CRACKING WINDOWS USER ACCOUNT PASSWORD

Share

Tweet

Passwords are Stored and Transmitted in an encrypted form called a Hash. When a User logs on to a system and enters a password, a hash is generated and compared to a stored Hash. If the entered and stored hashes match, the user is authenticated (This is called the Challenge/Response).

          Passwords may be cracked manually or with automated tools such as Brute-force method or the Rainbow Table attack.

WE CANT RECOVER THE PASSWORD  FROM THE ENCRYPTED HASH

WHAT OPTIONS DO WE HAVE?????

          Can we just remove the Hash from the SAM file, which will remove the Password from the User Account. Next time we will try to login, Windows will not ask for the password.

          Can we replace the Hash in the SAM file with a New Hash, which will replace the password for that User Account. Next time we will try to login, we can give the Newly Replaced Password.

METHOD:1

          USE THE COMMAND IN COMMAND PROMPT

                   Net user username*

                             -Type a New Password to Reset the Hash

                                                OR

                             -Leave Blank and Hit Enter to Remove the Password

By the above method if u get any message like ACCESS IS DENIED then do the steps below

METHOD:2

SAM file is in

 We need to attack this file

For this we need to open this file but it is not possible as it is in process by the computer from its start up.

And we suppose that the file opens then also we can’t see the passwords stored in it because they are encrypted in the form of HASHES.

And they are not be decrypted. And it is hardest encryption done and decryption is not easy.

But it is not impossible.

We need a bootable cd named HIRREN BOOT or OPH CRACK can crack the password

But we find another attack

          Go to C:\Windows\System32\

          Copy the File cmd.exe to desktop and rename it to sethc

          Now copy the file sethc to C:\Windows\System32\ and will give an error saying

DESTINATION FOLDER ACCESS DENIED

YOU NEED PERMISSION TO PERFORM THIS ACTION

          NOW right click on Sethc.exe>Properties>Security>Advanced>Owner>Edit>Double Click Administrator>Apply>ok>close

          Rightclick sethc.exe>Propeties>Security>Advanced>Permissions>Change Permission>Double Click on Administrator>Check on full control>ok

          Now copy the file sethc to C:\Windows\System32\

          You are done

          Now at the login screen press SHIFT KEY 5 times and a beep sound will come and command prompt will open.

          In the command prompt type “explorer.exe” without quotes and Hit enter a desktop will open in the tab mode. Use the computer Unlimited

                             OR

          In the command prompt change the password by shown in the METHOD 1