Extract local account hashes from matched SAM and SYSTEM

Needs: Matched SAM/SYSTEM from the same system and appropriate read/backup access

Windows commands

REM Baseline
reg save HKLM\SAM C:\Windows\Temp\SAM.hive /y
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.hive /y

Shell commands

# Baseline
impacket-secretsdump -sam SAM.hive -system SYSTEM.hive LOCAL

Mimikatz alternative from a suitable elevated context

# Mimikatz alternative from a suitable elevated context
privilege::debug
token::elevate
lsadump::sam

# Interpret a typical account row as
LOCAL_USER:RID:LM_HASH:NT_HASH:::

Verify → Verify source machine, matched hive pair and account/RID mapping; validate destination rights separately.

If it fails → Mismatched/incomplete hives or denied backup operations require source repair. Local hashes do not automatically grant domain access. More detail ↓

If → then

An NT verifier from an appropriate credential source → Recover or reuse an NT password hash
Needs: Correct account/domain and actual NT hash; recovery mode or an accepting NTLM service with required destination rights
A password, actual NT hash, AES/NT long-term key or ticket is available → Select password, NT hash, key-to-ticket or ticket authentication
Needs: Credential type accepted by the chosen protocol/client, correct identity/domain, naming/time and destination authorization
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
Matched SECURITY/SYSTEM material is accessible → Extract LSA secrets and cached-domain verifiers
Needs: Appropriate host/read privilege and complete matching key/source files

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Extract local account hashes from matched SAM and SYSTEM

USE WHEN: Protected local registry material is available under sufficient host privilege
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: Local-account NT hashes with source-machine context

Recognize the clue

At a host context with justified protected-file access inspect current privileges and the source machine before selecting matched registry material.

hostname
whoami /priv

SYNTHETIC EXAMPLE OUTPUT

Host: TARGET_HOST
Relevant backup/read privilege: present
Needed pair: SAM plus matching SYSTEM

Means: Sufficient source access suggests local-account extraction, not domain-account extraction.

Confirm: Verify a supported backup/read operation, complete same-host hives and offline parser context.

After validation: The matched local pair is available and parses correctly: classify the returned local hashes.
Ruled out in this context: Only unrelated/mismatched hives are available: reject parsing them as a consistent pair.
Still inconclusive: A privilege name alone does not establish the artifacts can be obtained.

Troubleshooting: Mismatched/incomplete hives or denied backup operations require source repair. Local hashes do not automatically grant domain access.

Additional prerequisite checks

whoami /priv
reg save HKLM\SAM C:\Windows\Temp\SAM.save
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.save

Mimikatz alternative from a suitable elevated context:

Interpret a typical account row as:

The NT hash is local-account material. Its reuse depends on the same local password existing elsewhere, account state, remote UAC restrictions, service support and host authorization. Return it to the credential-classification workflow; do not call it a domain credential.

Why it works

SAM stores local account verifiers protected using key material derived from SYSTEM. These are local identities; a same-named domain account is a different principal.

Worked example · hypothetical

Observation: a backup-capable context obtains both hives. Test: parse the matched files offline. Illustrative output: a local administrator hash is recovered. Interpretation: test only justified local-account reuse with explicit target-local qualification.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