0

Hashes of user account passwords in Windows 10 (like in older versions) are stored in SAM file. Using standard utility pwdump 7 for getting these hashes gives following result:

::LM hash : NTLM hash

But these hashes are encrypted with AES 128. I wonder where I can found AES keys for encrypting these hashes and how I can retrieve them?

Improve this question

1 Answer 1

Reset to default
1

The AES Key to decrypt the Double Encrypted Hash is derived from the “SysKey”, which is in itself also AES encrypted.

Improve this answer
8
  • I use mimikatz; get necessary privilege and after command lsadump::sam I have a table where there are SysKey and SAMKey values. I 've tried to use them like decryption key for AES-128 ECB but they have brought me "wrong" hashes. Is SysKey encrypted on som master key? And how can I derive right value of encryption key AES 128?
    – Setplus
    Commented Jan 24, 2019 at 13:16
  • SysKey is AES encrypted with Bootkey.
    – nethero
    Commented Jan 24, 2019 at 14:30
  • can you write please, how can I decrypt it?
    – Setplus
    Commented Jan 24, 2019 at 14:33
  • Bootkey is calculated by reordering the 4 Class Names from JD, Skew1, GBG and Data
    – nethero
    Commented Jan 24, 2019 at 14:39
  • I've answered your initial question.
    – nethero
    Commented Jan 24, 2019 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .