Recovering user passwords

Instant messengers are not the only location where we can search for passwords. We can find them in a cache, in the memory of text editors, buffers, command lines, or even some specific system processes. Volatility has several plugins to collect information about credentials:

• hashdump
• lsadump
• cachedump

Let's check them out, one by one.

Hashdump

The hashdump plugin can be used to dump hashes of local user passwords on Windows systems before Windows 8. The command will look like this:

Figure 4.26 – Volatility hashdump

In the output, you can see the account name, followed by the relative identifier and the LM and NT hashes. Notice that we have the same hashes for Administrator and Guest users. These specific hashes indicate blank passwords.

Another way to dump credentials is to use the cachedump plugin.

Cachedump

This plugin can be used to dump hashes of cached domain user passwords. By...