Cracking a windows password based security

In my previous post here, I talked about how hard it is to trust the cyber space in which our most valuable information passes through. Well today I wish to be the devil’s advocate and show you how to crack a window based password security. Don’t get me wrong but there are numerous situations which will warrant the need to have the password cracked but if security is you hobby then doing what we call professional hacking might be your excuse.

So what do you need? Below is a list of the tool you will need.

1.    A Linux based operating system, preferably on a CD/DVD.(I use Ubuntu)

2.    A windows password file reset tool.

3.    Another windows machine which you have access to.

4.    You attention might be a useful tool too. J

Before we start its important to note that in dual boot systems, usually the Linux based system such as ubuntu can access a windows file system and that will be the basis of our password cracking.

The next thing to know is that windows passwords are stored in a file called SAM which is found in the directory

C:\WINDOWS\SYSTEM32\CONFIG\

1.    Shutdown down your machine.

2.    Boot from the Ubuntu CD (or whatever similar based Linux variant you have).

3.    When its fully boots access the folder in the path above then copy the  file named SAM.

4.    Now go back to the other windows machine and paste the SAM file wherever probably on the desktop.

5.    Run the password file reset tool which can be downloaded from here.

Note that there are multiple password reset tool some which a free with other being proprietary.

From the screenshot above, it’s clear what you need to do. Select the location of the SAM file then click (RE) open.

It will list all the user account available in the machine and then when you click on an account the unlock or change password button will be activated. Play around to fit your needs.

6.    Exit from the tool and confirm that the file has been edited by right clicking then going to properties.

7.    Copy the file from where you got it from.

We are done and your password have been either changed or completely removed.

How to configure an SSL powered virtual host using XAMPP in windows and generating/self signing an SSL certificate

The month of February is a month of love. This is the month when most of the chocolate establishments make have their revenues. Now talking about love, love is one thing that is based on trust. You cannot have the later without the former. However nobody and especially those responsible for enterprise applications can afford the luxury of trusting the paths in which the valued information passes. 

Let’s try to understand what am talking about. Most  systems are web based and even more now that as I said in an earlier post the word cloud no longer means the  sign of  rain. Now when a company employee uses a web browser to  access the company system  then they are trying to request data from a remote server. This will involve the initial login which involves passing the username and password. The browser will encrypt the password for you but after that all that information that is passed along is open to tapping by a person with the right tools usually called the Adversary or simply the hacker.

Inorder to make sure that this does not happen , we need to encrypt all the requests coming from the client and decrypt them at the server and viceversa.  This involves creating a host which supports communication over the protocol : https.

1.    We start this procedure by editing the httpd-vhosts.conf found at the path xampp\apache\conf\extra.

Delete the scripts you have now from the previous post and replace with the one below.

<VirtualHost www.thetaitanstore.com:443>

    ServerAdmin admin@thetaitanstore.com

    DocumentRoot "D:\Virtual Sites hosted here\thetaitanstore"

    ServerName www.thetaitanstore.com

    ServerAlias thetaitanstore.com

    SSLEngine on

    SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

    SSLCertificateFile "C:\xampp\apache\conf\ssl.crt\server.crt"

    SSLCertificateKeyFile  "C:\xampp\apache\conf\ssl.key\server.key"

    CustomLog "D:\Virtual Sites hosted here\thetaitanstore\logs\access" common

<Directory />

           Options FollowSymLinks

           AllowOverride None

</Directory>

<Directory "D:\Virtual Sites hosted here\thetaitanstore">

           Options Indexes FollowSymLinks MultiViews

           AllowOverride FileInfo

           Order allow,deny

           allow from all

</Directory>

</VirtualHost>

Note that the SSL communications are now being done through port 443 as opposed to port 80.

The script above shows that we have a private key file and a public key file. These are contained in the SSL certificates for authentication purposes. So now let’s go on and generate our own SSL certificate.

2.      Create SSL Certificate and Server Private Key

In order to enable the encryption of your password, you must create an SSL certificiate (containing your public key) and a server private key. XAMPP provides a default certificate/key that can be used, but it is better to create a new one since the default key is available to anyone who downloads XAMPP. If someone knows your key, they can decrypt your packets.

XAMPP provides a batch file for creating a new certificate/key with random encryption keys. To execute this batch file, do the following:

1. Open a command window (Start->Run, type “cmd” and press “OK)
2. cd c:\xampp\apache
3. makecert

You will then see this:

C:\xampp\apache>newcert

Loading 'screen' into random state - done

Generating a 1024 bit RSA private key

............................++++++

.....................................++++++

writing new private key to 'privkey.pem'

Enter PEM pass phrase:

Enter in a pass phrase for decrypting your private server key, and press Enter. Write down this passphrase so you don’t forget it. Now you will be asked to verify it:

Verifying - Enter PEM pass phrase:

Enter your passphrase a second time and hit Enter. Now, you’ll see this:

-----

You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blank.

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:

Enter in your 2 letter country code. You’ll be asked for a few more items (shown below). Enter is what you think is most appropriate, but stop when you are asked for “Common Name”

State or Province Name (full name) [Some-State]:KE

Locality Name (eg, city) []:NAIROBI

Organization Name (eg, company) [CREATIVE COMMONS]: THE TAITAN STORE

Organizational Unit Name (eg, section) []:

Common Name (eg, YOUR name) []:www.thetaitanstore.com

For “Common Name”, you need to enter in the DNS name or IP address of your website. The name that you enter in here will need to match the server name that is entered into the browser that is accessing the page. It is important that this common name match the address that goes into a browser, otherwise you will get extra warnings when navigating to your secure web pages. If you are running this website over the public internet on an IP address that changes sometimes, you can use a Dynamic DNS service such as dyndns.org to get a free domain name that always points to your server. After you enter in the “Common Name”, you are asked for more information. Fill in what you think is appropriate, but it is OK to just hit ENTER to accept the defaults. Eventually, you will be asked for the pass phrase for privkey.pem:

Email Address []:

Please enter the following 'extra' attributesto be sent with your certificate request

A challenge password []:

An optional company name []:

Enter pass phrase for privkey.pem:

4.      Enter the pass phrase that you created earlier, and now you will see this:

writing RSA key

Loading 'screen' into random state - done

Signature ok

subject=/C=xx/ST=xx/L=xxxx/O=xxx/CN=commonname

Getting Private key

—–

Das Zertifikat wurde erstellt.

The certificate was provided.

Press any key to continue . . .

C:\xampp\apache>

You are now finished creating your SSL certificate and private key. The makecert.bat script will move your server private key and certificates in the appropriate directories for you.

3.    Remember to restart Apache for the configuration changes to take effect.

            Now you have your fully configured SSL powered virtual host.