Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.


I am looking for good informations about how windows handles the passwords of its users:

  • Which algorithms are used (which hash, do they use salt, ...)
  • Where are the passwords stored
  • Are there known exploits?

Especially interesting are Windows XP, Vista and 7.

I was not able to find useful infos with google, most pages are talking about resetting or cracking tools, but I am interested in the theory.

share|improve this question
1  
NTLM, LM hash, Kerberos. Looking up those things should give you some insight, I think. –  Joey Mar 10 '10 at 13:15
add comment

1 Answer 1

up vote 13 down vote accepted

Which algorithms are used (which hash, do they use salt, ...)

Two hashes are stored: LM hash for LanMan, and a MD4 hash (also called "NT hash") for NTLM.

Only the MD4 hash is normally used. It is not salted, since the SAM database is only accessible to the Administrators group and to NT AUTHORITY\SYSTEM internal account.

The LM hash is only stored for compatibility reasons. (See paragraph below.) It is very insecure (its history starts with OS/2 and MS-DOS), and crackable in (I think) minutes. Windows only uses it when logging in to old servers; however, if stored it can be extracted with a LiveCD or such.

In Windows 7, storing of LM hashes is disabled. In earlier releases you can disable it manually in security policies (secpol.msc → Local Policies → Security Options → Network Security: Do not store LAN Manager hash).


Where are the passwords stored?

Security Accounts Manager database - a part of Registry, stored under %SystemRoot%\system32\config\.

Since Windows 2000, the SAM database is additionally encrypted by default. <afaik> The key is scattered all over the (same) registry file, but is still recoverable. </afaik> But if you want, you can move the encryption key to a floppy drive, or to use an additional password. (You will be asked for it on boot.) This is done using SYSKEY (syskey.exe)

(SYSKEY support was added in NT 4.0 SP3, but disabled by default until W2000.)


Are there known exploits?

Cracking LM hashes? More than you can imagine. MD4 seems to be more secure, but be sure to read that Wikipedia article.


On Windows 9x series - don't expect anything better than ROT26.

share|improve this answer
1  
Great answer with lots of useful links ... I heard today that windows xp passwords can be cracked in a few minutes - that's why I asked. I thought they are saved with SHA1/2 + salt, so I just couldn't imagine how to crack them within minutes ... but your answer explains all ... thank you –  tanascius Mar 10 '10 at 15:09
    
Great answer for DOS, Win9x,Win2K, but I don't understand where's the WinXP,7,8:) –  SEARAS Oct 27 '12 at 19:35
    
@SEARAS: So far, all Windows NT series operating systems (NT 4.0, 2000, XP, Server 2003, 7, Server 2008, 8) use the same SAM. (The only difference is that Win7 and newer versions stopped storing the LM hash.) –  grawity Oct 27 '12 at 19:38
    
@grawity , OK, thanks –  SEARAS Oct 27 '12 at 20:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.