Where does Windows (xp) store its users passwords?

[spyordie007]

My mistake, I misread your post. I have no idea what they mean by that statement (it's from the MS KB article).

FYI AFAIK they've dropped LM Hashing support from Vista (finally), so under Vista this should be a non-issue.

-Erik

 

[spyordie007]

Found this interesting article relevant to our discussion:
http://www.securityfriday.com/Topics/win2k_passwd.html

When you adjust your password to 15 characters or more, the string for the LM authentication becomes a constant value, "aad3b435b51404eeaad3b435b51404ee". This implies that the password is null.

So the MS KB article is a bit misleading in that it "sets a value"; in really the value that is getting set is NULL...

 

[Nothinman]

In who's mind does aad3b435b51404eeaad3b435b51404ee equal null?

 

[gsellis]

And why crack it if you can reset it. There are tools as stated by other posters. And for those that complain that this is not secure, the first rule is deny physical access or nothing is secure.

 

[spyordie007]

Originally posted by: Nothinman
In who's mind does aad3b435b51404eeaad3b435b51404ee equal null?

That's the hash that gets generated if you enter a null password.

And why crack it if you can reset it.

True, this is why you would want to also disable the account and (if possible) use restricted groups in a GPO.

And for those that complain that this is not secure, the first rule is deny physical access or nothing is secure.

:thumbsup:

 

[drag]

Window's password security is 'ok'. It's very possible to crack it.

You have 2 choices:
1. Just reset the administrative password. This is very simple and can be done from many 'livecd'.

Hell, If you just delete the file it'll get what you want. If you delete or move the SAM file you can then log into the machine with no password. Then after your finished you can copy the file back to it's original location to restore the original passwords.

2. Also you can just get a SAM file editor and change the passwords that way.

The downside for that, I beleive, is that if your trying to access a encrypted file system it's not going to help you. In fact you can possibly lock yourself out forever. Also for a cracker it will instantly alert the administator to their precense.

3. Brute force the password.

What the article is trying to say about the 'LM' hash (lanmanager) is that if you use passwords over 15 characters it disables it. aad3b435b51404eeaad3b435b51404ee probably equals the 'null' character in encrypted form which equals "Don't Use". That A cracker then can't use the LM stuff to get a easy password.

LM is paticularly weak. Passwords are stored in 7 character hunks. They are stored with case insensitivity and they are stored with no salt.

So the worst case you'd have to find 7 characters and case doesn't matter. You can probably obtain a 'ranbow table', which is a list of every single possible password combinations for a paticular password encryption system. If you have a decent computer then it won't take long to extract working passwords.

LM hashes are actually stored in the SAM file. The other hash that is used is the NT hash. These are much more difficult to crack, but it's still very possible. I don't think it uses salt either so you can probably find a ranbow table for that also.

If you want more details about how the hashes works and how to defeat them then you can check out Episode 43 of Twat radio.
http://www.twatech.org/index.php It'll go into details about it.

The same guy that did that radio has information on auditing Active Directory passwords from cache http://www.irongeek.com/i.php?page=security/cachecrack

And how to defend yourself from this sort of thing.
http://www.irongeek.com/i.php?page=security/campussec05

 

[Nothinman]

Hell, If you just delete the file it'll get what you want. If you delete or move the SAM file you can then log into the machine with no password. Then after your finished you can copy the file back to it's original location to restore the original passwords.

I think that stopped working when Win2K was released, but I haven't verified that.

 

[P0ldy]

Originally posted by: rmrf

Originally posted by: Nothinman

"Method 3: Use a Password That Is at Least 15 Characters Long
The simplest way to prevent Windows from storing an LM hash of your password is to use a password that is at least 15 characters long. In this case, Windows stores an LM hash value that cannot be used to authenticate the user."

If that's true, why do they store anything at all?

ditto.

Yes, it's basically just legacy work from 98, 95, and 3.1. You can disable it in the registry, but obviously it shouldn't even be there in the first place.

 

[spyordie007]

Window's password security is 'ok'. It's very possible to crack it.

Pretty much any system you have physical access to is "very possible to crack"

Of course this will change some in Vista, with the "secure startup" (or whatever they are calling it this month). Basically encrypting the entire hard drive so it would be much harder to mount this type of attack.