Printable View
Hi ppl
I have posted the same query in another thread but I am not getting any positive replies.
I have got the SAM file of my windows 2000 nt system, I wanna know what it contains, which means to say I want all the passwords it contains.
How 2 do it?
lemme know plz
not going to get much better ones in this one either.Quote:
I have posted the same query in another thread but I am not getting any positive replies.
very carefully....Quote:
How 2 do it?
tell you what... I'll sell you the ultimate hacker CD for a small sum of US$50.
trust me. It'll be worth it. It'll have all those 1337 proggies and everything!
thanx phishphreek80
u are a real help.
I try my best! Really... I do! :D
I posted a step-by-step for you in the other thread, but when you posted this one it activated the vbscript self destruct sequence in my post! You can look at what's left, if you'd like!
That Sam guy sounds familar.
ok if you want all the passwords in YOUR sam file:
log in as admin,
download the program pwdump2 and run it. now you'll have all the password hashes....
Now, the question is: How do I get Admin pass before I log in ;)Quote:
Originally posted here by lepricaun
ok if you want all the passwords in YOUR sam file:
log in as admin,
download the program pwdump2 and run it. now you'll have all the password hashes....
[edit]
I'll ask something logical... If I have admin access, why I would need other passwords???
I forgot one? Just set it again from computer management
I want to access somebodys files? I'm admin already, I can access them anyway.
I don't know admin pass? Well my friend, you shouldn't know it in the first place!!!
Desolation is trying to crack a SAM that belongs to a "Friend's computer" that was obtained on a floppy. If it's a friend's computer and the friend trusts you enough to export the SAM to a floppy for you, you should already know the admin user/password combination and shouldn't need to crack the SAM to get it, IMHO!
Check out the other post here: http://www.antionline.com/showthread...hreadid=254106
Well. I will trust you-ish even though what you are saying is complete bullshit. You can use pwdump2 or L0pht4($$$), but both require administrator. Basically you can not touch the SAM file while running NT unless you use DLL injection. There are other ways such as using DoS or Linux....
-Cheers-
although i think that if you have gotten the sam file legally, you also have the admin password, and i think your story isn't right, i have one tip for you:
search google, there are plenty ways, just have to find them.
The man asked for a way to do this, you people shouldn't be concerned with why he wants to do this. Or the fact that he has a horrible excuse, just tell him what he wants and let him go into his corner.
Ok, I've had a need to retrieve a password on my WinXP machine once, After googling for about a minute, I found the Offline NT Password and Registry Editor, basically it is a Linux boot disk that goes in, retrieves the SAM hashes. Now a while ago (must be about a year now), someone at AO found a web-interface to retriving the passwords from the hashes, if you search AO for Windows XP, ICP, SAM and possibly my old name (ac1dsp3ctrum) you might find it. Good Luck!
All your SAM are belong to us
Here's a good thread that gives some of the tools you'll need to extract XP passwords but not much of an explanation.
Sam File
thanks newinnash, i could have thought about that myself too, but like i said, just search for it :) nothing bad intended.
Wait a minute, lepricaun....I think you did think of that...It was, after all, your thread he linked to, wasn't it?
:D
begki:Nope, sorry...can't do it....cause if he uses it and gets busted, the FEDs take his computer. Then they read the posts on AO and they come knocking on Inetmon's door asking questions. Of course, when they produce a warrant (and they will), AO gives them the info on all the folks that helped him and three guys in really bad suits come knocking on everybody's door at 2am...except me.Quote:
The man asked for a way to do this, you people shouldn't be concerned with why he wants to do this. Or the fact that he has a horrible excuse, just tell him what he wants and let him go into his corner.
Maybe that's why I'm concerned.
You can tell him anything you want, but I ain't saying $hit!
Leavenworth isn't exactly the Waldorf
576869746568617, i think your right! that's why i think that he'll have to search for it, cause that's the only way to really learn something!
and i don't think that the feds would come knocking on my door, since i'm about 3000 km's away :)
and i've they do, so what, i've got nothing too hide, since i'm not doing anything illegal with my computer, i'm just here to learn, since i'm very interested in computer security and i would like a job in it ( now i'm a repair engineer ) ;
WHAT A BUNCH OF BULLSHIT!! are you trying to tell me that if you tell someone to get pwdump2, as MsM did, that ao or bindview can be held responsible for what is done with it?
