SAMDUMP2(1)

💖 SAMDUMP2(1) 💖

okay bestie, welcome to samdump2(1) — it lives in the General Commands Manual section and it is literally the moment your Windows password hashes get exposed. no cap.

---

✨ NAME ✨

samdump2 — retrieves syskey and extract hashes from Windows 2k/NT/XP/Vista SAM.

like… it grabs the syskey and pulls the hashes out of a Windows SAM file. that's the whole vibe. 🦋

---

🌸 SYNOPSIS 🌸

samdump2 [OPTIONS] SYSTEM_FILE SAM_FILE

two files, bestie. the SYSTEM one and the SAM one. both. you can't skip either. 💅

---

🎀 DESCRIPTION 🎀

so samdump2 is designed to dump Windows 2k/NT/XP password hashes from a SAM file, using the syskey bootkey from the system hive. that's it, that's the whole plot. it's giving forensic icon behavior. 👑

the options are, and I cannot stress this enough, extremely cute and simple:

• -d — enable debugging. so when things get weird you get to see the weird. 🔍
• -h — display this help. the "hello?? help me" button. 🫶
• -o file — write output to file. so your results go into a file instead of just vibing in your terminal. ✨

---

🔥 EXAMPLE 🔥

here's the whole thing in action, no notes:

samdump2 -o out /mnt/ntfs/WINDOWS/system32/config/system
/mnt/ntfs/WINDOWS/system32/config/sam

see how -o out sends everything into a file called out, and then the two paths are the SYSTEM hive and the SAM hive? iconic. ate. periodt. 💖

---

👑 AUTHOR 👑

this manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others) and modified by Objectif Securite <info@objectif-securite.ch>.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL-2.

so yeah — GPL-2 or later, copy it, share it, remix it, the license said yes. 💜

---

🌈 SEE ALSO 🌈

• ophcrack(1) — go look at it, bestie, iykyk 🌸

---

and that's the whole page!! Version 3.0.0, April 2012, signing off — mwah, go dump responsibly 🎀💅✨