john-users - obtaining password hashes off Windows systems

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall Wordlists CD (20+ languages) with delivery worldwide or download

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 17 May 2006 21:10:17 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: obtaining password hashes off Windows systems

> santosh choudhary wrote:
> > can you tell whitch are the password files of windows xp,please?
> > thank you.

On Wed, May 17, 2006 at 06:24:03PM +0400, xnix wrote:
> system32/config/sam
> system32/config/system

I'm afraid that this answer is of little help since John the Ripper does
not process those files directly.  Instead, one of the pwdump tools
should be used to dump the password hashes in a format directly usable
with John:

	http://www.openwall.com/passwords/pwdump

Most of the time, pwdump2 will be sufficient.

A more extensive collection of pwdump-like and related tools is
available in this FTP directory:

	ftp://ftp.openwall.com/pub/projects/john/contrib/win32/pwdump/

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar