babilonics.com

Esta es una de esas utilidades que siempre deberías llevar encima

Recovering Windows Password Cache Entries
Summary

=======

Users authenticate themselves on a Domain Controller (DC) using NTLM/NTLMv2.

However the DC sometimes goes offline or the network cable is unplugged; in

this situation, the Local Security Authority System Service (LSASS) uses

password cache entries from the registry to perform offline logon.

This whitepaper explains the technical issues underneath Windows password

cache entries, which are undocumented by Microsoft. This paper aims at:

• Helping pentesters or security bso retrieving the password cache entries
  (hash value) for auditing purposes;
• Providing more compatibility for programs that may require access to
  these entries without using the LSA API.