3

In the past I have cracked Windows passwords with a Live Linux disk and navigating to the SAM file. In windows 10 it seems this information is stored on the cloud. Is there a way to find this locally on the machine?

1 Answer 1

7

The SAM hive still exists in Windows 10, and it's in the same place. For local non-Microsoft accounts, the format does not appear to have changed; the NTLM hash is still the 16 bytes before the last 8 bytes of the V value.

For accounts that sign in with a Microsoft account password, the CachedLogonInfo value contains the cached password (source). Unfortunately, it's not just an NTLM hash, so normal Windows hash cracking tools won't work on it. If that page is correct and the algorithm is indeed much stronger - which would make sense, since it would be very bad if an MS account password could be retrieved from a workstation - then cracking it would take an extremely long time considering the complexity requirements Microsoft puts in place.

3
  • Thanks for the source it was great and mostly what I was looking for. I possibly should have rephrased my question. Instead of cracking if I were to just delete the cached credentials would it unlock the system?
    – Joe
    Feb 16, 2017 at 18:56
  • 1
    @Joe I suspect that there's some other bookkeeping that identifies it as a Microsoft account. If you just need to get into the machine, you might use something like this approach to create a new administrative user.
    – Ben N
    Feb 16, 2017 at 19:14
  • Thanks again. I have seen that method before definitely a neat trick.
    – Joe
    Feb 19, 2017 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.