How To Install bkhive on Fedora 34

bkhive is Dump the syskey bootkey from a Windows system hive

Introduction

In this tutorial we learn how to install bkhive on Fedora 34.

What is `bkhive`

This tool is designed to recover the syskey bootkey from a Windows NT/2K/XP system hive. Then we can decrypt the SAM file with the syskey and dump password hashes. Syskey is a Windows feature that adds an additional encryption layer to the password hashes stored in the SAM database.

We can use yum or dnf to install bkhive on Fedora 34. In this tutorial we discuss both methods but you only need to choose one of method to install bkhive.

Install bkhive on Fedora 34 Using dnf

Update yum database with dnf using the following command.

sudo dnf makecache --refresh

The output should look something like this:

Fedora 34 - x86_64                               20 kB/s | 6.6 kB     00:00
Fedora 34 openh264 (From Cisco) - x86_64        1.4 kB/s | 989  B     00:00
Fedora Modular 34 - x86_64                       68 kB/s | 6.5 kB     00:00
Fedora 34 - x86_64 - Updates                    3.5 kB/s | 6.2 kB     00:01
Fedora Modular 34 - x86_64 - Updates             17 kB/s | 5.9 kB     00:00
Metadata cache created.

After updating yum database, We can install bkhive using dnf by running the following command:

sudo dnf -y install bkhive

Install bkhive on Fedora 34 Using yum

Update yum database with yum using the following command.

sudo yum makecache --refresh

The output should look something like this:

Fedora 34 - x86_64                               20 kB/s | 6.6 kB     00:00
Fedora 34 openh264 (From Cisco) - x86_64        1.4 kB/s | 989  B     00:00
Fedora Modular 34 - x86_64                       68 kB/s | 6.5 kB     00:00
Fedora 34 - x86_64 - Updates                    3.5 kB/s | 6.2 kB     00:01
Fedora Modular 34 - x86_64 - Updates             17 kB/s | 5.9 kB     00:00
Metadata cache created.

After updating yum database, We can install bkhive using yum by running the following command:

sudo yum -y install bkhive

How To Uninstall bkhive on Fedora 34

To uninstall only the bkhive package we can use the following command:

sudo dnf remove bkhive

bkhive Package Contents on Fedora 34

/usr/bin/bkhive
/usr/lib/.build-id
/usr/lib/.build-id/35
/usr/lib/.build-id/35/a7431e0201562bd43b26f4848f9b7e2711aecc
/usr/share/doc/bkhive
/usr/share/doc/bkhive/AUTHORS
/usr/share/doc/bkhive/COPYING
/usr/share/doc/bkhive/README
/usr/share/man/man1/bkhive.1.gz

References

bkhive website

Summary

In this tutorial we learn how to install bkhive on Fedora 34 using yum and dnf.