Angerona/documentation-payload/Cazalla/commands/samdump.md

samdump - Dump SAM Database

Extract NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.

Description

The samdump command extracts encrypted password hashes (NTLM) from the Windows SAM database for all local user accounts. It supports three different methods for accessing the SAM database, each with different privilege requirements and OPSEC considerations.

Important: Extracted hashes are automatically reported to Mythic's credential store for use in pass-the-hash attacks.

Syntax

samdump [method] [method-specific-parameters]

Methods

The command supports three methods for dumping the SAM database:

1. Registry Method (Default)

Accesses the SAM database directly through the Windows registry. This is the default method.

Syntax:

samdump registry

Parameters:

• No additional parameters required

Privileges Required:

• SYSTEM privileges (use steal_token on SYSTEM process first)
• Alternative: SeBackupPrivilege with NtOpenKeyEx (Windows 7+)

OPSEC Risk: CRITICAL

• Direct registry access to SAM/SYSTEM hives is heavily monitored
• EDR/XDR solutions have specific detection rules for this activity
• Detection likely within minutes
• High behavioral analysis risk

Best Practices:

• Always use steal_token on SYSTEM process before execution
• Consider off-hours execution
• Always requires approval from another operator
• Consider alternative methods for different detection signatures

2. Files Method

Loads SAM and SYSTEM hive files from disk and extracts hashes from the loaded hives.

Syntax:

samdump files <sam_path> <system_path>

Parameters:

• sam_path (required): Full path to SAM hive file
  • Example: C:\Windows\System32\config\SAM
  • Example: C:\Temp\SAM.backup
• system_path (required): Full path to SYSTEM hive file
  • Example: C:\Windows\System32\config\SYSTEM
  • Example: C:\Temp\SYSTEM.backup

Privileges Required:

• SYSTEM privileges OR
• SeBackupPrivilege and SeRestorePrivilege (for RegLoadKey)

OPSEC Risk: MEDIUM-HIGH

• File access is less monitored than direct registry access
• Still requires privileged access to load hives
• File read operations may be logged
• Lower detection rate than registry method, but still detectable
• Useful when you have offline copies of SAM/SYSTEM files

Best Practices:

• Use when you have access to SAM/SYSTEM files from backups or offline systems
• Lower detection profile than registry method
• Still requires SYSTEM or backup/restore privileges
• File access logs may be monitored

Example:

samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM

3. Remote Method

Connects to a remote system's registry and extracts SAM hashes over the network.

Syntax:

samdump remote <remote_host> [username] [password]

Parameters:

• remote_host (required): Remote system hostname or IP address
  • Example: \\TARGET-PC
  • Example: 192.168.1.100
• username (optional): Username for authentication (required if impersonating)
  • Can include domain: DOMAIN\user or user@domain.com
• password (optional): Password for authentication (required if impersonating)

Privileges Required:

• Network access to remote system
• Ability to start Remote Registry service on target
• Valid credentials (if impersonating) with appropriate permissions

OPSEC Risk: HIGH

• Network traffic (RPC calls to Remote Registry service)
• Service manipulation (starting Remote Registry service)
• Registry access over network is monitored
• Authentication attempts may be logged
• Network-based detection is possible
• Higher visibility than local methods

Best Practices:

• Use only when local access is not possible
• Ensure Remote Registry service can be started (may require admin rights)
• Network traffic is detectable by network monitoring tools
• Authentication attempts are logged
• Consider using existing authenticated sessions when possible
• Higher detection risk due to network activity

Example:

samdump remote \\TARGET-PC
samdump remote 192.168.1.100 DOMAIN\admin P@ssw0rd123

Examples

Local Registry Access (Default)

samdump
samdump registry

From Files

samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
samdump files C:\Backup\SAM C:\Backup\SYSTEM

Remote Access

samdump remote \\WORKSTATION-01
samdump remote 192.168.1.50
samdump remote \\SERVER-01 DOMAIN\admin Password123

Features

• Multiple Access Methods: Registry, files, or remote access
• Local Account Enumeration: Extracts hashes for all local user accounts
• NTLM Hash Extraction: Retrieves both LM and NTLM hashes (when available)
• Automatic Credential Reporting: Automatically reports extracted hashes to Mythic
• RID Extraction: Includes Relative Identifier (RID) for each account
• Artifact Tracking: Reports registry access, file access, or network connections

Output

The command outputs hashes in the standard format:

username:RID:LM:NTLM:::

Example Output

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6537b4eefd8b2aad3b435b51404eeaad3:::
user:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bd830b7586c5:::

Output Format

• username: Local account name
• RID: Relative Identifier (500 = Administrator, 501 = Guest, etc.)
• LM Hash: LAN Manager hash (often empty or weak)
• NTLM Hash: NT LAN Manager hash (used for authentication)

Credential Reporting

All extracted hashes are automatically reported to Mythic:

• Hashes: Reported as hash credential type
• Format: username:RID:LM:NTLM
• Realm: Empty (local accounts, no domain)
• Metadata: Includes RID and LM hash information

Credentials appear in Mythic's Credentials page (click the key icon in the UI).

