mirror of
https://github.com/rescatux/chntpw
synced 2026-06-21 14:07:44 +00:00
Adrian Gibanel Lopez
208 lines
6.7 KiB
Plaintext
208 lines
6.7 KiB
Plaintext
|
|
The Offline Windows Password Editor
|
|
|
|
(c) 1997-2014 Petter Nordahl-Hagen
|
|
|
|
This is free software, licensed under the following:
|
|
|
|
"ntreg" (the registry library) and
|
|
"libsam" (SAM manipulation library, user, groups etc)
|
|
is licensed under the GNU Lesser Public License. See LGPL.txt.
|
|
|
|
"chntpw" (the password reset / registry editor frontend)
|
|
"reged" (registry editor, export and import tool)
|
|
"sampasswd" (password reset command line program)
|
|
"samusrgrp" (user and group command line program)
|
|
is licensed under the GNU General Public License, see GPL.txt.
|
|
|
|
|
|
For manual to the different commands, see MANUAL.txt
|
|
Also, all have some help built in, just use the -h option.
|
|
|
|
See INSTALL.txt for compile instructions.
|
|
|
|
|
|
Where to get more info:
|
|
-----------------------
|
|
|
|
http://pogostick.net/~pnh/ntpasswd/
|
|
|
|
At that site there's a floppy and a bootable CD that use chntpw to
|
|
access the NT/2k/XP/Vista/Win7/Win8 system it is booted on to edit password etc.
|
|
The instructions below are for the standalone program itself, not the floppy.
|
|
|
|
What does chntpw do?
|
|
--------------------
|
|
|
|
This little program will enable you to view some information and
|
|
change user passwords, change user/group memberships
|
|
in a Windows (NT/XP/Vista/win7/win8) etc SAM userdatabase file.
|
|
You do not need to know the old passwords.
|
|
However, you need to get at the registry files some way or another yourself.
|
|
In addition it contains a simple registry editor with full write support,
|
|
and hex-editor which enables you to
|
|
fiddle around with bits&bytes in the file as you wish yourself.
|
|
|
|
Also have registry import or export
|
|
-----------------------------------
|
|
|
|
"reged" is a program that can do import and export of .reg files into
|
|
the registry hive (binary) files. Also has an editor, but still
|
|
rudimentary text based command line type thing.
|
|
|
|
And by popular request
|
|
Even have programs that can be used in scripts!
|
|
-----------------------------------------------
|
|
"sampasswd" can be used in scripts to get lists
|
|
of users or reset passwords automatically
|
|
"samusrgrp" can be used in scripts to list or change
|
|
memberships in groups automatically.
|
|
|
|
|
|
|
|
Why?
|
|
----
|
|
|
|
I often forget passwords. Especially on test installations (that
|
|
I just _must_ have some stuff out of half a year later..)
|
|
On most unix-based boxes you just boot the thingy off some kind
|
|
of rescue bootmedia (cd/floppy etc), and simply edit the
|
|
password file.
|
|
On Windows however, as far as I know, there is no way except reinstalling
|
|
the userdatabase, losing all users except admin.
|
|
(ok, some companies let you pay lotsa $$$$$ for some rescue service..)
|
|
(ok, from Windows Vista or something you can make a password reset
|
|
file, but you have to remember to do that BEFORE you forget your password...)
|
|
|
|
How?
|
|
----
|
|
|
|
Currently, this thing only runs under linux, but it may just happen
|
|
to compile on other platforms, too.
|
|
|
|
So, to set a new adminpassword on your Windows installation you either:
|
|
|
|
1) Take the harddrive and mount it on a linux-box
|
|
|
|
or
|
|
|
|
2) Boot a "live" linux CD with full GUI (many available: Ubuntu,
|
|
Knoppix and more. Search for them)
|
|
|
|
In both those cases, use the "chntpw.static" program found in the
|
|
"static" zip file on my website.
|
|
or
|
|
|
|
3) Use my linux boot CD (or USB) at: http://pogostick.net/~pnh/ntpasswd/
|
|
|
|
Usage:
|
|
------
|
|
|
|
For manual to the different commands, see MANUAL.txt
|
|
Also, all have some help built in, just use the -h option.
