Hashes of user account passwords in Windows 10 (like in older versions) are stored in SAM file. Using standard utility pwdump 7 for getting these hashes gives following result:

::LM hash : NTLM hash

But these hashes are encrypted with AES 128. I wonder where I can found AES keys for encrypting these hashes and how I can retrieve them?


The AES Key to decrypt the Double Encrypted Hash is derived from the “SysKey”, which is in itself also AES encrypted.

  • I use mimikatz; get necessary privilege and after command lsadump::sam I have a table where there are SysKey and SAMKey values. I 've tried to use them like decryption key for AES-128 ECB but they have brought me "wrong" hashes. Is SysKey encrypted on som master key? And how can I derive right value of encryption key AES 128? – Setplus Jan 24 '19 at 13:16
  • SysKey is AES encrypted with Bootkey. – Kamil Kurzynowski Jan 24 '19 at 14:30
  • can you write please, how can I decrypt it? – Setplus Jan 24 '19 at 14:33
  • Bootkey is calculated by reordering the 4 Class Names from JD, Skew1, GBG and Data – Kamil Kurzynowski Jan 24 '19 at 14:39
  • I've answered your initial question. – Kamil Kurzynowski Jan 24 '19 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.