Hack Forums
Crack Windows passwords with SAM file - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Crack Windows passwords with SAM file (/showthread.php?tid=6289208)

Crack Windows passwords with SAM file - Bastille - Jan 9, 2025

1. Retrieve the SAM and SYSTEM files

[Image: hHq2pOm.png]

These files are located in the following path:
Code
C:\Windows\System32\Config

[Image: h9nWN9e.png]

Information about the files :
SAM (Security Account Manager)
  • Contains hashed passwords for local user accounts.

  • These hashes are encrypted using a system key stored in the SYSTEM file.


SYSTEM
  • Stores configuration and encryption keys for the operatin system.

  • Includes the system key needed to decrypt the password hashes in the SAM file.


SECURITY
  • Contains local security policy information, such as auditing policies, privileges, and other security-related configurations.

  • Not necessary for password recvoery but useful for retrieving other security data.



2. Approaches to retrieve the files

1. From the Windows machine [Image: flbt2Kq.png]
You will need to do this from an administrator account, either by having remote access to the machine or physical access to it. For example, this could be possible if the user (who is also an administrator) has not locked their session (a beginner's mistake).

2. From a Linux machine [Image: JhuO86V.png]
You can extract the hard drive if you have physical access to the computer, connect it to your Linux machine, and follow the procedure below:

Code
lsblk
Lists available disks

Code
sudo mount /dev/sdXn /mtn
"X" is the number you retrieved with the previous command, "lsblk"

Code
cd /mnt/Windows/System32/config
sudo cp SAM SYSTEM SECURITY /home
To copy the files in your home folder

3. Exract the hash

From the following page : https://manpages.ubuntu.com/manpages/focal/man1/samdump2.1.html

Code
samdump2 [OPTIONS] SYSTEM_FILE SAM_FILE
Options :
  • -d / enable debugging

  • -h / display this help

  • -o file_name / write output to file



Code
samdump2 -o extracted_hash.txt SYSTEM SAM

4. Crack the hash

Many options here, the most user-friendly is to use online tools such as :
Or local tools such as :
  • John The Ripper
    Code
    john --format=NT hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

  • HashCat
    Code
    hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt




RE: Crack Windows passwords with SAM file - DramaKing - Jan 9, 2025

Were you able to get samdump2 to work?

RE: Crack Windows passwords with SAM file - Bastille - Jan 9, 2025

(Jan 9, 2025 05:14 AM)DramaKing Wrote:  Were you able to get samdump2 to work?

Yes, I've discovered this tool on a tryhackme.com room, and shared it here : https://hackforums.net/showthread.php?tid=6288695&pid=62635759#pid62635759

Is it an old tool that doesn't work anymore, something like that ?

RE: Crack Windows passwords with SAM file - DramaKing - Jan 9, 2025

(Jan 9, 2025 05:18 AM)Bastille Wrote:  Yes, I've discovered this tool on a tryhackme.com room, and shared it here : https://hackforums.net/showthread.php?tid=6288695&pid=62635759#pid62635759

Is it an old tool that doesn't work anymore, something like that ?

I stopped using it because I don't think that it works on the latest encryption. THM is probably using something like Windows 10 1507. Impacket's secretsdump script always does the trick.

RE: Crack Windows passwords with SAM file - Bastille - Jan 9, 2025

(Jan 9, 2025 05:23 AM)DramaKing Wrote:  I stopped using it because I don't think that it works on the latest encryption. THM is probably using something like Windows 10 1507. Impacket's secretsdump script always does the trick.

Interesting, thanks for the heads up, I'll update the thread when I have some free time with :)

RE: Crack Windows passwords with SAM file - padrino - Jan 10, 2025

will be adding this to the reading list!

RE: Crack Windows passwords with SAM file - JoseMar - Jan 12, 2025

Great job, mate! Your explanation is clear and easy to understand. Thank you!

RE: Crack Windows passwords with SAM file - Bastille - Jan 13, 2025

(Jan 10, 2025 03:09 AM)padrino Wrote:  will be adding this to the reading list!

Enjoy, besides feel free to browse the hacking tutorial section, there are a lot of interesting threads

(Jan 12, 2025 10:32 AM)JoseMar Wrote:  Great job, mate! Your explanation is clear and easy to understand. Thank you!

Thanks bro, and thanks for your tutorials too ! I'm glad to see this part of HF more active recently 😎