Skip to main content
1 of 2
Sardoc
  • 226
  • 1
  • 3

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config

On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file.

If you open the file, you'll see lines similar to below:

admin:1006:NO PASSWORD*********************:44bf0244f032ca8baaddda0fa9328bf8:::

This means the admin account's NTLM password is "44bf0244f032ca8baaddda0fa9328bf8".

If you see something like:

admin:1006:37035b1c4ae2b0c54a15db05d307b01b:44bf0244f032ca8baaddda0fa9328bf8:::

This means the PC has LM hashes enabled. In this case, the LM hash is "37035b1c4ae2b0c54a15db05d307b01b". LM hashes are easy to crack, they have the strength of a 7 character password (look it up on wikipedia to find out why).

The SAM and SYSTEM file generally are obtained when the PC is powered off. However, there is a technique to get the files when the PC is powered on, using shadow volume copy, which is available in modern versions of windows. Essentially, this allows you to take a back up of the running system, and you can extract the SAM and SYSTEM file from that backup. Google is your friend, there are many articles explaining this technique in detail.

Sardoc
  • 226
  • 1
  • 3