I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to extract it from there. I found the location HKLM\SAM\SAM\Domains\Account\Users\000001F4 (1F4=500=Admin) and there the value "V" with some binary content. The only useful documentation for the V binary is this link: http://www.beginningtoseethelight.org/ntsecurity/index.htm but that info is very old and I'm not sure if that is still correct with current Windows 7 and Windows 8. Also, if I extract the NT hash like described there, it doesn't match what I get if I set the password to "123" (I would expect 3dbde697d71690a769204beb12283678, but got 1509c04cb2a3e20eba3fde1ac5f8589f). So the question again: How to manually extract the NT hash from the registry?
closed as off-topic by TildalWave, Adnan, Rory Alsop♦ Jul 9 '13 at 7:06
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – TildalWave, Adnan
How to extract the hashes from the registry without 3rd party tools
This is the bare-bones answer to the question posed by the OP:
In these files are the local user hashes (not AD). From here, a simple hex script can be written to pull out the individual hashes.
The next question is: are you happy with the just hashes, or do you want to reverse engineer them to the plaintext versions? That question is not asked, so I will assume that it is not desired.
This post explains how to script ways to extract hashes.
The hashes are stored in the Windows SAM file. This file is located on your system (depending on your installation paths) at X:\Windows\System32\config but is not accessible while the operating system is booted up. These values are also stored in the registry at HKEY_LOCAL_MACHINE\SAM, but again this area of the registry is also not accessible while the operating system is booted.
There are known ways (and tools) to reverse engineer the hashes to retrieve the passwords and vice-versa, but I am not going to help you with that because...
Since you have physical access, one of the most effective methods is to boot the computer into a different operating system. If you are comfortable using Linux then this means you can simply boot to a Linux live CD that is capable of reading NTFS drives, mount the Windows partition, and copy the SAM file to external media. Work on that copy by looking at “SAM\Domain\Account\Users”. The rest is up to you.
On a sidenote I would like to warn you about playing with such system areas if you are using Encrypted File System (EFS) on anything released after Windows XP/2003. If you change something in the wrong place there (like resetting passwords or modifying other hashes), it might cause the operating system to lose its EFS keys which introduces a whole new bunch of problems which you don't even want to think about. That's why you'll only want to work with a copy of the SAM file.
Just found your previous question "How to brute-force NT hash to password?" and I'm starting to understand why you keep asking for the "exact hash location" and "hash identification".
Therefore, a little reminder: security.SE is not here to help you hack or crack anything. Please check the rules instead of looping the question in the comments area. Thanks.
|show 6 more comments|