SamDump implemented

2025-12-17 16:13:40 +01:00
parent 9351102878
commit cb774a21a3
18 changed files with 3403 additions and 122 deletions
@@ -1154,6 +1154,83 @@ browser_dump firefox

 ---

+### `samdump` - Dump SAM Database
+
+Extract NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.
+
+**Syntax:**
+```
+samdump [method] [method-specific-parameters]
+```
+
+**Methods:**
+
+1. **Registry (Default)** - Direct registry access
+   ```
+   samdump
+   samdump registry
+   ```
+   - **OPSEC Risk**: CRITICAL
+   - **Requires**: SYSTEM privileges
+   - **Detection**: Very high (minutes)
+
+2. **Files** - From SAM/SYSTEM files
+   ```
+   samdump files <sam_path> <system_path>
+   ```
+   - **OPSEC Risk**: MEDIUM-HIGH
+   - **Requires**: SYSTEM or backup/restore privileges
+   - **Detection**: Medium-High (hours to days)
+   - **Example**: `samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM`
+
+3. **Remote** - Remote registry access
+   ```
+   samdump remote <remote_host> [username] [password]
+   ```
+   - **OPSEC Risk**: HIGH
+   - **Requires**: Network access, ability to start Remote Registry service
+   - **Detection**: High (minutes to hours)
+   - **Example**: `samdump remote \\TARGET-PC`
+
+**Features:**
+- **Multiple Access Methods**: Registry, files, or remote access
+- **Local Account Enumeration**: Extracts hashes for all local user accounts
+- **NTLM Hash Extraction**: Retrieves both LM and NTLM hashes (when available)
+- **Automatic Credential Reporting**: Automatically reports extracted hashes to Mythic
+- **RID Extraction**: Includes Relative Identifier (RID) for each account
+- **Artifact Tracking**: Reports registry access, file access, or network connections
+
+**Output:**
+```
+Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+user:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bd830b7586c5:::
+```
+
+**OPSEC Considerations:**
+
+| Method | Risk | Detection | Best Use Case |
+|--------|------|-----------|---------------|
+| **Registry** | CRITICAL | Very High (minutes) | Default method, highest detection risk |
+| **Files** | MEDIUM-HIGH | Medium-High (hours-days) | Offline analysis, backup files |
+| **Remote** | HIGH | High (minutes-hours) | Remote systems, network access |
+
+- **Registry Method**: Direct SAM/SYSTEM registry access is heavily monitored, requires SYSTEM privileges, always requires approval
+- **Files Method**: Lower detection profile, useful for offline analysis, still requires privileged access
+- **Remote Method**: Network traffic detectable, service manipulation logged, use only when local access not possible
+- **General**: Always use `steal_token` on SYSTEM process first (for registry/files), consider timing, always requires approval
+
+**Technical Details:**
+- **Registry**: Accesses `HKEY_LOCAL_MACHINE\SAM` and `HKEY_LOCAL_MACHINE\SYSTEM` registry hives
+- **Files**: Uses `RegLoadKey` to load SAM/SYSTEM hives from disk
+- **Remote**: Connects to remote registry via `RegConnectRegistry`, starts Remote Registry service if needed
+- Extracts boot key from SYSTEM hive to decrypt password hashes
+- Output format: `username:RID:LM:NTLM:::`
+
+**Related:** [Token Operations](#token-operations), [Credentials Support](features.md#credentials-support), [Detailed Documentation](commands/samdump.md)
+
+---
+
 ## Control Commands

 ### `sleep` - Adjust Beacon Interval