Braindump
Read BlogpostsLet's Connect
  • Introduction: My OSCP Journey
  • Writeup Index
  • OSCP Machine Writeups
    • 🔥PG - Practice
      • Shenzi
      • DVR4
      • Resourced
      • Kevin
      • Nara
      • Jacko
      • Authby
      • Access
      • Internal
      • Hutch
      • Algernon
      • HelpDesk
      • Squid
      • Hepet
      • Craft2
      • ClamAV
      • Pelican
      • Payday
      • Snookums
      • Bratarina
      • Nibbles
      • Hetemit
      • Hawat
      • Astronaut
      • Exfiltrated
      • Fanatastic
      • Wombo
      • Levram
      • LaVita
    • 💣HackTheBox
      • Devel
      • Legacy
      • Intelligence
        • Learning
      • Blackfield
        • PrivEsc - SeBackupPrivilege
      • Sauna
      • Bastard
      • Arctic
      • Forest
      • Active
      • SecNotes
      • Access
  • Preparation Notes
    • Tips and Tricks
      • File Transfer
      • Download a file - Windows CLI
      • Bypassing Firewall/Defender/UAC
      • Accessing File
      • Reverse Shell
      • OneLiner - Reverse/bind Shell
      • OneLiner - MSFVenom
    • Enumeration Techniques
      • System and Network Enumeration
      • Web Enumeration
      • Service Enum
      • CMS
    • Exploitation
      • Exploiting Web Apps
      • Exploiting Wordpress
      • Public Exploits
    • Privilege Escalation
      • Linux Privilege Escalation
        • Disk Group PrivEsc
      • Windows Privilege Escalation
    • Active Directory
      • Enumeration
      • AD Attacks
      • mimikatz
      • Lateral movement
    • Pivoting and Networking
      • SSH Port Forwarding
      • Ligolo-ng
    • Password Cracking
Powered by GitBook
On this page
  • Got SAM and SYSTEM file?
  • Got NTUSER.DAT

Was this helpful?

  1. Preparation Notes
  2. Tips and Tricks

Accessing File

SAM, SYSTEM, NTUSER.DAT

Got SAM and SYSTEM file?

Extracts secrets using impacket-secretsdump

impacket-secretsdump -sam SAM -system SYSTEM LOCAL
>
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Target system bootKey: 0x8bca2f7ad576c856d79b7111806b533d
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:acbb9b77c62fdd8fe5976148a933177a:::
tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f24dc:::
Cheyanne.Adams:1002:aad3b435b51404eeaad3b435b51404ee:b3930e99899cb55b4aefef9a7021ffd0:::
David.Rhys:1003:aad3b435b51404eeaad3b435b51404ee:9ac088de348444c71dba2dca92127c11:::
Mark.Chetty:1004:aad3b435b51404eeaad3b435b51404ee:92903f280e5c5f3cab018bd91b94c771:::
[*] Cleaning up...

Got NTUSER.DAT

Extract registry information using reglookup

reglookup NTUSER.DAT 

PreviousBypassing Firewall/Defender/UACNextReverse Shell

Last updated 3 days ago

Was this helpful?