Printable View
Ive been trying to do some security checks on my own computers, and i feel like a complete idiot here coming from using linux to asking about windows.. but..
im trying to view whats in my .pwl file to see how secure it is. I know it could just be renamed, but thats a different problem. I tried viewing it in notepad but its encrypted. is there a program i could use? id like to secure this computer a little better.. even for windows.
Thanks for the help.
~DreamWeaver~
Okay, here's the skinny on .pwl files in Windows 9x. You CAN cause them NOT to be created through some registry keys (more on that if you want). They appear in c:\windows\ as the username (first 8 characters) and with a PWL extension. They are encrypted with your windows-logon password, (Novell network passwords work in this effect, as do simple user-profile passwords, which give you custom desktops and wallpapers, etc.)
The encryption method is VERY insecure, comparatively. If your windows logon password isn't humungous, I suggest either disabling pwl caching, or running a batch file to delete them each startup.
Now, to the cracking! I would suggest trying Cain (search from google), with later versions called Cain and Abel. Abel is a trojan that can be placed on a computer to collect pwl passwords, so be prepared for some virus alerts. Cain can run brute-force or dictionary attacks against a pwl file, but you have to supply the username. If the username is over 8 characters or contains invalid DOS-filename characters, you'll have to do some educated guessing.
I have Cain + Abel, but whenever i start the attack on the .pwl from cain, itll tell me how long the password is (5 chars) but it wont tell me what it is.. :Confused:
~DW~
previously id used cain 2.0 cain 1.0 seems to work much better. Just thought youd like to know. I obtained it from packetstorm i believe.
Thanks,
~DW~
Quote:
Originally posted by Terr
Okay, here's the skinny on .pwl files in Windows 9x. You CAN cause them NOT to be created through some registry keys (more on that if you want). *****yes Terr MORE*****;)
The encryption method is VERY insecure, comparatively. If your windows logon password isn't humungous, I suggest either disabling pwl caching, or running a batch file to delete them each startup.
The encryption method is VERY VERY insecure. There is a proggie called revelation by snadboy...it is able to decode the .pwl for the screensaver on win98. You can study the the de-encryption method he uses...He will even give you the source code.
Uhm... my understanding had been that Revelation uses a call in windows which only works if you are ALREADY LOGGED IN. In other words, someone had to put the windows logon password in correctly already. It won't work if you have a .pwl file itself, and are not already in a session on the computer.Quote:
Originally posted by antihaxor
The encryption method is VERY VERY insecure. There is a proggie called revelation by snadboy...it is able to decode the .pwl for the screensaver on win98. You can study the the de-encryption method he uses...He will even give you the source code.
In other words, it decrypts the CONTENTS of the pwl file, but only if you are already logged in, and it doesn't give you the actual logon password.
Maybe I'm wrong, but whatever.
EDIT:Oops! I got Revelation mixed up with another program, but I think Revelation still only works if you are already logged in. (Revelation is different from what I just described, but same limitations, will elaborate if necessary.)
I'm not sure if this will help you but you do not even have to view the .pwl files to bypass the login. When you boot your pc boot to DOS. Now all you have to do is find the pwl file you want and rename the extension to .zzz* Hope that helped.
hey Terr, could you tell some more about the registry and PWL files thing ??
Here's a way to hack .pwl password in Win 9x... Just try to get Cain and Abel password cracker but you must supply a username inorder to crack the password... Another way is to find the .pwl pass and delete it then reboot the computer and the computer will ask you to supply again a new pass...
Uhm... my understanding had been that Revelation uses a call in windows which only works if you are ALREADY LOGGED IN. In other words, someone had to put the windows logon password in correctly already. It won't work if you have a .pwl file itself, and are not already in a session on the computer. <---I agree with terr on this
Very Good Terr But I Just Wondered If You Could Please Teach Me How To Delete These Password Files From The Registary So My User Passwords Cannot Be Ripped With Programmes Like Cane Can You Tell Me How To Do This In Windows 98 And Windows XP Please Thanx Scott
Quote:
Originally posted by DreamWeaver
I have Cain + Abel, but whenever i start the attack on the .pwl from cain, itll tell me how long the password is (5 chars) but it wont tell me what it is.. :Confused:
~DW~
Ok DW...here's the deal. It will (the first few minutes) tell you how long the password is. Then (almost just like the movies) ...it begins to (slowly) crack the password... like if the password is: password. This is what Cain will show (Obviously in the GUI)
- 8 Characters long
- passwora <-- incorrect
- passworb <-- incorrect
- passworc <-- incorrect
- password <-- correct
When it finally gets the right combination it will prompt you and tell you that it has found the password. This can vary in time depending on the amount of RAM you have installed - and the program itself. Small RAM and old version equal long time to wait. Ante-up the both of them and you've got yourself a winning PW by the end of the day. :)
Well, in order to get rid of PWL files, you can either have a batch file run at every startup, or you can disable the caching through the registry...
