search

erwan2212 / NTHASH-FPC

33 stars 8 forks source link

/dumpsecret /input:secret /system error #2

Closed Papotito123 closed 4 years ago

Papotito123 commented 4 years ago

Hello: When I run /dumpsecret /input:secret /system in logged user I got this error;

C:\Users\TESTACCOUNT\Downloads\NTHASH-FPC\NTHASH-FPC-master\NTHASH-FPC-master\NTHASH>NTHASH-win64.exe /dumpsecret /input:secret /system NTHASH 1.8 x64 by erwan2212@gmail.com Impersonate:SYSTEM dumpsecret NOT OK, try adding /system dumpsecret NOT OK, try adding /system

Do I run it in wrong way ?

Thanks in advanced.

erwan2212 commented 4 years ago

try NTHASH-win64 /dmpsecret /input:dpapi_system /system.

with secret being any key under the regy key Security\Policy\secrets.

Papotito123 commented 4 years ago

Hello: Something like this ?

C:\Users\TESTACCOUNT\Downloads\NTHASH-FPC\NTHASH-FPC-master\NTHASH-FPC-master\NTHASH>NTHASH-win64.exe /dumpsecret /input:HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\L$_SQSA_S-1-5-21-337365419-192549521-2618175838-1004 /system NTHASH 1.8 x64 by erwan2212@gmail.com Impersonate:SYSTEM dumpsecret NOT OK, try adding /system dumpsecret NOT OK, try adding /system

Thanks for any info.

Papotito123 commented 4 years ago

Hello: No need to answer.I figure it .

Thanks.

erwan2212 commented 4 years ago

thanks :)

just sharing for others :

NTHASH-win64 /dumpsecret /input:dpapi_system /system

or

NTHASH-win64 /dumpsecret /input:dpapi_system /offline In this last case, you need security.sav in the same folder.

input parameter can be any key under registry key Security\Policy\secrets.