Reseting XP Admin Password

Okay, I bought a computer from a pawn shop and it came preloaded with Windows XP. The guest account is enabled along with another users account. The computer did not come with the restore software and I don't have any copies of anything lying around to do a fresh install not to mention there is licensed software on the computer I would like to keep (photoshop and Auto-Cad Lite).

I did a little googling and seen that I can reset the password or even brute force the hash using programs such as LC5 but access to the SAM ( and yes I did try to copy the repair directory SAM ) has been prohibited by the former owner.

Then I seen the linux approach.

I am currently downloading the Knoppix ISO but I need some directions as to what I am doing. How can I reset the password for the admin account. Delete the SAM?

How about if you just wanted to reset only the admin? Is there a line in which I can delete?

You could just reformat and reinstall XP.

Cant you go into safe mode and make a new admin account or give the guest accounts admin rights ?

Quote:

---

You could just reformat and reinstall XP.

---

As he said

Quote:

---

don't have any copies of anything lying around to do a fresh install

---

He doesn't want to reformat and reinstall XP there is software on it he wants to keep.
Installing LC5 will do you no good cause if I remember correctly you need to have admin rights to install that program... Unless you just wana brute it.

Not exactly sure how you would though.. Most programs like pwdump and LC5 require admin rights to get any information.

john the ripper might work though or even possibly chntpwd(but I think the later only works on NT/2000)

Give this program a try
http://home.eunet.no/~pnordahl/ntpasswd/

The admin account I am trying to access is the one you mentioned. Whoever also owned this computer before made the admin account accessible from the regular login screen which is a simple reg tweak I belive.


One thing maybe the AO community can help me figure out is that there is a hint for the password which is "ursa in english"

The only thing I can find is Ursa in latin is she-bear and I have tried many variations of this to no prevail. Anyone else have an idea?

Before you get to involved in different ways to get in.......did you try the simplist?

Boot into safe mode (usually by pressing F8 while boot screen is up). The administrator account will then show up along with any other admin accounts that are enabled on the box. Try the default windows password for the main administrator account to see if it works. (simple enter key....no input).

If the previous owner did not change the password then that will give you access to all features of windows and you can delete all the other accounts and create any new ones you wish.

I red(sp?) the first post wrong or I only noticed that he said he didn't have the restore disk. Try the word ursa=urged in italian. You really should use google.
If you meed to translate something go to google above the search box you will see a option that says more>>. Then you go to the bottom and it says translate.

Actually I'm gonna rant for a second because when I went to google and typed resetting xp admin password I got 36,000 results so I don't think you even searched google.
http://www.google.com/search?hl=en&i...=Google+Search
Then on searching the AO forums I found this:
http://www.antionline.com/showthread...admin+password
and this:
http://www.antionline.com/showthread...admin+password

Use the search feature and google...

Unfortunately I don't have another computer at my disposal at this time to use. So went to burn the iso I got from your link DeadAddict and found that I don't have anything to burn an iso with. Can't install of course and found the rawrite tries to create a temp file somehwere which is not allowed.

Not looking good.

Also when I tried "urged" as the password I noticed that it is "usra" not "ursa". Sorry.


/edit

If you would have read the post a little muert0 you would have noticed that I said I did try searching google and I think if you read those results you will find that almost all of them require to use LC5, pwdump2, or someother like program which requires access to the SAM which I said I did not have.

/edit2 I looked at irongeeks porfile earlier and went to his actual site in which all the info was posted and once again, requires installation of a program or the way in which I was talking about, booting a live OS. I asked how to do so in linux because I only kno the basic commands and wasn't even sure if I should be doing this considering its a NTFS and don't think modification of NTFS from linux is quite stable yet.

I've had a similar problem, and always did this:

http://ebcd.pcministry.com/


It's a package (COMPLETELY FREE)that you can download to your machine and run to create an emergency ISO file. (An ISO is a cd image that you can burn to a cd). Burn that ISO to a blank cd, and boot up the computer with that cd. Of course this means you need access to a cd-writer and at least one blank cd.

From there, follow the instructions both on the screen and website to change the password of the Administrator account. It's actually quite simple, despite how complicated I've made it sound, and has yet to ever fail me on an XP box. Bootable, quick, and effective. If you need further explainations check their website or ask here. I'll do my best to answer.

For the program in my post you can either put it on a cd or put it on floppy disks.

you have some good answers so im gonna play. you might be able to use a local lsass exploit and telnet/netcat to the port that the shell is spawned on, "net user" a new user and assign it to the admin group with "net localgroup". im sure the owner of the pawn shop didn't take the time to patch.

create a windows 98 bootdisk (or download one from bootdisk.com) and startup with the disk, now go to c:\windows\system32\config\ and copy the sam and system file to disk (if it fits), and send me an email : lepricaun2003 at yahoo dot com with these files, then i'll see what i can do for you...
/*if it doesn't fit on disk, then copy those to c:\ to have access to them when your in windows*/

the above only works with FAT32, otherwise you'd have to download a copy of ntfspro, ntfsreader or something like that...

as you've sent me the mail, you'd pray they didn't create a very hard password, otherwise it might be nearly impossible to crack.

lets see, Hmmm....

