Windows stores the user credentials in an encrypted format in its SAM database. Once we have compromised our target system, we want to get hold of all the credentials on that system. As shown in the following screenshot, we can use the post/windows/gather/hashdump auxiliary module to dump the password hashes from the remote compromised system:
Once we have a dump of credentials, the next step is to crack them and retrieve clear text passwords. The Metasploit Framework has an auxiliary module auxiliary/analyze/jtr_crack_fast that triggers password cracker against the dumped hashes.
Upon completion, the ...
