# samdump - Dump SAM Database

Extract NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.

## Description

The `samdump` command extracts encrypted password hashes (NTLM) from the Windows SAM database for all local user accounts. It supports three different methods for accessing the SAM database, each with different privilege requirements and OPSEC considerations.

**Important:** Extracted hashes are automatically reported to Mythic's credential store for use in pass-the-hash attacks.

## Syntax

```
samdump [method] [method-specific-parameters]
```

## Methods

The command supports three methods for dumping the SAM database:

### 1. Registry Method (Default)

Accesses the SAM database directly through the Windows registry. This is the default method.

**Syntax:**
```
samdump registry
```

**Parameters:**
- No additional parameters required

**Privileges Required:**
- **SYSTEM privileges** (use `steal_token` on SYSTEM process first)
- Alternative: `SeBackupPrivilege` with `NtOpenKeyEx` (Windows 7+)

**OPSEC Risk:** **CRITICAL**
- Direct registry access to SAM/SYSTEM hives is heavily monitored
- EDR/XDR solutions have specific detection rules for this activity
- Detection likely within minutes
- High behavioral analysis risk

**Best Practices:**
- Always use `steal_token` on SYSTEM process before execution
- Consider off-hours execution
- Always requires approval from another operator
- Consider alternative methods for different detection signatures

### 2. Files Method

Loads SAM and SYSTEM hive files from disk and extracts hashes from the loaded hives.

**Syntax:**
```
samdump files <sam_path> <system_path>
```

**Parameters:**
- `sam_path` (required): Full path to SAM hive file
  - Example: `C:\Windows\System32\config\SAM`
  - Example: `C:\Temp\SAM.backup`
- `system_path` (required): Full path to SYSTEM hive file
  - Example: `C:\Windows\System32\config\SYSTEM`
  - Example: `C:\Temp\SYSTEM.backup`

**Privileges Required:**
- **SYSTEM privileges** OR
- `SeBackupPrivilege` and `SeRestorePrivilege` (for `RegLoadKey`)

**OPSEC Risk:** **MEDIUM-HIGH**
- File access is less monitored than direct registry access
- Still requires privileged access to load hives
- File read operations may be logged
- Lower detection rate than registry method, but still detectable
- Useful when you have offline copies of SAM/SYSTEM files

**Best Practices:**
- Use when you have access to SAM/SYSTEM files from backups or offline systems
- Lower detection profile than registry method
- Still requires SYSTEM or backup/restore privileges
- File access logs may be monitored

**Example:**
```
samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
```

### 3. Remote Method

Connects to a remote system's registry and extracts SAM hashes over the network.

**Syntax:**
```
samdump remote <remote_host> [username] [password]
```

**Parameters:**
- `remote_host` (required): Remote system hostname or IP address
  - Example: `\\TARGET-PC`
  - Example: `192.168.1.100`
- `username` (optional): Username for authentication (required if impersonating)
  - Can include domain: `DOMAIN\user` or `user@domain.com`
- `password` (optional): Password for authentication (required if impersonating)

**Privileges Required:**
- Network access to remote system
- Ability to start Remote Registry service on target
- Valid credentials (if impersonating) with appropriate permissions

**OPSEC Risk:** **HIGH**
- Network traffic (RPC calls to Remote Registry service)
- Service manipulation (starting Remote Registry service)
- Registry access over network is monitored
- Authentication attempts may be logged
- Network-based detection is possible
- Higher visibility than local methods

**Best Practices:**
- Use only when local access is not possible
- Ensure Remote Registry service can be started (may require admin rights)
- Network traffic is detectable by network monitoring tools
- Authentication attempts are logged
- Consider using existing authenticated sessions when possible
- Higher detection risk due to network activity

**Example:**
```
samdump remote \\TARGET-PC
samdump remote 192.168.1.100 DOMAIN\admin P@ssw0rd123
```

## Examples

### Local Registry Access (Default)
```
samdump
samdump registry
```

### From Files
```
samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
samdump files C:\Backup\SAM C:\Backup\SYSTEM
```

### Remote Access
```
samdump remote \\WORKSTATION-01
samdump remote 192.168.1.50
samdump remote \\SERVER-01 DOMAIN\admin Password123
```

