Investigation: How to acquire a local SAM file.

Ola:

We are conducting an investigation in cooperation with our corporate security group, our first, and our manager, who knows how to do this, is out. We have a laptop from the employee under investigation and we are wondering how to get the local SAM file from the laptop. We can't ask the employee, as they do not know they are under investigation. We are going to try an UltraBay, and reload the physical harddisk into it and try to get admin access to the harddrive. Any thoughts, leads, tools or ways to check out would be appreciated.

The machine is a IBM Thinkpad T40.
The OS is W2KPro.

Let me know if there are questions as well.

In advance,

Gracias.

Well,

If you have an admin account on the machine... and the machine is connected to your network .....than you can pretty well copy any file off the laptop using the hidden admin share

\\machinename\c$


Although...there are procedures to "collect" info for investigations...depending on what your investigating, local laws, and if it needs to stand up in court. etc etc

MLF

you could download the live cd "Auditor" and use the samdump utillity.

Check out IronGeek's Tut on it:
http://irongeek.com/i.php?page=security/localsamcrack2

Ola:

Quote:

---

Well,

If you have an admin account on the machine... and the machine is connected to your network .....than you can pretty well copy any file off the laptop using the hidden admin share

\\machinename\c$


Although...there are procedures to "collect" info for investigations...depending on what your investigating, local laws, and if it needs to stand up in court. etc etc

MLF

---

Thanks for the reply back, but that's just it, we don't have admin access. Hold on...

...
OMG we just got it. We asked one of workstation analysts for an IBM ultrabay. We got the ultrabay, took the harddrive from the laptop we are looking at, put it into the ultrabay, loaded the ultrabay into bay of another IBM laptop we control and was able to mount the drive like a jump drive and pull over the SAM file. Took about 5 minutes total. Now off to use LC5. We are only going to get the admin pw and turn it all back over to our corporate security group. Thanks for the advice.

Buenos dias.

There you go. But like kernal said, there are utilities out there to boot with that will let you access NTFS partitions and grab the SAM file.

And I wouldn't even break out LC5. The guy's password is probably his username or a local sports team. :)

Hang him!

Quote:

---

we don't have admin access

---

Just curious, why don't you? Does anyone in the company or is it just your manager who isn't there right now? Is this a personal laptop that they use at work? If it's a corporate computer someone should have admin access.

seriously, why even remove the hard drive, throw on audittor dump the sam to a jump drive and crack it on another machine, it would take less than 5 minutes, probably even with boot time.

Quote:

---

Just curious, why don't you? Does anyone in the company or is it just your manager who isn't there right now? Is this a personal laptop that they use at work? If it's a corporate computer someone should have admin access.

---

It's a company computer, but we found out that they wanted the person's own id/pw, which in this case was not on the local machine but was a domain account. They also wanted admin access to laptop and did not want to ask IT - for confidentiality purposes.

Quote:

---

seriously, why even remove the hard drive, throw on audittor dump the sam to a jump drive and crack it on another machine, it would take less than 5 minutes, probably even with boot time.

---

What is the software you are referring to "audittor"? If so, would you need login access to load it up or can you boot up from it on a CD (like Knoppix)?

...

Also found out that the person who asked us to do that, was in fact NOT supposed to be asking us, but going through other channels, like our manager. It was cool to watch our manager flip and go after the corporate security person. Our manager told us what should have actually happened. So we stopped LC5 and handed the material over to our manager. And the reasons for that deal with legality and security - and we found out that the person who asked us to do the deed, should have known better. Hmmm. Be interesting to hear if anything happens from this whole incident.

Thanks again.

Buenos dias.

I accidentally unsubscribed from my work laptop's domain while having some phun(tm) with unencrypted wireless access points in an apartment building parking lot. I tried joining a workgroup but when I rebooted I couldn't log in to WinXP anymore. I tried using Auditor to capture the SAM last night and it was as simple as mounting hda1 and navigating to c:\windows\system32\config. I couldn't figure out how to get WLAN working and the laptop has no floppy drive so I don't think I can get the SAM off the computer. I'll be reading Irongeek's tutorial for John the Ripper tonight, though I may grab a 300mb text file for rainbowcrack instead since that's supposed to be way faster.

Unfortunately, I believe I'll need physical access to the domain if I want to join it again, even with the admin password. My account is locked until my next contract in a month and I have some hackering and crackering to do before then, so I'm just brute forcing the SAM to see if I can do it. I'm going to format it and tell them I got a Norton-crippling virus and didnt' want to take chances.

Word to the wise - don't unsubscribe from an inaccessible domain if you need it to log in! Whoops!

Auditor is a lot like knoppix, its a live linux cd.

its available at:
http://new.remote-exploit.org/index.php/Auditor_main

Quote:

---

I'll be reading Irongeek's tutorial for John the Ripper tonight, though I may grab a 300mb text file for rainbowcrack instead since that's supposed to be way faster.

