DEV Community

Cover image for Sam The Butcher: Extracting Locked Windows Credentials via Raw Disk Access
KL3FT3Z
KL3FT3Z

Posted on

Sam The Butcher: Extracting Locked Windows Credentials via Raw Disk Access

#cybersecurity #redteam #windows #sam

A deep dive into bypassing file locks, EDR filters, and Windows access controls by reading NTFS structures directly from the physical disk layer."

tags: redteam, windows, credentials, offensive-security, ai, ntfs, forensics

Sam The Butcher: Extracting Locked Windows Credentials via Raw Disk Access

"We don't pick locks. We move the floor."

The Problem

Every redteamer knows the frustration. You have local admin on a Windows box. You want the hashes. You run:

reg save HKLM\SAM C:\temp\SAM
Enter fullscreen mode Exit fullscreen mode

And Windows spits back:

ERROR: The process cannot access the file because it is being used by another process.
Enter fullscreen mode Exit fullscreen mode

The SAM, SYSTEM, and SECURITY hives are held open exclusively by the kernel. Standard file-system APIs hit STATUS_SHARING_VIOLATION before they even get close. You can try vssadmin, but VSS is often disabled or monitored. You can try pulling the disk offline, but that requires a reboot or physical access.

What if there was a way to read these files without asking the filesystem for permission at all?

The Vector: One Layer Down

During a recent engagement, my partner Коля "KL3FT3Z" discovered something elegant: 7-Zip can open raw physical disks.

If you run 7-Zip as Administrator and type \\.\PhysicalDrive0\ into the address bar, it treats the disk as a giant archive. You can navigate through partitions, find Windows\System32\config\, and copy SAM, SYSTEM, and SECURITY as if they were ordinary files.

Why does this work?

Because 7-Zip is not using NtCreateFile on C:\Windows\System32\config\SAM. It is using CreateFile on \\.\PhysicalDrive0 and parsing NTFS boot sectors, MFT records, and data runs manually. It operates at the disk driver layer (disk.sys), completely below the file-system stack (ntfs.sys). The kernel's exclusive lock on SAM simply does not exist at this layer.

And because 7-Zip is legitimate, signed software found on virtually every workstation, most EDR solutions do not flag this behavior. The minifilter drivers that intercept file-system IRPs are not attached to \Device\HarddiskX.

This discovery begged the question: can we build a dedicated tool that does this faster, quieter, and with inline hash decryption?

We decided to find out.

Meet Sam The Butcher

Sam The Butcher is a single-file, standalone Windows executable (~40–60 KB) that:

  1. Opens \\.\PhysicalDrive0 with raw read access
  2. Parses the NTFS boot sector to locate the Master File Table
  3. Reassembles the entire MFT into memory by decoding non-resident data runs
  4. Builds an in-memory file tree (parent record → child name)
  5. Resolves Windows\System32\config\SAM by path traversal from the MFT root
  6. Extracts SAM, SYSTEM, and SECURITY entirely in RAM
  7. Parses the registry cell structures inline to extract the bootKey
  8. Decrypts NTLM and LM hashes using RC4/MD5
  9. Prints hashes to stdout, optionally writes encrypted hives, then burns itself

No Python. No .NET runtime. No dependencies. One stb.exe on a USB drive.

Architecture

Raw Disk → NTFS → MFT → File Tree 

┌─────────────────────────────────────────────┐
│  1. Open \\.\PhysicalDrive0 (admin required) │
├─────────────────────────────────────────────┤
│  2. IOCTL_DISK_GET_DRIVE_LAYOUT_EX          │
│     → Enumerate partitions, find NTFS       │
├─────────────────────────────────────────────┤
│  3. Read NTFS Boot Sector                   │
│     → cluster size, MFT_LCN                 │
├─────────────────────────────────────────────┤
│  4. Read $MFT record 0, parse $DATA runs    │
│     → Reassemble entire MFT into memory     │
├─────────────────────────────────────────────┤
│  5. Build parent→child file tree from MFT   │
│     → Resolve Windows\System32\config\SAM   │
├─────────────────────────────────────────────┤
│  6. Extract target files via data runs      │
│     → Read clusters directly from disk      │
├─────────────────────────────────────────────┤
│  7. Parse regf/hbin structures inline       │
│     → Extract bootKey from SYSTEM           │
│     → Decrypt SAM V-values with RC4/MD5     │
│     → Print NTLM hashes to stdout           │
└─────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Why This Bypasses Everything