## Features

- **Multiple Access Methods**: Registry, files, or remote access
- **Local Account Enumeration**: Extracts hashes for all local user accounts
- **NTLM Hash Extraction**: Retrieves both LM and NTLM hashes (when available)
- **Automatic Credential Reporting**: Automatically reports extracted hashes to Mythic
- **RID Extraction**: Includes Relative Identifier (RID) for each account
- **Artifact Tracking**: Reports registry access, file access, or network connections

## Output

The command outputs hashes in the standard format:

```
username:RID:LM:NTLM:::
```

### Example Output

```
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6537b4eefd8b2aad3b435b51404eeaad3:::
user:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bd830b7586c5:::
```

### Output Format

- **username**: Local account name
- **RID**: Relative Identifier (500 = Administrator, 501 = Guest, etc.)
- **LM Hash**: LAN Manager hash (often empty or weak)
- **NTLM Hash**: NT LAN Manager hash (used for authentication)

## Credential Reporting

**All extracted hashes are automatically reported to Mythic:**

- **Hashes**: Reported as `hash` credential type
- **Format**: `username:RID:LM:NTLM`
- **Realm**: Empty (local accounts, no domain)
- **Metadata**: Includes RID and LM hash information

Credentials appear in Mythic's Credentials page (click the key icon in the UI).

## Technical Details

### Registry Method

1. **Registry Access**: Reads `HKEY_LOCAL_MACHINE\SAM` and `HKEY_LOCAL_MACHINE\SYSTEM`
2. **Boot Key Extraction**: Extracts the boot key from SYSTEM hive
3. **Hash Decryption**: Decrypts password hashes using the boot key
4. **Account Enumeration**: Iterates through all local user accounts

### Files Method

1. **File Loading**: Uses `RegLoadKey` to load SAM and SYSTEM hives from disk
2. **Temporary Registry Keys**: Creates temporary keys under `HKEY_LOCAL_MACHINE`
3. **Boot Key Extraction**: Extracts boot key from loaded SYSTEM hive
4. **Hash Extraction**: Extracts hashes from loaded SAM hive
5. **Cleanup**: Unloads hives after extraction

### Remote Method

1. **Service Management**: Starts Remote Registry service if needed
2. **Network Connection**: Connects to remote registry via `RegConnectRegistry`
3. **Remote Access**: Accesses remote SAM/SYSTEM hives over network
4. **Hash Extraction**: Extracts hashes using same logic as local methods
5. **Authentication**: Supports user impersonation for authenticated access

### Privilege Requirements

#### Registry Method
- **SYSTEM privileges required**: The SAM database is protected and only accessible to SYSTEM
- **Use `steal_token`**: Steal token from a SYSTEM process (e.g., `steal_token 4` for System process)
- **Alternative**: Use `SeBackupPrivilege` with `NtOpenKeyEx` (Windows 7+)

#### Files Method
- **SYSTEM privileges** OR
- **`SeBackupPrivilege` and `SeRestorePrivilege`**: Required for `RegLoadKey` operations

#### Remote Method
- **Network access** to remote system
- **Service management rights**: Ability to start Remote Registry service
- **Valid credentials**: If impersonating (optional but recommended)

## OPSEC Considerations

### Method Comparison

| Method | OPSEC Risk | Detection Likelihood | Key Indicators |
|--------|------------|---------------------|----------------|
| **Registry** | **CRITICAL** | Very High (minutes) | Direct registry access, SAM/SYSTEM hive access |
| **Files** | **MEDIUM-HIGH** | Medium-High | File read operations, RegLoadKey calls |
| **Remote** | **HIGH** | High | Network traffic, RPC calls, service manipulation |

### Registry Method OPSEC

**Risk Level: CRITICAL**

- **HIGH DETECTION RISK**: SAM database access is heavily monitored
- **EDR/XDR Detection**: Most security tools have specific rules for this activity
- **Registry Access Monitoring**: Access to SAM/SYSTEM hives triggers alerts
- **Credential Theft Indicators**: This is a primary indicator of attack (MITRE T1003.002)
- **Detection Timeframe**: Detection is likely within minutes
- **Behavioral Analysis**: Pattern matching for credential extraction

