> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-domain-compromise/sam-cleanup.md).

# SAM Cleanup

Bash one-liner to just output NTLM Hashes

```bash
cat hashes.txt | grep ::: | awk -F: '{print $1":"$4}'
```

```bash
hashcat --user -m 1000 hashes.txt ~/rockyou.txt -O -r /usr/share/hashcat/rules/InsidePro-PasswordsPro.rule
```