I am not fully sure how to make an admin account if you are not admin right now....
But maby you can just wait.... if i am not mistaking it is like 30 days if the admin Acc. is not logged into the password will delete and there will be an account called Windows Administrator. I am sure that is one way but it takes time... a lot at that matter...


And a few questions...?

Is there a burning program on there?
And if so can you use it?

because if so you can find a friend with copy of your OS you are using and then you can just make a backup and just burn that and then you will have a fresh copy of XP and an Admin ACC
... and then with that backup you can install it to your PC...
That should work.

That's called pirating. He could just use the advice he's already been given.

Quote:

---

Originally posted here by pooh sun tzu
Wait, guys, why on earth are you trying exploits and 'cracks'? Three other proven and instant methods have been listed (you read the entire thread, right?) that do not involve hoping an exploit was not patched and the password was not too hard.

"Never use a cannon to kill a mosquito." - Confucius

---

pooh please dont get testy as i said "you have some good answers so im gonna play. " i read the whole thread. ...its a thought. he said he doesnt have a cd burner or another computer. id try it just for shits and giggles. actually HTreg told of a pwd resetter which i downloaded but cant remember the name of. im to lazy/tired to search for it. i have it at work but that does me no good here and the previous answers would work. how could you call it a cannon? a 12k file that can be downloaded and run from the mydocument folder as compared to iso's, multiple floppies whatever.

if it works use it - me :-)

This might help you:

http://home.eunet.no/~pnordahl/ntpasswd/

I know you are new here §©®@P here is a small bit of advice read the entire thread before posting your reply I already posted a link to that program on the first page.

Quote:

---

Originally posted here by Tedob1
you might be able to use a local lsass exploit and telnet/netcat to the port that the shell is spawned on, "net user" a new user and assign it to the admin group with "net localgroup". im sure the owner of the pawn shop didn't take the time to patch.

---

Hey Tedob, as far as I am aware, you can only give the spawned shell admin rights, if it is spwaned from an admin account. As in say you connected to the port nc is on, an admin would need to be logged into that computer for you to end up with an admin account other wise he would only be able to assign it to user group or something similar, if I am wrong could you tell me why as I have been experementing with this for about 6 weeks and havent found a way round it yet!

Thanks!

Well, according to this: http://www.g4techtv.com/feature.aspx?article_key=664

You must:


# Boot with Knoppix STD and launch a shell.
# From the shell, you can view all your NTFS partitions via the LinuxNTFS built into Knoppix STD.
# Navigate to the windows\system32\config directory.
# Copy the SAM and system files to a cheap USB thumbdrive.
# Take each of these files back to another Windows machine and fire up SAMInside. SAMInside uses SAM and system files to extract the encrypted hash (the SAM file is double encrypted with SYSKEY. SAMInside gets around that).
# Launch LC4. It will brute-force and dictionary-attack the hash marks. Once the hash has been matched, the final password is displayed.


Or, you could always try erasing the hash values... not sure what it'll do though.




My very first post! Yay!

or you could use a program called CIA Commander, fits on a floppy .. boots straight into it from start up and gives you the user accounts and the option to change their passwords to whatever ...

Quote:

---

Originally posted here by DeadAddict
Give this program a try
http://home.eunet.no/~pnordahl/ntpasswd/

---

Quote:

---

Originally posted here by §©®@P
This might help you:

http://home.eunet.no/~pnordahl/ntpasswd/

---

I would agree, as long as you have physical access to a system, this is a great tool for reseting the administrator or even a user password. I have tested this on many NT & 2K systems, I have been told it works on XP, but have never had the need to use it. Has anyone here verified its use on XP?

yes it works on XP, but has problems when you do not have a internal floppy drive, but one with usb, cause it tries to load the scsi drivers, but somehow it doesn't work.,

the earlier version had a problem with NTFS, but that problem is also solved with the latest version, GREAT PROGRAM!

Quote:

---

Originally posted here by Nokia
Hey Tedob, as far as I am aware, you can only give the spawned shell admin rights, if it is spwaned from an admin account. As in say you connected to the port nc is on, an admin would need to be logged into that computer for you to end up with an admin account other wise he would only be able to assign it to user group or something similar, if I am wrong could you tell me why as I have been experementing with this for about 6 weeks and havent found a way round it yet!

Thanks!

---

im under the impression that the shell is spawned as system just like the remote exploits shell is. i mean it is exploiting the authentication mechanism so it seems only logical. ive never had cause to try it. whos code are you using k-otiks and what exactly have you tried?

today i switched our t circuits from uunet to att and had to change everything that used the old IPs...god i never relialized...but tomorrow or the next day (i hope) ill dig out an un-patched machine and give it a go.

Quote:

---

Originally posted here by Info Tech Geek
I would agree, as long as you have physical access to a system, this is a great tool for reseting the administrator or even a user password. I have tested this on many NT & 2K systems, I have been told it works on XP, but have never had the need to use it. Has anyone here verified its use on XP?

---

For my tests, the disk from http://home.eunet.no/~pnordahl/ntpasswd/ works fine in XP, but you will have the best luck if you use the "*" option to blank the password instead of changing in. Changing the password on XP does not always seem to work on my XP box but blanking always does.