Series
Offline Windows credential dumping
4 posts in this series. Read them in order or jump to any one.
- How the Windows boot key (syskey) works
The boot key is the root of all offline credential dumping. Here is where it lives, why it is scrambled across four registry keys, and how to reassemble it from the SYSTEM hive.
- Decrypting local account hashes from the SAM hive
From the hashed boot key to a user's NT hash: the F and V structures, the RC4 vs AES storage formats, and the per-RID DES layer that wraps every Windows password hash.
- LSA secrets and cached domain credentials (DCC2), explained
The SECURITY hive holds service passwords, the machine account, DPAPI keys and logon caches. See how the LSA key unlocks them — and why DCC2 is salted but still crackable.
- NTDS.dit explained: how domain hashes are stored and dumped
A domain controller keeps every account hash in one ESE database. See how the datatable, the Password Encryption Key (PEK) and each cipher layer fit — and how a hash is unwrapped offline.