6

After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.

In particular, samdump2 decrypted the SAM hive into a list of users with "blank" passwords:

samdump2 system sam -o out

I.e., admin:1001:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Conversely, mimikatz succeeded in outputting the proper NTLM hash:

mimikatz # lsadump::sam /system:C:\system /sam:C:\sam

I.e.,

RID  : 000003e9 (1001)
User : admin
  Hash NTLM: f1320e0960da374b88e40cffbec44885

The problem with mimikatz is that AVs flag it as malware the moment it gets download.

Are there other tools available that can run on Linux that may decrypt the SAM file properly after Windows 10 anniversary update?

Improve this question
9
  • Can't you simply whitelist that software in your AV?
    – forest
    Apr 17, 2018 at 9:48
  • 1
    I can easily crack the NTLM hashes on Kali using john. However, conventional tools like samdump2 fails in decrypting the SAM hive to reveal the NTLM hashes. I'm looking for a substitute for samdump2 with support for Windows 10...
    – Shuzheng
    Apr 17, 2018 at 9:53
  • 1
    @FlorinCoada - Yes, I can crack them on the same machine (i.e., Windows 10). However, I'd rather not use mimikatz...
    – Shuzheng
    Apr 17, 2018 at 10:47
  • 1
    The question is valid. A predecessor step - open the SAM hive - is required before the NTLM hashes are available. Mimikatz can do this, but the question is looking for ways to open the SAM hive when not on the original Windows OS at all, sidestepping the need for mimikatz.
    – Royce Williams
    Apr 17, 2018 at 21:04
  • 1
    @RoyceWilliams - Thanks! This is exactly what I'm asking... If you know where to look up the details of how the SAM hive is formatted / encrypted, I might be able to write a new tool. Where can I find this information, do you know that?
    – Shuzheng
    Apr 18, 2018 at 6:51

1 Answer 1

Reset to default
5

secretsdump.py from impacket works. It ships with Kali as impacket-secretsdump. After extracting the SAM and SYSTEM hives from Windows/System32/config, you can use it like this:

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .