3

After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.

In particular, samdump2 decrypted the SAM hive into a list of users with "blank" passwords:

samdump2 system sam -o out

I.e., admin:1001:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Conversely, mimikatz succeeded in outputting the proper NTLM hash:

mimikatz # lsadump::sam /system:C:\system /sam:C:\sam

I.e.,

RID  : 000003e9 (1001)
User : admin
  Hash NTLM: f1320e0960da374b88e40cffbec44885

The problem with mimikatz is that AVs flag it as malware the moment it gets download.

Are there other tools available on Kali that may decrypt the SAM file properly after Windows 10 anniversary update?

  • Can't you simply whitelist that software in your AV? – forest Apr 17 '18 at 9:48
  • @forest - Yes, I can. But I really want to be able to decrypt the SAM hive on my Kali box instead. – Shuzheng Apr 17 '18 at 9:49
  • Are you just asking for a way to crack NTLM hashes on Kali Linux? – forest Apr 17 '18 at 9:51
  • 1
    I can easily crack the NTLM hashes on Kali using john. However, conventional tools like samdump2 fails in decrypting the SAM hive to reveal the NTLM hashes. I'm looking for a substitute for samdump2 with support for Windows 10... – Shuzheng Apr 17 '18 at 9:53
  • 1
    @FlorinCoada - Yes, I can crack them on the same machine (i.e., Windows 10). However, I'd rather not use mimikatz... – Shuzheng Apr 17 '18 at 10:47
2

Why not just resetting the password? This is much easier and the process could be done in less than 5 minutes.

For password recovery, Ophcrack seems more effective than mimikatz.

Credit: A list of the top 10 free password recovery tool for Windows

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.