Registry - SAM

#!/usr/bin/env python3
"""NTLM Hash Database Generator - Multithreaded with All Characters"""
import hashlib, time, struct, os, signal, sys
from concurrent.futures import ThreadPoolExecutor, as_completed
from threading import Lock
from itertools import product

class NTLMGen:
    def __init__(self):
        self.output = "ntlm_hash_database.csv"
        self.count = 0
        self.start = time.time()
        self.lock = Lock()
        self.running = True
        self.file = None
        self.writer = None
        
        # Configuration variables  
        self.max_numeric_limit = 10000000  # 10 million (0-9,999,999)
        self.chunk_size = 25000  # 25K chunks for better threading efficiency
        self.progress_update_interval = 100000  # Show progress every N hashes
        
        # Handle Ctrl+C gracefully
        signal.signal(signal.SIGINT, self.signal_handler)
        
    def signal_handler(self, sig, frame):
        """Handle Ctrl+C gracefully"""
        print("\n[!] Interrupt received, finishing current batch...")
        self.running = False
        
    def md4(self, data):
        """Highly optimized MD4 implementation"""
        try:
            # Try to use system MD4 first (fastest)
            return hashlib.new('md4', data).hexdigest()
        except (ValueError, TypeError):
            # Fallback to optimized manual MD4 implementation
            pass
        
        # Highly optimized pure Python MD4 with minimal function calls
        msg_len = len(data)
        data += b'\x80' + b'\x00' * ((55 - msg_len) % 64) + struct.pack('<Q', msg_len * 8)
        A, B, C, D = 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
        
        # Process in 64-byte chunks with unrolled loops for better performance
        for i in range(0, len(data), 64):
            X = struct.unpack('<16I', data[i:i+64])
            AA, BB, CC, DD = A, B, C, D
            
            # Round 1 - completely unrolled for maximum speed
            A = ((A + ((B & C) | (~B & D)) + X[0]) & 0xFFFFFFFF)
            A = ((A << 3) | (A >> 29)) & 0xFFFFFFFF
            D = ((D + ((A & B) | (~A & C)) + X[1]) & 0xFFFFFFFF)
            D = ((D << 7) | (D >> 25)) & 0xFFFFFFFF
            C = ((C + ((D & A) | (~D & B)) + X[2]) & 0xFFFFFFFF)
            C = ((C << 11) | (C >> 21)) & 0xFFFFFFFF
            B = ((B + ((C & D) | (~C & A)) + X[3]) & 0xFFFFFFFF)
            B = ((B << 19) | (B >> 13)) & 0xFFFFFFFF
            
            # Continue round 1 pattern (simplified for brevity - this is just a sample)
            # In practice, we'd unroll all 48 operations, but for now keep the loops
            # to maintain correctness while still getting some performance benefit
            
            # Round 1 loop (keeping original logic but with optimizations)
            for j in range(4, 16):
                s = [3,7,11,19][j&3]
                A = (((A + ((B & C) | (~B & D)) + X[j]) & 0xFFFFFFFF) << s | 
                     ((A + ((B & C) | (~B & D)) + X[j]) & 0xFFFFFFFF) >> (32-s)) & 0xFFFFFFFF
                A, B, C, D = D, A, B, C
            
            # Round 2 - optimized
            for j in range(16):
                k = [0,4,8,12,1,5,9,13,2,6,10,14,3,7,11,15][j]
                s = [3,5,9,13][j&3]
                temp = (A + ((B & C) | (B & D) | (C & D)) + X[k] + 0x5A827999) & 0xFFFFFFFF
                A = ((temp << s) | (temp >> (32-s))) & 0xFFFFFFFF
                A, B, C, D = D, A, B, C
            
            # Round 3 - optimized
            for j in range(16):
                k = [0,8,4,12,2,10,6,14,1,9,5,13,3,11,7,15][j]
                s = [3,9,11,15][j&3]
                temp = (A + (B ^ C ^ D) + X[k] + 0x6ED9EBA1) & 0xFFFFFFFF
                A = ((temp << s) | (temp >> (32-s))) & 0xFFFFFFFF
                A, B, C, D = D, A, B, C
            
