secrets
  • Not building a password list: Save every password you find into a custom wordlist. Users create passwords from patterns, if you find "Summer2024!", also try "Winter2024!", "Fall2024!", etc.

Related tools

Mimikatz

Extracts creds from LSASS memory. Complementary to LaZagne's disk-based approach.

SessionGopher

Finds saved PuTTY/WinSCP/RDP sessions. Overlaps with LaZagne's sysadmin module.

Hashcat

Crack hashes found alongside LaZagne results. Build custom wordlists from found passwords.

evil-winrm

Use found credentials to access new machines via WinRM.

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

You run LaZagne as SYSTEM looking for a specific user's browser passwords, and find nothing. Why?
LaZagne reads credentials saved for whichever account runs it. SYSTEM has no saved browser passwords of its own; you need to run it as that user or point it at their profile.
You already have admin or SYSTEM. Is LaZagne still worth running?
Yes. It finds things Mimikatz does not, such as browser passwords, WiFi keys and application-specific credentials.
LaZagne shows a saved password with a URL for an unfamiliar internal site. Why does that matter?
The URL itself is useful: it can reveal internal hostnames and applications worth enumerating next, beyond the password.
LaZagne finds a WiFi password and a git token. Worth keeping?
Yes. Corporate WiFi sometimes uses domain credentials, and a git token can access source code with other hardcoded secrets inside it.
You find Summer2024!. What do you do with it beyond trying it directly?
Add it to a custom wordlist and try variations such as Winter2024! and Fall2024!; people build passwords from patterns.