how to HACK a password // Windows Edition

About this video

Presented as an ethical-hacking demo with permission on an employee’s unlocked Windows PC, the creator shows how a Windows password hash is obtained and cracked — answering, he says, the most common follow-up to his earlier password-cracking video. He explains that Windows does not store plaintext passwords but an MD4-based NTLM hash, verified at logon by re-hashing the attempt. With local admin access he exports the SAM and SYSTEM registry hives using reg save, copies them to a USB drive, and on Kali Linux uses Impacket’s secretsdump to extract the NTLM hashes locally. He then builds a targeted wordlist with CUPP, answering interactive questions about the victim’s name, partner, pet, company and interests, which generates 17,000 candidate passwords, and cracks the hash with Hashcat in NTLM mode 1000 — the targeted list succeeds. With the recovered password he logs in remotely via Evil-WinRM and xfreerdp/RDP, then demonstrates pass-the-hash: authenticating with the hash itself, using a capital-H option in Evil-WinRM and a pass-the-hash option in RDP, without knowing the plaintext at all. For defense he points to the MITRE ATT&CK entry for OS credential dumping via the Security Account Manager, with mitigations including restricting or disabling NTLM, password policies, user training and detection on registry access. He discloses that remote access in the demo required weakening the target — disabling the Windows firewall, enabling Remote Desktop and changing a restricted-admin registry setting — so Windows’ default posture is stronger than the demo suggests. A Dashlane sponsor segment promotes unique, complex passwords and claims a 50% discount with his code.

Key takeaways

• Brief physical/admin access is enough to copy the SAM and SYSTEM hives with reg save; secretsdump then extracts NTLM hashes offline, away from the target
• Targeted dictionary attacks work: a CUPP wordlist built from personal details generated 17,000 guesses and cracked the demo password with Hashcat mode 1000
• Cracking is optional — pass-the-hash lets an attacker authenticate to WinRM and RDP with the stolen hash alone
• Defenses cited via MITRE ATT&CK include restricting NTLM, strong/unique password policies, user training, and monitoring registry-hive access for detection
• The demo required disabling firewall/restricted-admin protections for remote access, a reminder to lock unattended machines and not over-trust a staged lab result

Episode details: published June 30, 2023 · 12:22 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: you NEED to learn Windows RIGHT NOW!! · Next: intro to cloud hacking (leaky buckets) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube