Where Does Windows Xp Store Its Passwords ?

Scribe

Aug 3 2005, 04:24 PM

Is thre a file where password information is kept in windows XP? If so what is it's name and where is it located?

BabyTux

Aug 3 2005, 11:25 PM

Yes. The files are "C:\WINDOWS\system32\config\SAM" and "C:\WINDOWS\system32\config\SYSTEM" (suppose you installed your Windows under C:\WINDOWS).

Comment/Reply (w/o sign-up)

qwijibow

Aug 4 2005, 12:03 AM

WindowsXP doesnt actually store passwords, it uses a destructive algorithm called MD4 to create a hash ( a fingerprint ) or the passwords ( in the files reported by BabyTux ).

So you cant just read them. However they can easily be brute forced, WindowsXP converts all login passwords to UpperCase before hashing (which is pretty stupid, it halfs the securety)

Make sure your passwords are 7 character or longer, and are not made up of dictionary words.

Comment/Reply (w/o sign-up)

tansqrx

Aug 4 2005, 08:22 PM

The password hashes are in binary format and will not do you much good to just read them. Go get L0phtCrack from http://www.atstake.com/ to be able dump the password hashes and run a simple dictionary attack on the hashes. Another method involves a time/memory trade-off called rainbow tables. See RainbowCrack at http://www.antsight.com/zsl/rainbowcrack/. This does take some effort as the tables take a large amount of disk space (about 20-30 Gb for alphanumeric, some special characters) and you will have to go through the trouble of downloading them. I found a nice fast source on Bit Torrent and had them in a matter of a few days.

If you are just fishing for information also grab Cain and Able at www.oxid.it/cain.html. Windows has its own secret storage area that saves such things as dial-up passwords and IE saved passwords. It might be worth a shot to see if anything is in the secrets. The secrets are not well protected and you can dump them without any waiting or cracking.

More information can be found on this subject at http://www.windowsecurity.com/articles/Pro...-Passwords.html

Comment/Reply (w/o sign-up)

FeedBacker

Jan 16 2008, 07:36 AM

Respected SIr,

My query is that When we create password like in file (.Doc,.Exl),IE,Administrator etc. That are stored any perticular path in window. But I don't know. Could you help How to crack password without using any software.

Regards
Alok

-Alok

Comment/Reply (w/o sign-up)

yordan

Feb 10 2008, 06:22 PM

QUOTE(FeedBacker @ Jan 16 2008, 08:36 AM)

Two things Alok.
1) Your question is not fully clear, probably. I'm pretty sure that if you crete a password-protected .doc or .xls file, the password protection is inside the file.
2) password cracking is against our rules. Here we talk only about fully legit items. If an admin put a password on a file, you have to ask the admin to give you the password. If this file was yours and you forgot your own password, too bad, next time you will remember it. But teaching crackig techniques will never be allowed here.

Comment/Reply (w/o sign-up)

FeedBacker

Feb 26 2008, 09:38 PM

Windows XP \\\"Remembered\\\" passwords
Where Does Windows Xp Store Its Passwords ?

Using Norton Password Manager, I can delete 'remembered" passwords used for websites, programs, etc. How can I un-remember a password "remembered" by XP? Often when I go to a new website that requires a password, Norton Pass/mgr pops up and asks if I want it to remember the password I just entered. Sometimes XP or Internet Explorer, not sure which has its own popup asking the same thing. I usually ignor the XP popup but now I want to unremember a password that XP has stored somewhere and delete it. Any ideas?

-question by Dennis

Comment/Reply (w/o sign-up)

mastercomputers

Feb 27 2008, 07:41 AM

XP also uses Passport.NET to store remembered passwords, whether this is what is being remembered or not, I don't know, but if you go into Users Account in Control Panel you can remove stored passwords from there.

Cheers,

MC

Comment/Reply (w/o sign-up)

Jimmy89

Feb 27 2008, 11:45 AM

QUOTE(tansqrx @ Aug 5 2005, 07:22 AM)

Another method involves a time/memory trade-off called rainbow tables. See RainbowCrack at http://www.antsight.com/zsl/rainbowcrack/. This does take some effort as the tables take a large amount of disk space (about 20-30 Gb for alphanumeric, some special characters) and you will have to go through the trouble of downloading them. I found a nice fast source on Bit Torrent and had them in a matter of a few days.

You can actually generate your own rainbow tables, specifying what characters, numbers, symbols that you want to include. This would mean you don't actually have to download the rainbow tables.

Comment/Reply (w/o sign-up)

FeedBacker

May 13 2008, 06:21 PM

Copying the SAM and SYSTEM
Where Does Windows Xp Store Its Passwords ?

How can I copy the SAM and SYSTEM files in
C:\WINDOWS\system32\config\SAM" and "C:\WINDOWS\system32\config\SYSTEM

It says being used by another program, and wont let me copy it. Any ideas?

Cain & Able is a great program but the brute force attack takes a while

Thanks

-question by nightmagic

Comment/Reply (w/o sign-up)

Latest Entries

iGuest

Jan 25 2010, 02:14 PM

password path
Where Does Windows Xp Store Its Passwords ?

But where is the path for that to remove the password

-reply by SUNIL

Comment/Reply (w/o sign-up)

iGuest

Jan 19 2010, 02:30 PM

what happens if the SAM files in the location described are deleted BabyTux?

Comment/Reply (w/o sign-up)

iGuest

Jan 6 2010, 04:50 AM

how can change windows xp password from SAM?

Comment/Reply (w/o sign-up)

iGuest

Aug 20 2009, 12:22 PM

Getting access to password locked profile
Where Does Windows Xp Store Its Passwords ?

in response to

--------------------------

xp access through usb hard drive...Bypass login

My old drive was password protected on login...I have tried a IDE to Serieal converter...But something in the registry is really bad and Windows will not recover or reload. With the converter I have access To all my shared files and pictures...And have transfered them to the New drive. But my user files, that were under the password protected Login I can not access.

-question by james

-------------------------------------------------

While your profile may be locked from a password the files are not actually locked. Unfortunately Windows does not want to allow you (even the administrator) to access user files that have a password attached to them.

Linux on the other hand could care less if you password your files. I personally use mac for my hard drive recovery. MacFuse will allow you to read and write the ntfs or fat32 files and recover them to whatever medium you are interested in.

Alternatively if you lose your root access on a linux or mac machine. Windows will walk through its security too... However if you are savvy you can fix a mac or linux machine with itself... Windows is not so simple.

-reply by Volure DarkAngel

Comment/Reply (w/o sign-up)

iGuest

Aug 13 2009, 12:22 AM

xp access through usb hard drive...bypass login
Where Does Windows Xp Store Its Passwords ?

I had a hard drive crash? virus? Anyhow it was an excuse to build a new machine. My new mother board would not accept IDE hard drives...So I bought two new serieal drives. Now to my question.

My old drive was password protected on login...I have tried a IDE to serieal converter...But something in the registry is really bad and windows will not recover or reload. With the converter I have access to all my shared files and pictures...And have transfered them to the new drive. But my user files, that were under the password protected login I can not access. Is there a was to drop the password from this file so I can pull the files I need(I know the password) Mind you I can not load or log into this installation of windows , reading drive as a mass storage USB device.

-question by james

Comment/Reply (w/o sign-up)