Printable View
There is a SAM file in the c:\winnt\repair\ directory. Is this same at the one in the config directory.
Ive noticed the one in the config directory is being used by the system so you cannot read the contents but this one is readable.
Can anyone shed light on why there is 2 SAMs?
If i'm not mistaken this is the backup of the sam file, a read only copy.
Thanks
the SAM in the repair folder is not exactly a backup nor is it RO, it is created when an ERD is created (or other various system recover tools are used), consequently this repair file tends to be quite dated.
The other SAM actually contains the Hkey_Local_Machine\Sam registry hive.
catch
well then my quote below is quite true!
Hmmm..so if I extracted a password out of it , it could be a very old password thats been changed?
Is there anyway to read the current SAM file?
There exist tools for extracting the SAM file, all of these require the privileges to do so (most likely Administrator).
Passwords extracted from the SAM repair file may or may not be dated, but as a rule they are.
Lastly, I don't know of any tools that will extract passwords from the SAM if LM passwords are disabled (as they should be in the security policy)
catch
Well its on a remote machine, and its not so much I want to extract any passwords via network, I just want to get a copy of the SAM on my local computer. I dont think its possible, I was able to get the old one and extract the Administrator password but it appears the password did not work, so I figure it is an outdated password.
Google "rdisk.exe /s". It was taken out after NT 4 and is now done via the repair disk wizard.
-Maestr0
pwdump2 should still dump the nt hashes from the SAM (presumably the LM ones will not be there though). I haven't tried it though. But it does dump the NT hashes normally along with the LM ones.Quote:
Originally posted here by catch
I don't know of any tools that will extract passwords from the SAM if LM passwords are disabled (as they should be in the security policy)
There is a modified version of John which will attack the nt hashes instead of LM ones.
The NT hash algorithm is better than the LM one - it is harder to attack. But dictionary attacks still work. It is more similar to how it works in Unix.
The LM ones I don't fully understand, but maybe it is case insensitive and stores parts of the password so they can be cracked independently?
Slarty
*revision*
When I meant extract the passwords, I meant the final passwords, there are many tools that will pull the hashes.
Yes a dictionary attack will work, but a system established according to the MS/NSA guidelines using 8+ chars and password complexity, will from my experience take too long to be useful. NTLMv2 is pretty decent, I have not even read of a successful crack against a system following standard guidelines.
I beleave that if you syskeyed your system, prog's like pwdump & l0pht will dump the sam and the hashs , even from a remote machine but they will not be able to crack it, (the new version of l0pht, i think can but im not at work to play with it) so if you used syskey as you should you might not be able to recover. and yes you do need root priv. on a box to dump the sam remotely.
AFAIK you still need admin privs to be able to do that.Quote:
Originally posted here by slarty
pwdump2 should still dump the nt hashes from the SAM (presumably the LM ones will not be there though). I haven't tried it though. But it does dump the NT hashes normally along with the LM ones.
LM passwords use only ascii and are always converted to uppercase. After that it will fill the password with nulls if it's shorter then 14 characters. This 14 character password gets split up into 2 7 char. pieces. These pieces are used as a key in a 56bit DES encryption resulting in 2 pieces of DES cyphertext. These are concatenated and stored in the SAM.Quote:
The LM ones I don't fully understand, but maybe it is case insensitive and stores parts of the password so they can be cracked independently?
In contrast the NTLMv2 passwords are unicode and use MD5, making it alot more difficult to brute-force.
I think there is a way to gain admin acces with ntfsdos pro and chtdisk, and then use pwdump2 and L0pht.
But ntfsdos isnt working on my comp so cant help you a lot :(
If you want exact detail:
1. Boot with an Ms-Dos boot disk, run ntfsdos pro and mount partition
2. Copy SAM on disk(for back up)
3. Use Nt password recovery tool to reset password
4. Extract password with pwdump2 and save output on disk
5. replace new SAM with old backup SAM
6. Wait on your super computer to crack the pw file with L0pht
And you have admin password!
What franklinchef said doesnt' work anymore. For Windows 2000/XP "syskey.exe" is automatically turned on. So even if you boot with NTFSPRO and extract SAM. It will be useless. Even with the newest LC4. I found the only sure way to recover SAM is to use a linux boot disk.
Nt password recovery
And btw, this is a linux boot disk...Quote:
Works with syskey (no need to turn it off, but you can if you have lost the key)