**Detection Mechanisms:**
- Registry access to `HKEY_LOCAL_MACHINE\SAM`
- Registry access to `HKEY_LOCAL_MACHINE\SYSTEM` (boot key extraction)
- Behavioral analysis (credential extraction patterns)
- Credential theft detection rules
- Security event logging (if enabled)

**Best Practices:**
- Always use `steal_token` on SYSTEM process first
- Consider off-hours to reduce detection
- Always requires approval from another operator
- Consider alternative methods for different detection signatures
- Use sparingly and only when necessary

### Files Method OPSEC

**Risk Level: MEDIUM-HIGH**

- **Lower Detection Profile**: File access is less monitored than direct registry access
- **File Access Logging**: File read operations may be logged but less aggressively
- **Privilege Requirements**: Still requires SYSTEM or backup/restore privileges
- **RegLoadKey Monitoring**: Loading registry hives may be logged
- **Useful for Offline Analysis**: Can work with backup files or offline systems

**Detection Mechanisms:**
- File access to SAM/SYSTEM files
- `RegLoadKey` API calls
- Privilege usage (SeBackupPrivilege/SeRestorePrivilege)
- File system monitoring (if enabled)

**Best Practices:**
- Use when you have access to SAM/SYSTEM files from backups
- Lower detection profile than registry method
- Still requires privileged access
- Useful for offline analysis of captured files
- File access logs may be monitored but less aggressively

### Remote Method OPSEC

**Risk Level: HIGH**

- **Network Traffic**: RPC calls to Remote Registry service are detectable
- **Service Manipulation**: Starting Remote Registry service is logged
- **Network Monitoring**: Network-based detection is possible
- **Authentication Logging**: Authentication attempts are logged
- **Registry Access Over Network**: Remote registry access is monitored
- **Higher Visibility**: Network activity increases detection surface

**Detection Mechanisms:**
- Network traffic (RPC calls)
- Remote Registry service start/stop events
- Authentication attempts (if impersonating)
- Network-based behavioral analysis
- Registry access over network

**Best Practices:**
- Use only when local access is not possible
- Network traffic is detectable by network monitoring tools
- Authentication attempts are logged
- Consider using existing authenticated sessions
- Higher detection risk due to network activity
- Ensure proper network segmentation considerations

### General OPSEC Best Practices

- **Requires SYSTEM privileges** (for registry and files methods): Use `steal_token` on SYSTEM process first
- **Timing**: Consider off-hours to reduce detection
- **Authorization**: Ensure proper authorization before use
- **Always requires approval**: Another operator must approve execution
- **Alternative methods**: Consider using Mimikatz via `inline_execute_assembly` for different detection signatures
- **Method Selection**: Choose the method with lowest OPSEC risk for your situation
  - Prefer files method when you have offline files
  - Avoid remote method unless necessary
  - Registry method has highest detection risk

## Artifacts

The command automatically reports the following artifacts based on the method used:

### Registry Method
- **Registry Read**: `HKEY_LOCAL_MACHINE\SAM` access
- **Registry Read**: `HKEY_LOCAL_MACHINE\SYSTEM` access (boot key extraction)
- **Credential Access**: SAM database enumeration and hash extraction

### Files Method
- **File Read**: SAM file access
- **File Read**: SYSTEM file access (boot key)
- **Credential Access**: SAM database enumeration and hash extraction from files

### Remote Method
- **Network Connection**: Remote registry connection to target
- **Registry Read**: Remote SAM database access
- **Registry Read**: Remote SYSTEM database access (boot key)
- **Credential Access**: Remote SAM database enumeration and hash extraction

## Related

[Token Operations](../commands.md#token-operations) - Steal SYSTEM token  
[Credentials Support](../../../features.md#credentials-support)  
[OPSEC Guide](../../../opsec.md)

---

**Command Category:** Credential Access  
**Requires Admin:** Yes (SYSTEM privileges required for registry/files methods)  
**MITRE ATT&CK:** [T1003.002 - OS Credential Dumping: Security Account Manager](https://attack.mitre.org/techniques/T1003/002/), [T1003.001 - OS Credential Dumping: LSASS Memory](https://attack.mitre.org/techniques/T1003/001/)