Dumping credentials from SAM file using mimikatz and cracking with john the ripper and hashcat

Windows stores user account passwords in SAM file. This file contains hashes of passwords. This SAM file cannot be opened directly by the user, so we have to dump it.

Tools used : Mimikatz John The Ripper , Hashcat.

Dumping SAM file:

For this we need to copy sam and system files from their original path to anywhere.

Copying SAM and SYSTEM files using CMD.

Step 1: Run CMD as administrator and run following commands.

Step 2: open Mimikatz and run the following commands.

We obtained the NTLM hash from the SAM file using Mimikatz.

Now, copy this hash and save it in a notepad file.

Obtaining password from john the ripper and hashcat:

1. Download john the ripper
2. Extract on desktop
3. Paste the notepad file in RUN in john the ripper folder.
4. Open cmd
5. Go to john the ripper.
6. Go to run
7. Run the following command.

Windows:

Kali Linux:

Note: 2602 is our password.

Using hashcat :

Run the following command in terminal.

hashcat -m 1000 -a 0 filename usr/share/wordlists/rockyou.txt

Note : 1000 — for NTLM hash.

Note:

Wordlist rockyou.txt.gz is compressed.

So unzip the file to use it.

Go to the file location via terminal and type:

Gzip -d rockyou.txt.gz