[NBLUG/talk] recovering Windows pw with Knoppix

Andrew argonaut at softhome.net
Wed Dec 29 21:32:50 PST 2004


Never heard of SAMInside. Maybe I should have a look at it. Might
come in handy some day. Anyway, if all you're trying to do is get
into the Administrator (or other) account on NT/2k/XP and you're
not interested in *recovering* the old password, you can use
Petter Nordahl-Hagen's Offline NT Password & Registry Editor to
blank the password and thus get into the account. It's a small
download: two floppies or a 3 MB .iso. And it's Linux-based, with
a fairly open "license", so you can feel good about using it. You
can get it at:

http://home.eunet.no/~pnordahl/ntpasswd/

You can also find it included in a number of "rescue"-type CDs,
such as the SystemRescueCD.

Good luck.

A.


Kevin Dwan wrote on Wed, 29 Dec 2004 20:12:31 -0800:

> 
> I found the below: does anyone know how to do this *without*
> requiring SAMInside?
> 
> 1. Boot with Knoppix STD and launch a shell.
> 2. From the shell, you can view all your NTFS partitions via
> the LinuxNTFS built into Knoppix STD.
> 3. Navigate to the windows\system32\config directory.
> 4. Copy the SAM and system files to a cheap USB thumbdrive.
> 5. Take each of these files back to another Windows machine and
> fire up SAMInside. SAMInside uses SAM and system files to
> extract the encrypted hash(the SAM file is double encrypted
> with SYSKEY. SAMInside gets around that).
> 6. Launch LC4. It will brute-force and dictionary-attack the
> hash marks. Once the hash has been matched, the final password
> is displayed.
> ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
> '''''''''''''''''''''''''''''''''''''''''''''
> Thanx. 
> 
> 
> Kevin Dwan              kevind at sonic.net
> 707-823-7077  




More information about the talk mailing list