passwords and RAM

Greetings,
Throwing this out to the informed masses... What is the best way to recover passwords, logins, etc from machines where these items are not saved to the computer like the registry - but merely typed in and the person "hits enter.". I am guessing they are in RAM, but things like dd_img does not capture them (using a windows forensics toolkit approach). Based on the scenario, keyloggers are not an option because the deed is done by the time I find out about it - but I do have access to any machine immediately after the events (corporate environment). Much appreciated...

I made a batch file that does this for me on Windows 9X.

copy C:\WINDOWS\*.pwl a:

I popped that into a batch file on a floppy disk. Works great. this should give you at least a start.

Gore... that was the most retarded answer you have ever given.


SASJohnson, you're not trying to get local logins? You are talking more like websites and whatnnot? Something where the hash is not stored locally?

I second Synja with regard to Gore's comment.... *sigh*

You may find the passwords or thier hashes in the page file. You may also find them in the browser history as part of the url sent after the password has been entered. Hell, they may have even said "remember me" and you _might_ find them stored in cookies...

My question is though... Why do you need their password... If they went to hotmail to check thier personal email and that is against policy then you already have them by the short and curlies... There's no reason to see if they received any new email... Pummel them on the policy breach...

Lol What, it said passwords in RAM... Lol. Damn no one appreciates a good one anymore.

"Based on the scenario, keyloggers are not an option because the deed is done by the time I find out about it - but I do have access to any machine immediately after the events (corporate environment)."

This sentence is not making sense to me. You can't use a keylogger "because the deed is done by the time I find out about it...," but then you go on to say, "but I do have access to any machine immediately after the events...." If you need to stop some illicit deed beforehand, how is any method someone could give you going to help you afterward?

Sounds like you are maybe trying to get sonmeones "network" logon password?

Preacher:

Policy doesn't allow him to put keyloggers on his boxes but, through whatever means, he may discover activity that requires him to investigate it... Hence the after the fact investigation...

Quote:

---

Originally posted here by Nokia
Sounds like you are maybe trying to get sonmeones "network" logon password?

---

That's why I toyed with him. But that got ruined by the no sense of humor duo.

Quote:

---

That's why I toyed with him. But that got ruined by the no sense of humor duo.

---

I have a sense of humor. I just usually prefer jokes involving flatulence or boobies.

I'm with Synja on the boobies.... I have my own problems with the flatulence so it has lost it's "glow" for me... Old age sux... ;)

Hitler had a flatulence problem. Maybe that's why Tiger is like that.... ;)

By the way when did you want to grab those things off my server? I can copy them over like now if you want.

Not from here... Fractional T1... PM me their loc and I'll grab the comedy stuff tonight.

I don't have a domain so it's just going to be my IP. I'm just going to whack the Slackware anon FTP server into the DMZ so you can grab them and then take it out after you've finished. So when you get home send me a PM to let me know and I'll give you the info. Or I can just give you an account if you'd like. Either way is fine with me, just shoot a PM this way when you get home.

Real time password alerting *can* be done with keyloggers and other monitoring technologies. My question is why is the timing important? I mean, unless you are physically standing over the user, the jig is up if you apply your logic to the issue.

Tiger is on the right track here. Policy wins every time when you play corporate paper rock scissors. I would use a content filter or something of the like to enforce policy. This way, the deed won't be done, you have an audit trail and you also have a way to map the policy violation. Game, set, match.

Here is my problem in more detail. IT runs their world here - forensics backs the company up and provides the hammer for discipline. Sometimes we both play together-sometimes we don't. My instructions are to capture any passwords / logins to web pages that may be inappropriate. (no one saves it to p. storage) They want this acquired from the person's desk PC. If Flatulence Frank hits myspace.com and tries to hook up with a 14 year old --- admin wants his web page login / password recovered from the PC "at his desk". I thought it would be in RAM, but I defer this thought in light of a better solution. thanks.

Sooo - why cant you use a keylogger? As long as you put a disclamer informing the user that his actions will be logged - and you have the WS admins/owners permission - it is perfectly legal to install a keylogger.

Now without a disclamer, logging on to his WS and recovering his password - is very much illegal and I highly doubt that if you are working in a company that is big enough to have a IT Forensics dept that anyone would ask you to do this - and if they did, I'm pretty sure they would ask someone who knows how to do it in the first place.

However - the logon page to myspace is not a secure one........in-other-words the data will be sent in clear over the network.......voilla!

But, if the admins doesnt want users to go to myspace - why dont they just restrict access to it?

//me thinks there is more to your question than meets the eye.........

Webpage logons are not really stored in RAM per se... It is just a small buffer that gets sent upstream to the site...


Now, cookies will be stored... but only encrypted so to speak...


If I am understanding you right... you will need to run remote administration software on the clients for on the fly access. Any cookie you get is going to be encrypted, and any separate keylogger you install is going to require you to either have the keylog in a network accessable location, or require you to physically go to the machine and download it, once again, after the fact.

THe biggest dilemma you are going to face is getting around SSL, you will have to capture the logon information before it is sent upstream. This means you need some sort of keylogger, once again, preferably as part of a remote administration package. You might even be able to configure something to alert you when certain DNS requests are made, depending on network configuration and the tools you have available.

Remember, your best option is prevention. Wouldn't it be better not to have employees trying to sex0r 14 year old girls during work hours? Isn't that more of a home thing?