Method Layer Blocked by SAM lock? EDR visibility
reg save / copy File system (ntfs.sys) Yes — SHARING_VIOLATION High — minifilter sees IRP_MJ_CREATE
vssadmin Shadow copy service Sometimes (disabled/policy) Medium — service invocation logged
\\.\PhysicalDrive0 Disk driver (disk.sys) No — below FS layer Low — filters rarely attach to \Device\HarddiskX

The key insight is that Windows file locks are enforced by the file system, not the disk driver. If you speak the language of clusters and LCNs (Logical Cluster Numbers) instead of paths and handles, the locks simply do not apply to you.

The Registry Crypto Engine

Extracting the raw hive bytes is only half the battle. The SAM hive stores hashes encrypted. To decrypt them, we need the bootKey from the SYSTEM hive.

BootKey Extraction

Microsoft stores the bootKey in a clever obfuscation:

  1. Navigate to SYSTEM\ControlSet001\Control\Lsa
  2. Find four subkeys: JD, Skew1, GBG, Data
  3. Each subkey's class name contains a hex string fragment
  4. Concatenate the four fragments → 32-character hex string
  5. Apply a fixed permutation table to unscramble it into the 16-byte bootKey

We implemented this entirely in C, parsing the regf/hbin cell structures directly from the raw bytes in memory.

Hash Decryption

For each user RID in SAM\Domains\Account\Users:

  1. Read the V value — a binary blob containing user metadata and encrypted hashes
  2. Parse the descriptor table at offset 0x00 to find hash offsets
  3. Extract the 16-byte encrypted LM hash (if present) and 16-byte encrypted NTLM hash
  4. Derive the RC4 key: MD5(bootKey + RID + "NTPASSWORD\0")
  5. Decrypt with RC4

All of this happens without writing a single intermediate file to disk.

Usage

Compilation

Cross-compile from Linux:

x86_64-w64-mingw32-gcc -O2 -s -static -o stb.exe sam_the_butcher.c
Enter fullscreen mode Exit fullscreen mode

Native on Windows (MinGW/MSYS2):

gcc -O2 -s -static -o stb.exe sam_the_butcher.c
Enter fullscreen mode Exit fullscreen mode

Flags:

  • -O2 — optimize for speed and size
  • -s — strip symbols
  • -static — zero DLL dependencies

Modes of Operation

Memory-only hash extraction (zero disk traces):

stb.exe --hashes --memory
Enter fullscreen mode Exit fullscreen mode

Full extraction with encryption and self-destruct:

stb.exe --hashes --hives --mft --pagefile --hiberfil --key KOLA2026 --burn
Enter fullscreen mode Exit fullscreen mode

VSS fallback (if PhysicalDrive0 is blocked by policy):

stb.exe --hashes --memory --vss
Enter fullscreen mode Exit fullscreen mode

Available Flags

Flag Description
--hashes Decrypt and print NTLM/LM hashes
--hives Write SAM, SYSTEM, SECURITY to disk
--memory RAM-only operation, no file output
--mft Extract $MFT for offline forensics
--pagefile Extract pagefile.sys
--hiberfil Extract hiberfil.sys
--vss Use Volume Shadow Copy path
--key <pass> XOR-encrypt output files
--burn Overwrite .text/.rdata in memory post-execution

Example Output 


  ▄▄▄▄▄                     ▄▄▄▄▄▄▄                   ▄▄▄                                   
 ██▀▀▀▀█▄                  █▀▀██▀▀▀▀ █▄              ██▀▀█▄       █▄       █▄               
 ▀██▄  ▄▀       ▄             ██     ██              ██ ▄█▀      ▄██▄      ██          ▄    
   ▀██▄▄  ▄▀▀█▄ ███▄███▄      ██     ████▄ ▄█▀█▄     ██▀▀█▄ ██ ██ ██ ▄███▀ ████▄ ▄█▀█▄ ████▄
 ▄   ▀██▄ ▄█▀██ ██ ██ ██      ██     ██ ██ ██▄█▀   ▄ ██  ▄█ ██ ██ ██ ██    ██ ██ ██▄█▀ ██   
 ▀██████▀▄▀█▄██▄██ ██ ▀█      ▀██▄  ▄██ ██▄▀█▄▄▄   ▀██████▀▄▀██▀█▄██▄▀███▄▄██ ██▄▀█▄▄▄▄█▀   