Technical Details

Registry Method

1. Registry Access: Reads HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM
2. Boot Key Extraction: Extracts the boot key from SYSTEM hive
3. Hash Decryption: Decrypts password hashes using the boot key
4. Account Enumeration: Iterates through all local user accounts

Files Method

1. File Loading: Uses RegLoadKey to load SAM and SYSTEM hives from disk
2. Temporary Registry Keys: Creates temporary keys under HKEY_LOCAL_MACHINE
3. Boot Key Extraction: Extracts boot key from loaded SYSTEM hive
4. Hash Extraction: Extracts hashes from loaded SAM hive
5. Cleanup: Unloads hives after extraction

Remote Method

1. Service Management: Starts Remote Registry service if needed
2. Network Connection: Connects to remote registry via RegConnectRegistry
3. Remote Access: Accesses remote SAM/SYSTEM hives over network
4. Hash Extraction: Extracts hashes using same logic as local methods
5. Authentication: Supports user impersonation for authenticated access

Privilege Requirements

Registry Method

• SYSTEM privileges required: The SAM database is protected and only accessible to SYSTEM
• Use steal_token: Steal token from a SYSTEM process (e.g., steal_token 4 for System process)
• Alternative: Use SeBackupPrivilege with NtOpenKeyEx (Windows 7+)

Files Method

• SYSTEM privileges OR
• SeBackupPrivilege and SeRestorePrivilege: Required for RegLoadKey operations

Remote Method

• Network access to remote system
• Service management rights: Ability to start Remote Registry service
• Valid credentials: If impersonating (optional but recommended)

OPSEC Considerations

Method Comparison

Method	OPSEC Risk	Detection Likelihood	Key Indicators
Registry	CRITICAL	Very High (minutes)	Direct registry access, SAM/SYSTEM hive access
Files	MEDIUM-HIGH	Medium-High	File read operations, RegLoadKey calls
Remote	HIGH	High	Network traffic, RPC calls, service manipulation

Registry Method OPSEC

Risk Level: CRITICAL

• HIGH DETECTION RISK: SAM database access is heavily monitored
• EDR/XDR Detection: Most security tools have specific rules for this activity
• Registry Access Monitoring: Access to SAM/SYSTEM hives triggers alerts
• Credential Theft Indicators: This is a primary indicator of attack (MITRE T1003.002)
• Detection Timeframe: Detection is likely within minutes
• Behavioral Analysis: Pattern matching for credential extraction

Detection Mechanisms:

• Registry access to HKEY_LOCAL_MACHINE\SAM
• Registry access to HKEY_LOCAL_MACHINE\SYSTEM (boot key extraction)
• Behavioral analysis (credential extraction patterns)
• Credential theft detection rules
• Security event logging (if enabled)

Best Practices:

• Always use steal_token on SYSTEM process first
• Consider off-hours to reduce detection
• Always requires approval from another operator
• Consider alternative methods for different detection signatures
• Use sparingly and only when necessary

Files Method OPSEC

Risk Level: MEDIUM-HIGH

• Lower Detection Profile: File access is less monitored than direct registry access
• File Access Logging: File read operations may be logged but less aggressively
• Privilege Requirements: Still requires SYSTEM or backup/restore privileges
• RegLoadKey Monitoring: Loading registry hives may be logged
• Useful for Offline Analysis: Can work with backup files or offline systems

Detection Mechanisms:

• File access to SAM/SYSTEM files
• RegLoadKey API calls
• Privilege usage (SeBackupPrivilege/SeRestorePrivilege)
• File system monitoring (if enabled)

Best Practices:

• Use when you have access to SAM/SYSTEM files from backups
• Lower detection profile than registry method
• Still requires privileged access
• Useful for offline analysis of captured files
• File access logs may be monitored but less aggressively

Remote Method OPSEC

Risk Level: HIGH

• Network Traffic: RPC calls to Remote Registry service are detectable
• Service Manipulation: Starting Remote Registry service is logged
• Network Monitoring: Network-based detection is possible
• Authentication Logging: Authentication attempts are logged
• Registry Access Over Network: Remote registry access is monitored
• Higher Visibility: Network activity increases detection surface

Detection Mechanisms:

• Network traffic (RPC calls)
• Remote Registry service start/stop events
• Authentication attempts (if impersonating)
• Network-based behavioral analysis
• Registry access over network

Best Practices:

• Use only when local access is not possible
• Network traffic is detectable by network monitoring tools
• Authentication attempts are logged
• Consider using existing authenticated sessions
• Higher detection risk due to network activity
• Ensure proper network segmentation considerations

General OPSEC Best Practices

• Requires SYSTEM privileges (for registry and files methods): Use steal_token on SYSTEM process first
• Timing: Consider off-hours to reduce detection
• Authorization: Ensure proper authorization before use
• Always requires approval: Another operator must approve execution
• Alternative methods: Consider using Mimikatz via inline_execute_assembly for different detection signatures
• Method Selection: Choose the method with lowest OPSEC risk for your situation
  • Prefer files method when you have offline files
  • Avoid remote method unless necessary
  • Registry method has highest detection risk

Artifacts

The command automatically reports the following artifacts based on the method used:

Registry Method

• Registry Read: HKEY_LOCAL_MACHINE\SAM access
• Registry Read: HKEY_LOCAL_MACHINE\SYSTEM access (boot key extraction)
• Credential Access: SAM database enumeration and hash extraction

Files Method

• File Read: SAM file access
• File Read: SYSTEM file access (boot key)
• Credential Access: SAM database enumeration and hash extraction from files

Remote Method

• Network Connection: Remote registry connection to target
• Registry Read: Remote SAM database access
• Registry Read: Remote SYSTEM database access (boot key)
• Credential Access: Remote SAM database enumeration and hash extraction

Related

Token Operations - Steal SYSTEM token
Credentials Support
OPSEC Guide

---

Command Category: Credential Access
Requires Admin: Yes (SYSTEM privileges required for registry/files methods)
MITRE ATT&CK: T1003.002 - OS Credential Dumping: Security Account Manager, T1003.001 - OS Credential Dumping: LSASS Memory