Skip to content
›_Secrets Dump

Posts tagged: #ntlm

← Back to all posts
secretsdump output format: username:RID:LMhash:NThash
How to read Impacket secretsdump output — the username:RID:LMhash:NThash pwdump line, the blank LM hash, the DCC2 ($DCC2$) cache and the LSA secrets block.
secretsdumpimpacketntlmoutput
Decrypting local account hashes from the SAM hive
From the hashed boot key to a user's NT hash: the F and V structures, the RC4 vs AES storage formats, and the per-RID DES layer that wraps every Windows password hash.
windowscredentialssamntlm