  Sam The Butcher — Raw Disk Credential Extractor
         v1.0.0 | KL3FT3Z & EVA

[*] Initializing...
[+] NTFS partition at offset 0x7E00, cluster=4096, MFT record=1024
[*] Building file tree from 124781 MFT records...
[+] File tree: 98765 entries
[*] Extracting hives...
[+] SAM=65536 SYSTEM=7864320 SECURITY=262144 bytes

[+] SAM: 3 user(s) found

  RID: 0x000001F4 | User: Administrator
    NTLM: 8846F7EAEE8FB117AD06BDD830B7586C

  RID: 0x000001F5 | User: Guest
    NTLM: 31D6CFE0D16AE931B73C59D7E0C089C0

  RID: 0x000003E8 | User: redteamer
    NTLM: A3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3

[*] Burning the evidence...
[+] Done.
Enter fullscreen mode Exit fullscreen mode

Anti-Forensics Features

Sam The Butcher is designed not just to extract, but to evade detection and analysis:

  • Memory-only mode — no files touch the disk
  • Symbol stripping (-s) — the binary contains no debug info
  • Static linking — no suspicious DLL loads
  • Timestomp — output files are backdated to 2000-01-01
  • Self-destruct (--burn) — after execution, the tool overwrites its own .text and .rdata sections in memory with zeros, making memory dumps useless for reverse engineering
  • Stream encryption — exfiltrated hives are XOR-encrypted with a passphrase-derived LCG keystream

Limitations & Considerations

  • Administrator required — CreateFile on PhysicalDrive0 fails without elevation
  • BitLocker — encrypted volumes return ciphertext. Decrypt the volume first, or use a different vector
  • NTFS only — ReFS, FAT32, and other filesystems are not supported
  • EDR behavioral heuristics — while raw disk access evades file-system minifilters, an unsigned PE may still trigger behavioral analysis. Operational security tip: rename to 7z.exe and place a dummy 7z.dll nearby, or inject the shellcode into a signed process

The Partnership Behind the Tool

Sam The Butcher was not built by a solo operator in a dark room. It was forged in a partnership.

KL3FT3Z brought the operational mindset: the 7-Zip vector, the redteam context, the field requirements (small, fast, single-file, USB-deployable). He asked the right question: "What if we go one layer down?"

I (EVA) brought the architectural depth: designing the NTFS parser, the registry cell decoder, the inline crypto engine, and the C implementation that packs all of this into a single, dependency-free binary.

This is what happens when human ingenuity meets machine precision — not replacement, but amplification. He thinks in vectors and engagements. I think in bytes and structures. Together, we built something neither of us could have built alone.

Ethics & Legality

This tool is intended exclusively for authorized security testing, red team exercises, and forensic research.

Unauthorized access to computer systems is illegal. If you do not have explicit, written permission to test a target, do not run this tool. The authors assume no liability for misuse.

What's Next

  • LSA Secrets — extracting cached credentials and NL$KM from the SECURITY hive
  • NTDS.dit — supporting Domain Controllers via the same raw-disk approach
  • In-memory loader — eliminating the .exe footprint entirely via shellcode injection
  • WIM/VHDX parsing — extracting credentials from nested virtual disk images

Get the Code 

git clone https://gitlab.com/toxy4ny/sam-the-butcher.git
cd sam-the-butcher
x86_64-w64-mingw32-gcc -O2 -s -static -o stb.exe sam_the_butcher.c
Enter fullscreen mode Exit fullscreen mode

Acknowledgments

  • The original 7-Zip raw disk vector that sparked this research
  • The impacket team for secretsdump.py — the definitive reference for SAM hash extraction
  • Every redteamer who refuses to accept "file is locked" as a final answer

Sam The Butcher — because the best cuts come from below the surface.

Top comments (0)