Password crackers?

[Reaperman@home]

Ok, you sound like you know a little bit about hacking...I have been trying to get the Admin's password for a while but have tried everthing I can think of.

I run a small network for "the man". Sometimes we check out old garbage computers before we dump them--passwords are long gone. The method is simple, but requires total access to a machine.

The sam should be on the local machine. Unless there's some kind of crazy network boot going--which, trust me, there's not. With a totally secure computer (like mine ), you will have to boot something that can mount NTFS drives. Either some flavor of Linux (NTFS is still in 'pirate' stages), or a commercial tool (like ERD commander). Yes, you'll probably have to pull cmos for it. Then either decrypt the sam or enter a new admin password (depending on what tools and time you have)

of course this just gets you onto this machine--the fun is on the domain, which you really will not be able to do from where you are.

as for grabbing the SAM file from within windows, M$ killed that many updates ago. All your admin would have had to do is click the install updates button. Even if you could install files, they will most likely not work. I tried PWdump4 here, all it says is "local lsass process failed".

[S q u e e !]

To get passwords, find pwdump4 and a version of cain and able.
pwdump4: http://www.hackingdefined.com/rainbow/rainbowins.html
cain and able: http://www.oxid.it/cain.html
Rainbow tables also speed everything up, but if you dont want to download a bunch of files you can submit the hash here: http://www.hackingdefined.com/rainbow.html

Can't you be fined for giving out information as to where those programs are, and for having them in your possesion?

[nos_slived]

Those programs have many legitimate purposes! (Like hacking)

It isn't illegal to know how to hack, or to have programs used to hack. It is only illegal when you are hacking a site or computer without the owner's permission.

[trogdorian1]

you mean i have to get permission to hack??? awww, my parents were right, u gotta ask for everything!

[G-Prime]

The sam should be on the local machine. Unless there's some kind of crazy network boot going--which, trust me, there's not. With a totally secure computer (like mine ), you will have to boot something that can mount NTFS drives. Either some flavor of Linux (NTFS is still in 'pirate' stages), or a commercial tool (like ERD commander). Yes, you'll probably have to pull cmos for it. Then either decrypt the sam or enter a new admin password (depending on what tools and time you have)

of course this just gets you onto this machine--the fun is on the domain, which you really will not be able to do from where you are. .

Thats the problem, there is a SAM file on the local machine...but the only thing it keeps is the password to get direct access to the computer. I wan't the one that is on the main server...that sores everyones account password. their has to be some way to get access to the SAM file without direct access to the server.

[HK-47]

To get passwords, find pwdump4 and a version of cain and able.
pwdump4: http://www.hackingdefined.com/rainbow/rainbowins.html
cain and able: http://www.oxid.it/cain.html
Rainbow tables also speed everything up, but if you dont want to download a bunch of files you can submit the hash here: http://www.hackingdefined.com/rainbow.html

Can't you be fined for giving out information as to where those programs are, and for having them in your possesion?

No they can all be used as whitehat security tools to test security on your own network. Thats their purpose. It just happens you can direct them at other peoples computers too.

[Reaperman@home]

their has to be some way to get access to the SAM file without direct access to the server.

there'd better not be a good way to get domain passwords of a properly secured network, or I'm out of business. Domain passwords aren't stored in the sam file--actually we don't know where the heck they're stored. (finding out has become a group project here). Best guess is spread out over numerous files--google doesn't even know. filenames and number of them probably vary by situation.

The best way:
coordinated physical attack. The human element is always the weakest link in any network. wait for admin to go to the little boys/girls room, pray the door and system are unlocked (they will be) go into the directory of users and create an account with admin rights. Have a friend further distract him for best results. This only works if admin is on site--which they probably will not be in a school.

stupid ways I've thought of so far:

1) if he's left the old net command intact (slightly likely) you could send the admin account a keylogger. I believe you can specify destination folder, but I also think he gets notice of it (requiring him to accept the file). at best he'll say yes for a good laugh. (you'll have to know the computername, IP or username--and it probably isn't 'Administrator'). If dropped in startup folder it should send his keystrokes when he unlocks the machine (after reboot). my net command was neutered long ago, so I can't say for sure if this would work from where I'm at.

2) we were also tossing around the idea of using a rogue machine, as ethernet generally sends all signals everywhere (with tons of exceptions), and leaves individual OS to figure out what is what. However this is grandmaster level--we don't even know how possible it is. It would require a very 'special' machine. Also for password transmission, a great deal of handshaking and encryption are involved, and the key probably changes often and relates to the specific situation. Now it is possible since school networks will not have port security (like federal networks use), but I've never really heard of any tool that does this. also this will not work if there's anything smarter than a hub between you--which there probably is (especially since he's likely offsite).

generally speaking, almost any other password is easier to get.