If that were the case razor would have been in jail for a very long time now as would jp.
this guy is asking for info for what he says is a legit reason...how are we responsible for what he does with it
How many of you can actually do whats being asked here? now of those that can how many learned it on their own? now out of this group, how many of you are going around breaking into computers now that you know how to do it.
you can use lc4 but you wont learn much more than how to use lc4. get pwdump2. it'll take patience and research to learn how to use it. nothing will be handed to you.
http://razor.bindview.com/tools/desc...p2_readme.html
Have a look at Rainbowcrack , slightly different approach the L0pht. Takes a while to build the initial hash file, but then it flies
Also, I think Tedob is touching on a larger issues. Since coming back on here after a while I notice that lots of posts seem to receive replies along the lines of "we can`t tell you that, sorry, as you may do bad things" etc...Now, I know we are not here to advise people how to hack into sites and cause electronic carnage, but, and taking this case, if we explain to someone what to do to crack a Sam file, they still have to get it and then do something with once its cracked, so a lot of the work is still to be done. I guess I am just concerned that maybe some people (and 576869746568617 you are not one of them) are using some nice excuses in order to cover up the fact that they really don`t know much either and just want to give the illusion that they do.
If someones asks a blatant hacking question like "How do I hack hotmail" then sure, flame them all day, but if someone asks how to do something that others might find useful then surely its our task to provide useful information?
And I don`t think we are going to go to jail if we tell someone how to do soemthing. Well, maybe I am just hoping that people will be held accountable for their own actions...otherwise where does it end? If you are driving a car and run someone down and kill them is your driving instructor going to be thrown in jail?
Ted, you have a valid point, and I think that you are right for the most part...as long as you are not the one who breaks into the system, or you do not collaborate directly to help compromise the system.
This is fine and dandy and all...as long as both of the above apply, and there are no extenuating circumstances that would cause a third variable to fall into play.
I for instance, by nature of my employment with a certain entitiy, have such a third variable. The 99.975% chance that nothing would happen to me or my employment does not outweigh the .025% chance that something would, IMHO.
You can call me a puss or whatever...I don't care. I worked very hard to get the job that I have, and I'm not about to risk losing that.
Besides, there are plenty of step by step explinations of how to do it...many on this site. Maybe I'll just link to one next time, like newinnash did, instead of feigning ignorance.
I for one wouldn't even fool around with the SAM. It's much easier to enumerate the information from the LSA, especially if you have physical access.
And if you know the person really well, you probably have the password on you computer already from when he checked his Hotmail account from your computer the last time he came over to visit. (Survey says: 95% of people polled use the same password for everything)
Not bashing or flaming...just explaining.
Have you tryed Cain?
Cain is good for dumping users and passwords! on the box that your using anyway
i would never think anyone a puss for saying what they believe. actually i think thats being rather stand-up. but i could not accuse someone of criminal intent in word or in deed for wanting to learn something that i myself have learned in pretty much the same way either....but thats just me.
I feel you on that one, Ted. Sorry If I came across as abrasive or rash earlier. I wasn't pissed off at ya,...have more respect for you than that, as you do me :)
BTW, the puss remark wasn't directed directly at you....I was referring to whomever were to read the post and get that impression. I know you better than that from what you post to other people, and you're the kind of person that call it as you see it....if you thought I was being a puss, you would have said that from the start! :p
And I do agree with you that it isn't fair to automatically assume that someone has poor intentions just because they ask a question like the one that started this thread. I think that's the core of the issue, isn't it.
It's just that, in this instance, the ole' red flag came up, because I was talking about it in the other SAM cracking post (by the same person, same subject), and when I got here, the information in the reason for needing the info was different.
I think that we both hope that everyone else at AO doesn't just start flaming folks for asking questions. That would be a shame. How else are we going to help educate and shape the minds of future generations of security professionals? Do we really want to fill our ranks with ignorance?
Of course we don't. It's OK to have fun and taunt and make jokes and all, and sometimes, giving out a hard time to someone is OK. I'm not saying that we should not give out this kind of information just because the question is "How do you crack an XP logon password?". There ARE a lot of legitimate reasons to ask a question like this.
I also think, and I think that we both agree on this, that we all, as security professionals, have a responsability to not give this kind of information out indiscriminately.
Now, If they ask something like "How do get root on Windows XP" and when you ask them to explain they say something like "There's this computer in the barracks, blah, blah, blah..." Well, that's a whole different matter. :D