|
|
|
|
Some old tech babble on how the password is stored
|
|
--------------------------------------------------
|
|
(still mostly valid, but should be moved somewhere else than this file)
|
|
|
|
|
|
A struct, called the V value of a key in the NT registry
|
|
was suddenly somewhat documented through the pwdump utility
|
|
included in the unix Samba distribution.
|
|
This struct contains some info on a user of the NT machine,
|
|
along with 2 crypted versions of the password associated
|
|
with the account.
|
|
|
|
One password is the NT console login password,
|
|
the other the LANMAN network share password
|
|
(which essentially is the first one in uppercase only,
|
|
and no unicode)
|
|
|
|
This is how NT encrypts the passwords:
|
|
|
|
The logon cleartext password a user enters is:
|
|
1) Converted to unicode
|
|
2) A MD4 hash is made out of the unicode string
|
|
3) Then the hash is crypted with DES, using the RID (lower
|
|
part of the SID, userid) as the crypt key.
|
|
This is the so called "obfuscation" step, so
|
|
it's not obvious on a hex dump of the file
|
|
that two or more users have the same password.
|
|
4) The result of stage 3 (16 bytes) is put into the V struct.
|
|
|
|
For the LANMAN password:
|
|
1) Uppercased (and illegal characters probably removed)
|
|
14 bytes max, if less the remaining bytes are zeroed.
|
|
2) A known (constant) string is DES-encrypted
|
|
using 7 first characters of the password as the key.
|
|
Another constant is encrypted using the last 7 chars
|
|
as the key.
|
|
The result of these two crypts are simply appended,
|
|
resulting in a 16 byte string.
|
|
3) The same obfuscation DES stage as 3 above.
|
|
4) 16 bytes result put into the V struct.
|
|
|
|
Since the number of possible combinations in the lanman
|
|
password is relatively low compared to the other one,
|
|
and it's easy to see if it's shorter than 8 chars or not
|
|
it's used first in brute-force-crackers.
|
|
|
|
This program, however, don't care at all what the old
|
|
one is, it just overwrites it with the new one.
|
|
|
|
Ok. So, how do we find and identify the V struct?
|
|
Yeah.. that was the hard part.. The files structure
|
|
is not documented (as far as I know..)
|
|
|
|
But, with help from an unnamed German, and a lot of testing
|
|
and guesswork from myself, it's now possible to follow
|
|
the actual registry tree. (see source code for struct-defines
|
|
and comments on the registry structure)
|
|
|
|
The usernames are listed in:
|
|
\SAM\Domains\Account\Users\Names\
|
|
|
|
[2d18] \SAM\Domains\Account\Users\Names> l
|
|
ls of node at offset 0x2d1c
|
|
Node has 4 subkeys and 1 values
|
|
nk-offset name
|
|
0x003290 - <Administrator>
|
|
0x003630 - <Guest>
|
|
0x001c88 - <luser>
|
|
0x003428 - <pnh>
|
|
|
|
Each name is a subkey, with one namless value containing
|
|
the RID.
|
|
|
|
[2d18] \SAM\Domains\Account\Users\Names> cd pnh
|
|
|
|
[3428] \SAM\Domains\Account\Users\Names\pnh> l
|
|
ls of node at offset 0x342c
|
|
Node has 0 subkeys and 1 values
|
|
vk-offs size type name
|
|
0x003688 0 (unknown) <> INLINE: val (in type field?): 1000 (0x3e8)
|
|
|
|
To get the userinfo (V struct), access
|
|
\SAM\Domains\Account\Users\<RID>\V
|
|
|
|
[2c90] \SAM\Domains\Account\Users> l
|
|
ls of node at offset 0x2c94
|
|
Node has 5 subkeys and 1 values
|
|
nk-offset name
|
|
0x003320 - <000001F4>
|
|
0x0036b8 - <000001F5>
|
|
0x003550 - <000003E8>
|
|
0x001d00 - <000003E9>
|
|
0x002d18 - <Names>
|
|
|
|
[2c90] \SAM\Domains\Account\Users> cd 000003E8
|
|
|
|
[3550] \SAM\Domains\Account\Users\000003E8> l
|
|
ls of node at offset 0x3554
|
|
Node has 0 subkeys and 2 values
|
|
vk-offs size type name
|
|
0x0035a8 80 REG_BINARY <F>
|
|
0x003228 508 REG_BINARY <V>
|
|
|
|
For more techincal info, look it up in the source code.
|