iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (1)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Remove A Windows Password
  • Corrosion
    Posts: 121
    Can be done in damn near any linux os, I used backtrack for this:

    1) Boot backtrack
    2) Find the windows drive(partiton)
    a) fdisk -l (the larger drive is prob windows, example: /dev/sda2)

    3) Create a directory to mount it to
    a) mkdir /mnt/win (makes a folder under /mnt/win, windows will be there)

    4) Mount the windows drive to your new directory
    a) mount -t ntfs-3g /dev/sda2 /mnt/win -o force (this mounts /dev/sda2 to /mnt/win) (if your doing this on a disto other than backtrack and this command doesn't work do "apt-get update" then "apt-get install ntfs-3g"

    5) Goto the location of the sam file, CASE specific, run ls after every cd change
    a) location is: /mnt/sda2/windows/system32/config

    6) Run CHNTPW
    a) chntpw -l SAM SYSTEM (Case of sam and system is important)
    b) This lists the users, so pick your user

    7) chntpw -u USERNAMEHERE SAM SYSTEM
    8) SAY NO TO DISABLE SYSKEY!
    9) Now just run your command to either unlock the acct or blank password
    10) Safe HIVE and reboot.
    11) Shutdown via command
    a) shutdown -h now

    Re-posted from my own site: http://deauththis.com/forum/security/ba ... 48/#msg248

    you can also find a video of me doing it there
  • Xin
    Posts: 3,251
    Just watched your video to this, watching episodes 1-4 in one lump im loving it, didn't know about the chntpw tool either. Thanks
    Xin
  • Corrosion
    Posts: 121
    :D It's really great to hear, any questions or suggestions let me know
  • realitybend
    Posts: 25
    Before you spend the time with this - on many XP systems, you can simply reboot into safe mode, go to the "Administrator" account, and hit ENTER without typing in a password. It amazing how few people changed their admin password... At some point probably 80% of Windows installs were vulnerable to this. Now, it's a lot less... but it's quick and easy to check.
  • Sh3llc0d3
    Posts: 1,910
    said:


    Before you spend the time with this - on many XP systems, you can simply reboot into safe mode, go to the "Administrator" account, and hit ENTER without typing in a password. It amazing how few people changed their admin password... At some point probably 80% of Windows installs were vulnerable to this. Now, it's a lot less... but it's quick and easy to check.



    Thats how I used to gain access to systems, so simple.
  • Corrosion
    Posts: 121
    KonBoot in my experience is complete garbage, I've never seen it work properly outside of a vm
  • realitybend
    Posts: 25
    ophcrack has also worked in my experience.
  • Corrosion
    Posts: 121
    ophcrack is good, so far chntpw is my favorite method
  • Xin
    Posts: 3,251
    Didnt think oph worked on 7
    Xin
  • Corrosion
    Posts: 121
    idk if it works on 7 or not (oph crack)

    btw, I just tried the paid version of kon-boot v1.1
    It is amazing! Will boot no problem even on x64 machines and win7 of course
  • Sh3llc0d3
    Posts: 1,910
    Konboot does look a good bit of kit, saw it demonstrated on hak5
  • Corrosion
    Posts: 121
    kon-boot v1.0 is complete garbage...

    here is a video demo of kon-boot v1.1 I paid for the license (although you can find it floating around)
    http://www.youtube.com/watch?v=IT2v_5Lx ... ture=inbox

    V1.1 is great and runs off of a floppy, usb, cd its just great :D
    but, scary easy tool for a skiddie to have
  • Corrosion
    Posts: 121
    said:


    use konboot that will be better



    said:


    kon-boot v1.0 is complete garbage...

    here is a video demo of kon-boot v1.1 I paid for the license (although you can find it floating around)
    http://www.youtube.com/watch?v=IT2v_5Lx ... ture=inbox

    V1.1 is great and runs off of a floppy, usb, cd its just great :D
    but, scary easy tool for a skiddie to have


    not bad but both kon boot and chntpw are cheaper
  • Xin
    Posts: 3,251
    Or you can use l0phcrack if its XP/Vista then you can actually crack the password.
    Xin
  • Corrosion
    Posts: 121
    yeh thats one downside is that it kon-boot will not tell you what password is, same with chntpw...
    but if your for example in a pc repair setting the customer thought telling you the password was unimportant... we'll now it is,
    put the thing on a flash drive and just boot in real quick
Add a Comment