just wondering where the user name and pass so i can login with remote desktop

SAM <-

The encrypted hashes are stored in the SAM files....but you can't access them while the OS is in use. Try an alternate directory, like a recovery directory (I forgot where), that may store a copy of the SAM for you to DL.

You can then use L0pht Crack, or known as LC4 to crack the hash.

You can also use www.sysinternals.com tool NTFSDOS, to boot the machine to DOS, then DL the SAM onto the NTFS floppy. Import to your LC4 machine and crack accordingly.

-Hardcore

you can often find the stored sam
in "WINDOWS\repair\" or "WINDOWS\_repair\" directory

If I'm not mistaken the file in the repair folder are user and passwd at fresh install. When they (i.e. username and passwd) are changed, the content of the file will be useless, obviously.

registry and sam

You can bott with a bootdisk like CIA Commander and then copy the SAM and SYSTEM file to the floppydisk. The SAM is in C:\Winnt\system32\config\
Then you can crack it with SamInside if it's SYSKEY encrypted, if not, you can also use LC4 but I'd SamInside.

Hey,

Heres the tool SAMINSIDE

Download it

Manu

^SAM^

LM hashes

hi, could somebody tell me where i can find it in the registry ? i found the other two, but not in the registry..

the only thing i found is in hkey_local_machine/system/services/samss/security
and i don't think it's that..

why not use pwdump2 once you are on the machine ... you dont need a reboot or a boot disk to get SAM file and NT accounts

Edit : sorry forgot the link

hxxp://razor.bindview.com/tools/desc/pwdump2_readme.html

The Usernames and Passwords are stored under c:\winnt\system32\config

Here is a very good yet simple to use program. Its DOS based, but there are no complicated functions.Passwords are retrieved in a short amount of time... even complex passwords.

So enjoy.

Here is a download link.....

http://www.freewebs.com/win2khacking/johntheripper.zip

Its called John the Ripper...

hehe , the well known john

i have it on my knoppix std.. but haven't finished the manual yet, cauz there are (too) many options , and in command line, it's not the same

i tried to crack my win password with LoPHT, but after several days, he still didn't found anything, except a disabled user account... is it due to a bad wordlist or a thing like that? there are special characters in the password.

i'll give johhny a try

tx