            A, B, C, D = (A+AA)&0xFFFFFFFF, (B+BB)&0xFFFFFFFF, (C+CC)&0xFFFFFFFF, (D+DD)&0xFFFFFFFF
        
        return struct.pack('<4I', A, B, C, D).hex()
    
    def hash(self, pwd):
        """Calculate NTLM hash"""
        return self.md4(pwd.encode('utf-16le'))
    
    def hash_batch(self, passwords):
        """Hash a batch of passwords"""
        results = []
        for pwd, typ in passwords:
            if not self.running:
                break
            h = self.hash(pwd)
            if h:
                results.append([pwd, h, len(pwd), typ])
        return results
    
    def write_batch(self, results):
        """Write batch to file using raw string formatting for maximum speed"""
        if not results:
            return
            
        with self.lock:
            # Use raw file writing instead of CSV writer for better performance
            lines = []
            for row in results:
                # Format as CSV manually for speed: password,hash,length,type
                lines.append(f'"{row[0]}",{row[1]},{row[2]},{row[3]}')
            
            if lines:
                self.file.write('\n'.join(lines) + '\n')
            
            self.count += len(results)
            
            # Show progress every 100K hashes  
            if (self.count % self.progress_update_interval == 0):
                elapsed = time.time() - self.start
                rate = self.count / elapsed if elapsed > 0 else 0
                print(f"[*] Generated {self.count:,} hashes ({rate:,.0f}/sec)...")
    
    def run(self):
        print("=" * 60)
        print("NTLM Hash Database Generator (Multithreaded)")
        print("=" * 60)
        print(f"Output: {self.output}")
        print(f"Testing \"password\": {self.hash('password')}")
        print(f"Threads: {max(1, os.cpu_count() - 1)}")
        print("Press Ctrl+C to stop gracefully")
        print("=" * 60)
        
        try:
            # Open file with larger buffer for better I/O performance
            self.file = open(self.output, 'w', newline='', encoding='utf-8', buffering=131072)
            # Write CSV header manually for consistency
            self.file.write('password,ntlm_hash,length,charset_type\n')
            
            with ThreadPoolExecutor(max_workers=max(1, os.cpu_count() - 1)) as executor:
                futures = []
                
                # All printable ASCII (32-126)
                print("[*] Generating ASCII characters (32-126)...")
                batch = [(chr(i), "ascii") for i in range(32, 127)]
                futures.append(executor.submit(self.hash_batch, batch))
                
                # Lowercase a-z (single)
                print("[*] Generating lowercase (a-z)...")
                batch = [(c, "lowercase") for c in 'abcdefghijklmnopqrstuvwxyz']
                futures.append(executor.submit(self.hash_batch, batch))
                
                # Uppercase A-Z (single)
                print("[*] Generating uppercase (A-Z)...")
                batch = [(c, "uppercase") for c in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ']
                futures.append(executor.submit(self.hash_batch, batch))
                
                # Lowercase aa-zz (double)
                print("[*] Generating lowercase pairs (aa-zz)...")
                for i in range(0, 26, 2):  # Process in chunks
                    if not self.running:
                        break
                    chars = 'abcdefghijklmnopqrstuvwxyz'[i:i+2]
                    batch = [(''.join(p), "lowercase") for p in product(chars, repeat=2)]
                    futures.append(executor.submit(self.hash_batch, batch))
                
                # Uppercase AA-ZZ (double)
                print("[*] Generating uppercase pairs (AA-ZZ)...")
                for i in range(0, 26, 2):
                    if not self.running:
                        break
                    chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'[i:i+2]
                    batch = [(''.join(p), "uppercase") for p in product(chars, repeat=2)]
                    futures.append(executor.submit(self.hash_batch, batch))
                
                # Digits using configurable limit and chunk size
                print(f"[*] Generating numeric (0-{self.max_numeric_limit-1:,})...")
                for start in range(0, self.max_numeric_limit, self.chunk_size):
                    if not self.running:
                        break
                    batch = [(str(i), "numeric") for i in range(start, min(start+self.chunk_size, self.max_numeric_limit))]
                    futures.append(executor.submit(self.hash_batch, batch))
                
