Cracking Windows User Account Password

In Windows OS Passwords are Stored and Transmitted in an encrypted form called a Hash. When a User logs on to a system and enters a password, a hash is generated and compared to a stored hash. If the entered and the stored hashes match, the user is authenticated (This is called the Challenge/Response). This is stored in a file named SAM.


The SAM file is located here as shown in the picture below


We cannot recover the Password from the Encrypted Hash.

So what options do we have???

• We can just remove the Hash from the SAM file, which will remove the password from that user account. Next time we will try to Login, Windows will not ask for the password.
• We can replace the Hash in the SAM File with a New Hash, which will replace the Password for the User Account. Next time we will try to Login, we can give the newly replaced password.

Hence, now we need to attack the SAM file. For this we need to open this file. But it is not possible as it is in process by the computer from its start up. Even if we open the file then also we cannot see the passwords stored in it because they are encrypted in the form of HASHES. And they cannot be decrypted as it is a one way encryption and also the hardest encryption.
But it is not impossible. If we can access the SAM file just before the OS loads in the memory, then something can be done.
Here the role of Live CDs come into play.

What is a Live CD??

A live CD, live DVD, or live disc is a CD or DVD containing a bootable computer operating system. Live CDs are unique in that they have the ability to run a complete, modern OS on a computer lacking mutable secondary storage, such as a hard disk drive. Live USB flash drives are similar to live CDs, but often have the added functionality of automatically and transparently writing changes back to their bootable medium. While live CDs typically do not alter any system or files already installed on a computer’s secondary storage, but many of them include mechanisms and utilities for altering the host computer’s data stores, including installation of an OS. This is important for the system management aspect of live CDs, such as removing malware, drive imaging and system recovery.
There are a number of live CD software which can help us in changing or just removing the administrator password to gain access to the computer for the first time. I told here “for the first time” because once you gain access to the machine, you can maintain the access to it by creating a Backdoor. I will tell you about creating simple backdoors in Windows based PCs in my next post. But for the time being I am telling you some famous and really effective live CD software. You can always Google them down.
So here are they:

• Active@password changer
• Oph Crack
• Offline Password Cracker
• Kon Boot
• Hiren Multiboot CD
• Cain & Abel

Securing Windows System

Now we know how our system is vulnerable to the above type of attack. So it is important to know what countermeasures exist for the tools we’ve listed above, because we don’t our system to be vulnerable.
Here is a quick list of some countermeasures to take to prevent and re-mediate attacks already discussed.

• Enforce 7-12 character alpha-numeric, upper and lower case passwords.
• Set the password change policy to 30 days.
• Use the SYSKEY utility to store hashes on disk.
• Change the Boot sequence of the BIOS to make Hard Disk the First Boot Device.
• Apply Password to the BIOS.
• Physically isolate and protect the system.
• Apply permissions on the File and Folders on the Hard Disk.

A strong password is less susceptible to a Cracker. The following rules should be kept in mind while giving passwords, to protect against attacks:

• Must not contain any part of the user’s account name.
• Must have minimum eight characters
• Must contain characters from at least three of the following categories: Non alphanumeric symbols ($,:”%@!#), Numbers, Upper case letters, Lower case letters.

With this I conclude my post on gaining access to a windows based PC. In my next post I will tell you about maintain access to a PC after gaining access to it as you might not always have the live CDs with you.
Till then…Stay Tuned with HACK-SAW.
Good Bye.