So in our challenge, we said we wanted to be able to extract hashes from the SAM and System Registry Hives from a Windows 11 system that I imported for us.
I have them right here, and I'm highlighting them now.
And I also have this terminal opened where I use cred.7 to be able to do just that.
And I'm going to zoom in for us here real quick, because I wanted to show you the little differences between Windows 11 output and previous ones that we've seen before.
And they are not that much.
The only difference here is that you see a default difference between Windows 11 accounts and previous versions of Windows, and you don't see any accounts in here that are disabled.
This was from a very basic install of Windows 11 that I use for practice in my virtual lab here at the house.
And you can see Zaphod is down at the bottom, and his user ID is with that for the quiz question down below.
Now, if you'll notice, the NTLM hash is the same for the first part.
The NT portion is the same for Eric and also Zaphod, but the difference is in the LM hash.
So this is a little quirk in how Windows 11 deals with their hashes.
But if you want to expand a little bit further and start using HashDump, you'll notice there ain't that much difference in how they protect the passwords for NTLM.
I would suggest 5000 or maybe even still using mode 1000.
So that's it for here as far as like using the hashes and everything like that to crack.
But when we start moving forward, we're going to see if we can start getting into the system physically to be able to retrieve some of this information so we can bring it over to our pentesting workstation.
And then as we continue throughout the course, we'll be introducing more password cracking tools like John the Ripper.
I hope this has been informative for you, and I'd like to thank you for viewing.