Windows Passwords

Question 1

Where are all Windows passwords (except DC) stored?

Answer 1

• the SAM (Security Accounts Manager)
• a database stored as a registry file
• C:\Windows\System32\config
• HKEY_LOCAL_MACHINE\SAM
• not accessible while the OS is running

Question 2

What are the Windows password hashing formats?

Answer 2

• LM

- NT (all passwords from Windows 2000 are stored as NT)

Question 3

How can Windows passwords be Remotely dumped?

Answer 3

• passwords are dumped from the memory of the remote system, by loading a password dumping program remotely
• requires at least an administrative account
• pwdump, fgdump, ophcrack

Question 4

How can you use Metasploit to remote steal Windows hashes?

Answer 4

• getuid

- run hashdump

Question 5

How can you steal Windows hashes locally?

Answer 5

• requires physical access to the machine
• 2 methods:
• • Running system: local admin; download hashes from memory
• • Off-line system: decrypt the SAM stored in SYSTEM file

Question 6

Off-line steal Windows hashes with Kali?

Answer 6

• Boot Kali on the Windows system
• Mount the partition where Windows is installed (/mnt/sda1/WINDOWS/system32/config)
• samdump2 SAM syskey.txt > ourhashdump.txt

Question 7

What are some tools to crack Windows hashes?

Answer 7

• John the Ripper
• ## ophcrack