Removing The Sam

GovernmentSecurity.org > System Security > Beginners Section

studnikov

Aug 8 2004, 12:33 AM

I was wondering if there was a possible way to Copy the SAM file from a remote host. I have access to my remote systems im not asking how to gain access so you can get them, i just want to know if it is possible to make a copy of them and move them to my host system or to another remote host for later retreival.

i get this error everytime

CODE

450 Cannot open file /c:/WINNT/system32/config/SAM for reading.
Transfer Failed!

i tried to rename without sucess, stumped here, if anyone can guide me toward the right direction , i would greatly appreciate it

G777

Aug 8 2004, 12:44 AM

lol try pwdump2
i packed in a dos sfx with batch to run it so execute it in a shell to unpack
once unpacked type

QUOTE

pass

this will dump the sam to zzz.txt and then delete the pwdump files

Auto PWDump

studnikov

Aug 8 2004, 12:54 AM

thanksfor your quick reply, but im actually wanting to copy the file itself. I am testing 'samrape' that illwill created and posted. In the readme it says this :

CODE

The problem is that you must
figure out a way to get the SAM and SYSTEM file form the computer... the reason you need the SYSTEM file also is because if the
SAM file was encrypted with SYSKEY then the SYSTEM file holds the key to reverse it

Thats why im tryin to copy the files, but without sucess.

G777

Aug 8 2004, 01:01 AM

well i dunno bout that mate i`ve never used illwill`s proggie
i always use pwdump2 then import the results into lc5 for cracking, works for me

fulvioo

Aug 8 2004, 01:43 AM

try at

CODE

c:\WINDOWS\repair\sam

but this can be removed

mathofaka

Aug 8 2004, 03:12 AM

YOOOOO THNX THNX THNX ALOT G777

aapje

Aug 9 2004, 03:55 PM

or use lc or how that program was called from @stake, it can connect to a remote computer and get the hashes

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.