After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.

In particular, samdump2 decrypted the SAM hive into a list of users with "blank" passwords:

samdump2 system sam -o out

I.e., admin:1001:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Conversely, mimikatz succeeded in outputting the proper NTLM hash:

mimikatz # lsadump::sam /system:C:\system /sam:C:\sam

I.e.,

RID  : 000003e9 (1001)
User : admin
  Hash NTLM: f1320e0960da374b88e40cffbec44885

The problem with mimikatz is that AVs flag it as malware the moment it gets download.

Are there other tools available on Kali that may decrypt the SAM file properly after Windows 10 anniversary update?

  • Can't you simply whitelist that software in your AV? – forest Apr 17 at 9:48
  • @forest - Yes, I can. But I really want to be able to decrypt the SAM hive on my Kali box instead. – user111854 Apr 17 at 9:49
  • Are you just asking for a way to crack NTLM hashes on Kali Linux? – forest Apr 17 at 9:51
  • 1
    I can easily crack the NTLM hashes on Kali using john. However, conventional tools like samdump2 fails in decrypting the SAM hive to reveal the NTLM hashes. I'm looking for a substitute for samdump2 with support for Windows 10... – user111854 Apr 17 at 9:53
  • 1
    @FlorinCoada - Yes, I can crack them on the same machine (i.e., Windows 10). However, I'd rather not use mimikatz... – user111854 Apr 17 at 10:47

Why not just resetting the password? This is much easier and the process could be done in less than 5 minutes.

For password recovery, Ophcrack seems more effective than mimikatz.

Credit: A list of the top 10 free password recovery tool for Windows

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.