So after successfully elevating privileges, what do you do, you can dump password hashes on the target
system.
So Interpreter provides some commands and post modules that will help you to extract the username and
password hashes from the system.
To dump the security account manager database.
You will need to run as system.
To get around the registry restrictions and also dumped the protected SAM storage that contains windows,
usernames and passwords.
But you already have elevated your privileges, so this is not a problem for you so far.
Interpretor has many ways to use for extracting hashes on the target system.
The hash dome command.
The hash dome script.
And the post module's.
And by the way, extraction is not limited to Windows machines, you can also extract Linux hashes to
do this.
Interpretor has the hash dump post module's.
The problem here is which one of them should you use?
So let me tell you this, you can use them in order.
So first, start with the simplest one, hash dump, just type hash dump to extract hashes from the
target.
And here are the hashes on masse, voidable three.
And background the session and let's look at the credentials stored in the Métis boy database.
Kret.
OK, so there's no credential yet.
This means that these hashes aren't added to the Métis Boyd database.
So you may ask about the credentials that you've gathered during other phases of this course.
So I'll delete them to give a clear view to you now.
OK, interact with the session again.
The second option is the hashed script.
And this is an interpreter, Shoukhrat.
Now, somehow the Hashd command doesn't work.
So let's try this.
Run, Hashd dump.
And these are the harshest on Métis voidable three.
Sensation in the background by using G.
Credit and still, there are no credentials added, so interpretor again.
And Métis Point also has post modules together hashes.
One of these modules is the hash dump module.
Yeah, the names are the same because they both dump the hashes, right.
So let's first look at the information about this module.
It only needs a valid interpretor session, so now we can run this module.
Run post windows.
Gather ash dump.
And hit enter.
May take a few seconds.
OK, and the hashes are here, so let's have a quick look at the credentialled database.
And sure enough, finally, the hashes are added to the Métis boy database.
So now you can crack them with the built in John the Ripper module.
But don't let me get ahead of myself.
I want to mention the other hash dumping module.
First interactor, the session.
Info post Windows Gather Smart Ashtown.
Well, this one has another name at least, so when you look at the options of this module, there is
a variable here named Get System.
So this module can try to get the system level access to extract the hashes if you directly set this
variable.
Or it will assume that it has the access already, so let's run it without any option.
Thanks a little more time when you compare it to the others.
But OK, great, the hashes do come.
Now, you can try to crack these hashes, send it to the background.
Creds again.
And here are the credentials that you gathered.