Charles Kos @Charlestech01 - Twitter Profile

Pinned Tweet

Charles Kos @Charlestech01

9 months ago

Date never lies the best account recovery expert send me a dm now don’t dm if you ain’t bag ready

3

5

0

7

2K

Charles Kos @Charlestech01

23 days ago

@Cocca_GK @Meephu7 @BebeSwk I can help you get it restored send a dm

0

10

Charlestech01 retweeted

Security Trybe

@SecurityTrybe

5 months ago

9

846

75

49

24K

Charlestech01 retweeted

Winston Ighodaro @Officialwhyte22

4 months ago

When hackers gain access to a Windows system, the biggest mistake they don’t make is rushing. Instead of running random tools or poking around files, skilled attackers go straight for credentials. Why? Because with passwords or NTLM hashes, they can move to other systems, escalate privileges, or impersonate users silently. Windows stores these credentials in memory, especially inside a process called lsass.exe (Local Security Authority Subsystem Service), which is responsible for handling logins. To extract this sensitive information, attackers use a common method: they dump the memory of lsass.exe using a tool like procdump, then load the dump into mimikatz, a powerful post-exploitation tool. Once that dump is opened in mimikatz, the tool can reveal the usernames and passwords of users who logged in, sometimes even domain admin accounts. This is how attackers quietly elevate their control and move across the network without triggering alerts, especially if logging isn’t properly configured. In the terminal output, we first locate the lsass.exe process using tasklist | findstr lsass.exe to get its PID. Then we use procdump.exe -ma <PID> lsass.dmp to dump the process memory into a file. After that, mimikatz is launched, and we load the dump using sekurlsa::minidump lsass.dmp, then run sekurlsa::logonpasswords to extract plaintext credentials from memory. This technique is extremely effective and often used by both red teams and real attackers during lateral movement.

Officialwhyte22's tweet photo. When hackers gain access to a Windows system, the biggest mistake they don’t make is rushing. Instead of running random tools or poking around files, skilled attackers go straight for credentials. Why? Because with passwords or NTLM hashes, they can move to other systems, escalate privileges, or impersonate users silently. Windows stores these credentials in memory, especially inside a process called lsass.exe (Local Security Authority Subsystem Service), which is responsible for handling logins.

To extract this sensitive information, attackers use a common method: they dump the memory of lsass.exe using a tool like procdump, then load the dump into mimikatz, a powerful post-exploitation tool. Once that dump is opened in mimikatz, the tool can reveal the usernames and passwords of users who logged in, sometimes even domain admin accounts. This is how attackers quietly elevate their control and move across the network without triggering alerts, especially if logging isn’t properly configured.

In the terminal output, we first locate the lsass.exe process using tasklist | findstr lsass.exe to get its PID. Then we use procdump.exe -ma <PID> lsass.dmp to dump the process memory into a file. After that, mimikatz is launched, and we load the dump using sekurlsa::minidump lsass.dmp, then run sekurlsa::logonpasswords to extract plaintext credentials from memory. This technique is extremely effective and often used by both red teams and real attackers during lateral movement.

16

999

111

879

79K

Charlestech01 retweeted

Security Trybe

@SecurityTrybe

5 months ago

Hackers don’t search for passwords. They dump them all in seconds. Do you know how?

18

178

10

66

106K

Charles Kos @Charlestech01

5 months ago

@officialmoore7 @BetFluence1

0

211

Charles Kos @Charlestech01

6 months ago

@NoLimitGains Never knew there was a fake gold, buy bitcoin now!

0

1

0

47

Charles Kos @Charlestech01

6 months ago

@FabrizioRomano Fr

1

0

213

Charlestech01 retweeted

Meta Newsroom

@MetaNewsroom

7 months ago

The Segment Anything Collection has two new additions, both accessible on our Segment Anything Playground platform: • SAM 3: Detects and tracks objects in images and video using text prompts. • SAM 3D: Facilitates 3D reconstruction of objects and people from a single image. https://t.co/lIJkEpA6QE

17

21

7

1

4K