But remember! If you do this then you won't be able to save passwords for your ISP or for some Internet Explorer features! You'll have to remember them and enter them each time.
Check out This page for information on disabling the caching in 98/95. (You need your OS disk.)
As for XP, I don't use it. I doubt it uses the same system.
Quote:
Originally posted by [WebCarnage]
Ok DW...here's the deal. It will (the first few minutes) tell you how long the password is. Then (almost just like the movies) ...it begins to (slowly) crack the password... like if the password is: password. This is what Cain will show (Obviously in the GUI)
- 8 Characters long
- passwora <-- incorrect
- passworb <-- incorrect
- passworc <-- incorrect
- password <-- correct
When it finally gets the right combination it will prompt you and tell you that it has found the password. This can vary in time depending on the amount of RAM you have installed - and the program itself. Small RAM and old version equal long time to wait. Ante-up the both of them and you've got yourself a winning PW by the end of the day. :)
Hmph. I guess that makes sense =) The old version, instead of telling you the number of characters its trying, it tells you "Brute force attack" or "Dictionary attack" so atleast you know whats going on. I like that better than somethin stuck at "5 chars" which usually slowly increments to 8 chars.
Maybe im just anal.
Thanks for the help all,
~DW~
Yet, notice how I said in it's own GUI (Graphical User Interface). So it's not going to show you every password it's going to try at the moment, on the spot. As I recal (back in the "9x day's...*), I don't think it even shows you any passwords. Although (I think) it gives you a 'dictionary'. Yet just let it run...if it tells you it's gotten the number of characters just leave it be. It could find out it was wrong and add/subtract a few later on. Just set it and leave it in the bg(background). :)Quote:
Hmph. I guess that makes sense =) The old version, instead of telling you the number of characters its trying, it tells you "Brute force attack" or "Dictionary attack" so atleast you know whats going on. I like that better than somethin stuck at "5 chars" which usually slowly increments to 8 chars.
Maybe im just anal.
Good luck.
you might be interested in this
Program Archive Name:
accmen.zip
Program Name/Title:
Access Manager for Windows
Program Version:
2.4
Program Release Date:
June 8, 2001
Program Description:
Protect your privacy and control access to your PC
Target OS:
Windows 95/98/ME
Software type:
Shareware ($25, Discounts)
Program home page:
http://www.softstack.com/accmen.html
Author information
-------------------
Author:
Kirill Vasilev
Contact WWW URL:
http://www.softstack.com
Description
-----------
Access Manager for Windows allows you to restrict access to key features of
Windows, such as Control Panel, Start Menu, Network, Taskbar, Desktop, System
Tray, Network Access Control Page. It also enables to control Internet usage,
disable the Ctrl+alt+delete keys and the function keys at startup, allows to
password protect Windows and restrict users to running specific applications
only, forbid Internet Access, view statistics of computer use by your kids or
employees and loads more. This program can lock your PC and ask for a password
when Windows loads. Access Manager for Windows is just the thing for keeping
employees , students or children from coming in and fiddling around with the
computers. It has all the needed features to keep people from viewing or
changing what you do not want them too. Every network administrator should get
this nice security program!
Your post got me to thinking about win95/98 passwrds. So, I did a search on packetstormsecurity site and came up with this (querry "passwords"):
"ShowPass 1.0"
ShowPass 1.0 - like dripper - dial up password ripper for Windows. With this program you can find every password in a machine! "*" shadowed passwords, dialup passwords and cached passwords are on your hire. It's like a combination of Dripper, Revolution and Pwlview. Program supports both English and Turkish. Homepagehere. By Misoskian
I downloaded, I then ran norton on it and it found this:
PWsteal.trojan
Ha! Hmmm..was it infected to steal and send...or is this how it opens the pwl files and shows them to me??? Well, Im leaving it alone..I don't want to find out!