Yes, yes, I know we've been picking on XP a little bit just because it's easy to do and it gets us a little bit familiar with things that are coming up that are more recent.
For example, Windows 10. Now I'm going to be using Windows 10 as our demonstration for this portion of the skill because we don't have Windows 11 available in Adept Labs just yet.
Now I can import later on and we may do this as an additional exercise in further skills, Windows 11 files from my personal Windows 11 virtual machine.
But for the sake of argument, let's pretend that Windows 10 and 11 are very similar in how they store local user accounts because they are really close.
And the reason I bring that up is because inside of our lab, you may also notice a folder next to XP to the left called 10.
And inside of there is the SAM and system hives of the actual Windows 10 system within our lab, the BWAP system.
And I created another user inside of there.
And we're going to take a little look real quick to get an understanding of understanding the hash output from Windows 10 because we can't use off crack to actually sit down and give us a clear password break like it does at XP.
Because we don't have an updated rainbows table that's aligned with how Windows 10 and beyond does their hashing or encryption for passwords.
So we're going to take a look at just getting the actual NTLM hash from the user accounts on that system and get an understanding.
So let's hop on over to our lab real quick.
And you can see here that I'm in Kali.
Now we're going to be using a tool called SAM dump.
And like I mentioned, I have a folder here that has the SAM and system registry hives from that Windows 10 BWAP system.
Now, I'm already going to run this and I'm going to have the code for this below.
But it's very simplistic, sudo samdump2 and then system and SAM of the actual registry hives that you brought over or acquired.
Now, I happen to be in the, well, let me change my directory because I'm in the mount folder right now.
I'll change directory into home Kali desktop into 10.
Do an LS real quick.
And yep, there we go.
And I'm going to use these right here.
Same command.
It's just I wanted to make sure I was in the right folder.
So when we run this, it's going to basically take a look at those two hives, combine them together and export hashing for the user accounts that are actually on the system.
Now, this SAM dump was developed before Windows 10.
So there's a little bit of a quirk to it.
All the users are here.
However, we don't see all the names necessarily.
And I'll give you an example here real quick.
As I zoom in, we can see that we have learner.
And right below that, we have 1002.
That's actually a user and the user ID, the UID.
And we need to know that when we see that and not necessarily a name right in front of it, that that's not a phantom account.
That's actually a real user account because you can see the others above it.
They're disabled and they have names with them.
Some of them do.
Administrator, guest, 503, 504.
And then you have learner.
Well, looking at 1002, you can see here that there is no name associated with it.
But I want to show you real quick.
And the command for this will be below as well.
On the actual Windows 10 system, and I'm going to zoom in, that 1002 user is Ford Prefect.
Now, he is sitting in the local users and groups on that Windows 10 system.
And the way I can verify this, just as a proof of concept for us, is using the WMIC account list or user account list full command.
And when I do this and run it, you're going to get a whole list of users on the actual system.
And I'm going to scroll up to Ford Prefect real quick and highlight it for us.
Now, right here, you can see that account type 512 user account.
No description. It's not disabled.
Look down, look down, name, Ford Prefect.
Well, if I go down and look at the SID, which is the full system ID, at the end of it, there's 1002.
And that 1002 is the actual user ID.
It's truncated from the SID.
And as an example of this, let me scroll up to Lerner real quick, if I can find it, because there's a whole lot of text here real quick.
Administrator, default, Ford, and Lerner right here.
And I'm going to highlight it, and then you can see that in the SID for Lerner, at the end of it, it's 1001.
Well, if we hop back over to the actual SAM dump in Kali, you can see, and I'm going to highlight for you right here, that Lerner colon 1001.
So, we know that this is based more off the UID than it is names, and if there's not a description or anything like that, that's okay.
This basis is off of the user ID, and if there's no name or description tied to it or anything like that, or it's hidden, it will come up in SAM dump.
So, the last line is what we're taking a look at here, and you can see that there are two hashes.
And this is very similar to the off-track output when we were looking and piddling with our Windows XP system.
So, we have the NT and LM, and by their powers combined, the NTLM hash.
Well, the next part is, what do we do with this?
Because we have the hashing for that actual user that was exported from the SAM system registry.
Where does it make a password?
Now, just in case that SAM dump doesn't give you exactly what it is that you're looking for, or that you're trying to use a newer version of Windows.
Like, for instance, we're working with Windows 10 here.
I went through SAM dump just so you would be familiar with it.
I wanted to show you something else as well, and that is the actual password dump from CredDumper.
And the CredCredentialDumper is in the actual submenu, submenu 8 for credential access.
Go into hash identification, or excuse me, OSCredentialDumping, and you'll see CredDump7.
I'm going to highlight that for you, and then make sure you can actually see it as I zoom in right there.
So, under OSCredentialDumping, CredDump7, it's going to open up a terminal window for you with a submenu.
I have the command below for you to use it with your Python script.
And basically what it does is it works very similar to SAM dump, but it also supports newer versions of Windows.
Now, we're using Windows 10 in our lab here, but I can tell you that it does, in fact, work with Windows 11.
So, we're using pwdump.py and pointing it to the actual system and SAM file for our Windows 10 system.
When we press enter, we get a more defined look of the actual hash dumping.
And you can see here that we have full information for Ford Prefect, along with his full NTLM hash.
And I'm specifically pointing that out because we're going to crack this password using HashCat,
and it's important for us to know what type of hash that we're dealing with here.
So, taking this information, we're going to create inside of our Windows 10 folder a document that I have called Windows 10.
So, as I zoom in, we just copy that line that we get from the hash output in CredDump and paste it in here.
Character for character.
Now, you can put more than one in here, but for the sake of time and also understanding that we're limited on resources in our lab,
we're only doing Ford Prefect here to see if we can crack his password.
And in the next portion of the skill, we're going to be taking a look at HashCat.
I kind of wanted to put a break here for a second for the actual retrieval first
and understanding that there are multiple ways to be able to do hash dumping using the registry.
Because when we get into HashCat, we're going to be bringing in hashes outside of the actual Windows 10 arena, or Windows arena, if you will.
And I kind of wanted to focus on HashCat by itself for just a minute as well, too.
So, be right back.