Skip to main content
Information Security

Return to Answer

added 10 characters in body
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/configC:/WINDOWS/SYSTEM32/config

On a Linux Distro, like Kali-linux linux, you can then use the command "bkhive SYSTEM bootkey"bkhive SYSTEM bootkey to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt"samdump2 SAM bootkey > samdump.txt to get the hash dump from the SAM file.

If you open the file, you'll see lines similar to below:

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

This means the admin account's NTLM password is "44bf0244f032ca8baaddda0fa9328bf8"44bf0244f032ca8baaddda0fa9328bf8.

If you see something like:

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

This means the PC has LM hashes enabled. In this case, the LM hash is "37035b1c4ae2b0c54a15db05d307b01b"37035b1c4ae2b0c54a15db05d307b01b. LM hashes are easy to crack, they have the strength of a 7 character-character password (look it up on wikipedia to find out why).

The SAM and SYSTEM filefiles generally are obtained when the PC is powered off. However, there is a technique to get the files when the PC is powered on, using shadow volume copy, which is available in modern versions of windowsWindows. Essentially, this allows you to take a back upbackup of the running system, and you can extract the SAM and SYSTEM file from that backup. Google is your friend, there are many articles explaining this technique in detail.

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config

On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file.

If you open the file, you'll see lines similar to below:

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

This means the admin account's NTLM password is "44bf0244f032ca8baaddda0fa9328bf8".

If you see something like:

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

This means the PC has LM hashes enabled. In this case, the LM hash is "37035b1c4ae2b0c54a15db05d307b01b". LM hashes are easy to crack, they have the strength of a 7 character password (look it up on wikipedia to find out why).

The SAM and SYSTEM file generally are obtained when the PC is powered off. However, there is a technique to get the files when the PC is powered on, using shadow volume copy, which is available in modern versions of windows. Essentially, this allows you to take a back up of the running system, and you can extract the SAM and SYSTEM file from that backup. Google is your friend, there are many articles explaining this technique in detail.

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config

On a Linux Distro, like Kali linux, you can then use the command bkhive SYSTEM bootkey to get the bootkey from the system file. Then, use the command samdump2 SAM bootkey > samdump.txt to get the hash dump from the SAM file.

If you open the file, you'll see lines similar to below:

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

This means the admin account's NTLM password is 44bf0244f032ca8baaddda0fa9328bf8.

If you see something like:

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

This means the PC has LM hashes enabled. In this case, the LM hash is 37035b1c4ae2b0c54a15db05d307b01b. LM hashes are easy to crack, they have the strength of a 7-character password (look it up on wikipedia to find out why).

The SAM and SYSTEM files generally are obtained when the PC is powered off. However, there is a technique to get the files when the PC is powered on, using shadow volume copy, which is available in modern versions of Windows. Essentially, this allows you to take a backup of the running system, and you can extract the SAM and SYSTEM file from that backup. Google is your friend, there are many articles explaining this technique in detail.

Source Link
Sardoc
Sardoc
  • 226
  • 1
  • 3

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config

On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file.

If you open the file, you'll see lines similar to below:

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

This means the admin account's NTLM password is "44bf0244f032ca8baaddda0fa9328bf8".

If you see something like:

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

This means the PC has LM hashes enabled. In this case, the LM hash is "37035b1c4ae2b0c54a15db05d307b01b". LM hashes are easy to crack, they have the strength of a 7 character password (look it up on wikipedia to find out why).

The SAM and SYSTEM file generally are obtained when the PC is powered off. However, there is a technique to get the files when the PC is powered on, using shadow volume copy, which is available in modern versions of windows. Essentially, this allows you to take a back up of the running system, and you can extract the SAM and SYSTEM file from that backup. Google is your friend, there are many articles explaining this technique in detail.