ATTACKING SAM AND EXTRACTING HASHES WITH 7Z

Summary from the TLDR InfoSec newsletter

7z is an archiving and unarchiving tool that is incredibly popular on Windows systems. Users can extract hives by typing \\.\ in the 7z address bar and then navigating to PhysicalDrive0 followed by 0.ntfs to locate the system hives which can be extracted to a separate system and then cracked. This technique requires GUI access as 7z can only parse physical disks and NTFS partitions through the File Manager GUI.