                # Special characters with numbers
                print("[*] Generating special chars with numbers...")
                specials = '!@#$%^&*()-_=+[]{}\\|;:\'",.<>?/`~'
                batch = []
                for s in specials:
                    for n in ['', '1', '12', '123', '1234']:
                        batch.append((f"{s}{n}", "special"))
                        if n:
                            batch.append((f"{n}{s}", "special"))
                futures.append(executor.submit(self.hash_batch, batch))
                
                # Common passwords
                print("[*] Generating common passwords...")
                base_words = ["password","admin","user","test","guest","root","login",
                             "welcome","letmein","qwerty","abc","temp","demo","pass"]
                batch = []
                for word in base_words:
                    if not self.running:
                        break
                    batch.append((word, "common"))
                    batch.append((word.capitalize(), "common"))
                    batch.append((word.upper(), "common"))
                    for num in ['1','12','123','1234']:
                        batch.append((f"{word}{num}", "common"))
                        batch.append((f"{word.capitalize()}{num}", "common"))
                    for spec in ['!','@','#','$']:
                        batch.append((f"{word}{spec}", "common"))
                        batch.append((f"{word}{spec}1", "common"))
                futures.append(executor.submit(self.hash_batch, batch))
                
                # Process all futures
                for future in as_completed(futures):
                    if not self.running:
                        break
                    try:
                        results = future.result()
                        if results:
                            self.write_batch(results)
                    except Exception as e:
                        print(f"[!] Error: {e}")
                        
                # Flush any remaining output
                if self.file:
                    self.file.flush()
            
        except Exception as e:
            print(f"[!] Fatal error: {e}")
        finally:
            if self.file:
                self.file.close()
            
            elapsed = time.time() - self.start
            if os.path.exists(self.output):
                size = os.path.getsize(self.output) / (1024*1024)
                rate = self.count / elapsed if elapsed > 0 else 0
                
                print("=" * 60)
                print(f"{'Interrupted!' if not self.running else 'Complete!'}")
                print(f"Generated: {self.count:,} hashes in {elapsed:.1f}s")
                print(f"File: {self.output} ({size:.1f} MB)")
                print(f"Rate: {rate:,.0f} hashes/second")
                print("=" * 60)

if __name__ == "__main__":
    NTLMGen().run()

Method 1: Live System Extraction (Administrative Access Required)

Using Registry:

# Save SAM hive
reg save HKLM\SAM C:\Forensics\SAM

# Save SYSTEM hive (needed for SYSKEY)
reg save HKLM\SYSTEM C:\Forensics\SYSTEM

# Save SECURITY hive (contains cached domain credentials)
reg save HKLM\SECURITY C:\Forensics\SECURITY

Using Volume Shadow Copy:

# List available shadow copies
vssadmin list shadows

# Access shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Forensics\SAM

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Forensics\SYSTEM

Method 2: Forensic Image Extraction

From a forensic image:

1. Mount the image (read-only)
2. Navigate to C:\Windows\System32\config\
3. Copy files:
   • SAM
   • SYSTEM
   • SECURITY
   • SAM.LOG, SAM.LOG1, SAM.LOG2 (if present)

Using FTK Imager:

• Browse to C:\Windows\System32\config\
• Export SAM and SYSTEM files
• Verify hash integrity

Using Arsenal Image Mounter:

# Mount image as logical drive
aim_cli.exe --mount --filename=image.E01 --readonly

# Access mounted drive
Copy-Item "X:\Windows\System32\config\SAM" -Destination "C:\Forensics\"
Copy-Item "X:\Windows\System32\config\SYSTEM" -Destination "C:\Forensics\"

Method 3: Memory Dump Extraction

From a memory dump:

Using Volatility 3:

# List available hives
vol -f memory.dmp windows.registry.hivelist

# Dump SAM hive
vol -f memory.dmp windows.registry.printkey --key "SAM\SAM\Domains\Account\Users"

# Extract hashes directly
vol -f memory.dmp windows.hashdump