Impacket samedit.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Changes a user’s password hash directly in a local SAM hive, using a SYSTEM hive or a supplied boot key.
| Item | Details |
|---|---|
| Implementation | examples/samedit.py |
| Category | Secrets / DPAPI / registry / file analysis |
| Size | 121 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/samedit.py -h for the current option definitions.
| Argument | Description |
|---|---|
user | User account whose password is to be replaced |
sam | SAM hive file to edit |
-password | New password to set |
-hashes | Replace the NTLM hash directly (the LM hash is optional) |
-system | SYSTEM hive containing the boot key for password encryption |
-bootkey | Boot key used to encrypt and decrypt SAM passwords |
-debug | Enable debug output |
-ts | Add a timestamp to each log message |
Detailed processing flow
Section titled “Detailed processing flow”The tool opens the SAM hive and obtains the boot key from the SYSTEM hive or a supplied value. LocalOperations resolves the boot key, and SAMHashes finds the user record and RID. It encrypts the password or LM:NT hash in the account-specific format and updates the hive cell.
How it works
Section titled “How it works”Password fields in SAM user records are neither plaintext nor simple NT hashes. They are protected through layers using the boot key, SAM domain key, and user RID. This command opens the local SAM hive and either the SYSTEM hive or an explicit boot key, checks the existing record’s encryption format and version, and writes the new hash in the same format.
For password input, it calculates the LM and NT one-way functions. For hash input, it uses the supplied value directly as the account hash. It then encrypts the record fields with RID-derived and SAM keys. The handling of disabled LM hashes and history or length fields must match the record layout for the Windows version.
Because this is an in-place edit, do not update the file before parsing succeeds and the record size is known. Check that the target user is unique, the SAM and SYSTEM hives match, backups exist, and the file parses again after writing. The writer is not transactional, so minimize the update range to avoid corrupting the hive on a partial write failure.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
| module-level entry | 1 | Parses arguments and runs at the top level |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | ntlm, version |
impacket.examples | logger |
impacket.examples.secretsdump | LocalOperations, SAMHashes |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- Some operations change the target’s state. Check the target name, SID, and path before making changes.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- Distinguish a missing input file, a damaged file, an incomplete read, and an unsupported format.
When changing the implementation
Section titled “When changing the implementation”The code depends on examples.secretsdump.LocalOperations, SAMHashes, and impacket.ntlm. This is a destructive local file update, so focus tests on record size, hash-disabling rules, and partial writes on exceptions.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/samedit.py - CLI:
python examples/samedit.py -h - No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.