---
id: 4588
title: "Quarks PwDump"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/quarks-pwdump.html"
published_at: "2012-05-13T22:00:00Z"
tags: ["windows", "ntlm", "tooling", "pentest", "password-dumping", "bitlocker"]
phying_url: "https://phying.com/item/4588"
lang: en
---

# Quarks PwDump

## Summary

Quarks PwDump: a Win32 tool dumping local and domain NT/LM hashes, cached domain credentials and NTDS.dit's BitLocker recovery data via JET/ESE APIs to avoid libesedb crashes; admin rights needed.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2012-05-13T22:00:00Z
- **Original:** https://blog.quarkslab.com/quarks-pwdump.html
- **Phying News:** https://phying.com/item/4588