0

I am able to log into my Windows 7 machine as admin and am interested in recovering past passwords for the accounts on my laptop. Is there an easy way to do this, or would it still require cracking the hash with rainbow tables?

2 Answers 2

1

Windows does not store passwords. Only hashes. So whether or not you have any stored past passwords you can not recover them as text from Windows. Only the hash.

1
  • Pity. Guess it's the hard way then.
    – Alex
    Jun 13, 2013 at 4:47
0

All of your account's passwords stored into a file that called SAM,The Security Accounts Manager (SAM) file in Windows XP, Windows Vista and Windows 7 stores users' passwords in a hashed format (in LM hash and NTLM hash). Since a hash function is one-way, this provides some measure of security for the storage of the passwords.

In an attempt to improve the security of the SAM database against offline software cracking, Microsoft introduced the SYSKEY function in Windows NT 4.0. When SYSKEY is enabled, the on-disk copy of the SAM file is partially encrypted, so that the password hash values for all local accounts stored in the SAM are encrypted with a key (usually also referred to as the "SYSKEY").

In the case of online attacks, it is not possible to simply copy the SAM file to another location. The SAM file cannot be moved or copied while Windows is running, since the Windows kernel obtains and keeps an exclusive filesystem lock on the SAM file, and will not release that lock until the operating system has shut down or a "Blue Screen of Death" exception has been thrown. However, the in-memory copy of the contents of the SAM can be dumped using various techniques (including pwdump), making the password hashes available for offline brute-force attack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .