Description
Retrieves all NTLM hashes and cleartext credentials captured by the running Inveigh session.
Overview
Retrieves credentials captured by an active Inveigh session. Supports filtering by type, deduplication, and Hashcat output format for NTLM hashes.
Arguments
| Parameter | Type | Description |
|---|---|---|
| Type | string | Credential type to return. ValidateSet: NTLM, Cleartext, All. Default: All. |
| Unique | bool | Return only unique NTLM hashes (one per user). Default: false. |
| Hashcat | bool | Format NTLM hashes in Hashcat mode 5600 format. Default: false. |
Dependencies
- inveigh
Operating Systems
- Windows
Example Text Output
Timestamp : 4/27/2026 09:05:00
Protocol : LLMNR
ClientIP : 192.168.1.50
User : jsmith
Domain : LAB
NTLMHash : aad3b435b51404eeaad3b435b51404ee:...