---

Might want to look at ophtcrack which uses a small or large rainbow table dependent on your CPU speed. Actually looks rather nifty (haven't had a full chance to abuse it!) :D

Reset the local admin password. I don't see how the SAM will help you any. In a Domain environment the authtentication takes places against a Domain controller. In the event a DC is unreachable Windows caches the last 10 accounts in LSA secrets (By default that is, GP can overide this) Allowing users to log in when a DC is unreachable. However if you removed yourself from the Domain, the cached credentials will be invalid. Local accounts will be all that are available, so just set your local Admin account.

-Maestr0

Quote:

---

Unfortunately, I believe I'll need physical access to the domain if I want to join it again, even with the admin password. My account is locked until my next contract in a month and I have some hackering and crackering to do before then, so I'm just brute forcing the SAM to see if I can do it. I'm going to format it and tell them I got a Norton-crippling virus and didnt' want to take chances.

---

You will need a domain admin account to rejoin the domain. Your local admin account won't be able to do it. Othewise, once you get the local admin account you should be good to go until you need to log into the domain again.

If you can't get the wlan to work and don't have a floppy, then try a flash drive. They are pretty simple to use. There are several how tos out there on how to mount/use them.

Normally as simple as

Quote:

---

su
mkdir /mnt/flash
mount -t vfat /dev/sda /mnt/flash

---

After you have your sam file, then you can use ophcrack (which uses rainbow tables).
http://ophcrack.sourceforge.net/ (Same that MsM posted above, just the "official site")

It is pretty damn fast. I cracked my local accounts in seconds! After I changed the complexitiy and length of the passwords... I was unable to crack them. My P4 3.2ghz hyperthreaded box acually shut itself off due to overheating... I need to get another fan in that sucker.

a real handy device to have around is the "Offline NT Password and Registry Editor" found here: http://home.eunet.no/~pnordahl/ntpasswd/

it allows you to change or reset the password in NT/2k/XP/2003. and is really simple to use. so if its a really strong password and is hard to crack or you just dont want to be bothered this is the way to go.

Tedob1: I've had problems using that ntoffline on a XP SP2 box. After using it... every time I booted that box, it would put itself through a chkdisk. Then I was unable to make changes to the user profile. I had to delete the profile and let the system create a new one.... In one case I had to rebuild the box. (no ghost images... home user)

Anyone else had problems with ntoffline since XP SP2? I used to use it and trust it completely... but with ophcrack and an auditor cd... its just as easy to grab the sam and crack the passwords than it is to have to possibly reinstall the box. :(

At the time, I was using the latest version...

As you are conducting an investigation, you should really image the HDD using a forensics tool like EnCase or Vogon, and analyse the data from the image, not from the original HDD. Otherwise your evidence is open to challenge by the employee in question.

Also, does the HDD have a username and password unique to the individual under suspicion, or does it have a generic logon? If the latter, then the "suspect" may squirm out of it by claiming that "someone" else must have used the laptop for nefarious purposes. They may also use this defence if the laptop has been stored somewhere where other members of staff had access. A police officer in the UK under investigation for viewing paedophile material on the net successfully defended themselves in court using exactly this defence.

I also seem to remember that a suspected "hacker" successfully defended themselves in court by claiming that a trojan was on their PC that may have been used by someone else to perpetrate the hacks in question.

From the defence point of view, its all about reasonable doubt, and when a judge/jury or even an internal disciplinary committee don't understand the technical issues, then that reasonable doubt is fairly easy to establish.

On the plus side, my experience is that if all you're after is bringing the employee into line, then confronting them with whatever evidence you've gathered usually results in them blubbing and confessing all. If they don't understand the issues surrounding the integrity of evidence, they usually consider themselves caught "bang to rights" even if you do more than show them the contents of their IE History folder. But a more savvy employee may brazen this out, and then your evidence handling becomes an issue.

In short, your internal procedures for handling evidence (which must stand up to third party scrutiny if necessary) are as important as the actual evidence you collect.

If the guy doesn't seem technologically apt enough to choose a secure password, use pwdump, or Cain, or SAMInside and post the LM hash here. I have 9 Rainbow tables to use that cover:
abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()


Though to complete the set, I need 71 tables, I'm only on the 9th right now. But 0-8 are sorted and ready to rip. I've cracked several passes already with it.

A_T

I find it odd that a company would have to break into one of their own computers. I would expect that the admins would have the admin password for any machine on their network. If its not their system and its his personal machine and they are doing this, well that opens a whole new can of worms that could blow up in their face.

Secondly, I find it odd that you're breaking the password for the system instead of the "Corporate security" team. In any case this thread is somewhat old and he has said that he was able to obtain it so I guess the issue is past the point of no return.