recovering the password hashes on windows machine after penetration is common goal among attackers these hashes can be cracked offline in an attempt to recover the target' passwordor they can be used in pass-the-hash attack to gain access to other network resources looking through the vms or snapshots on target is perfect place to attempt to recover these hashes whether the target is paranoid user who performs high-risk operations only on vm or an enterprise attempting to contain some of its user' activities to vmsthe vms present an excellent point to gather information after you've gained access to the host hardware volatility makes this recovery process extremely easy firstwe'll take look at how to operate the necessary plugins to retrieve the offsets in memory where the password hashes can be retrievedand then retrieve the hashes themselves then we'll create script to combine this into single step windows stores local passwords in the sam registry hive in hashed formatand alongside this the windows boot key stored in the system registry hive we need both of these hives in order to extract the hashes from memory image to startlet' run the hivelist plugin to make volatility extract the offsets in memory where these two hives live then we'll pass this information off to the hashdump plugin to do the actual hash extraction drop into your terminal and execute the following commandpython vol py hivelist --profile=winxpsp - "windowsxpsp vmemafter minute or twoyou should be presented with some output displaying where those registry hives live in memory clipped out portion of the output for brevity' sake virtual physical name --- xe ff \device\harddiskvolume \windows\system \config\software xe fedbb \device\harddiskvolume \windows\system \config\sam xe [no name xe cd \device\harddiskvolume \windows\system \config\system in the outputyou can see the virtual and physical memory offsets of both the sam and system keys in bold keep in mind that the virtual offset deals with where in memoryin relation to the operating systemthose hives exist the physical offset is the location in the actual vmem file on disk where those hives exist now that we have the sam and system hiveswe can pass the virtual offsets to the hashdump plugin go back to your terminal and enter the following commandnoting that your virtual addresses will be different than the ones show python vol py hashdump - - - "windowsxpsp vmem--profile=winxpsp - xe - xe adb running the above command should give you results much like the ones belowadministrator: : aaaddd ae dd : dfb fa ::guest: :aad ad ee: cfe ae ::helpassistant: :bf cf kdkkd : fbd ce fa ::support_ df: :aad eeaad ee: fc dcd fdaec fdfa aee::perfectwe can now send the hashes off to our favorite cracking tools or execute pass-the-hash to authenticate to other services now let' take this two-step process and streamline it into our own standalone script crack open grabhashes py and enter the following code