Crack and Reset the system password locally using Kali linux

Hi folks,  For today  post  i will show you how to crack and reset password at times when you forget it or when you want to gain access to a computer for which you do not know the password. there are tons of tools available to crack password, but i am going to use most popular cracking tools that are defaultly available in kali linux.

 

Download Kali Linux and burn the ISO to a CD/DVD or USB.

 

Creating a bootable Kali Linux USB key in a Linux environment is easy. Once you’ve downloaded your Kali ISO file, you can use dd to copy it over to your USB stick as follows.

Plug in your USB device to your Linux computer’s USB port.

Verify the device path of your USB storage with dmesg.

Proceed to (carefully!) image the Kali ISO file on the USB device:

 

#dd if=kali.iso of=/dev/sdb bs=512k

 

Creating a bootable Kali Linux USB key in a WIndows environment, follow by past tutorial here

 

Insert the USB Live CD and Boot your PC. Make sure the Boot from USB is the first option in the Boot menu at BIOS.

 

Boot Windows machine with the LiveCD. On the boot menu of Kali Linux, select Live (forensic mode). Kali Linux initialize and when it loads, it will open a terminal window and navigate to the Windows password database file

 

 

 

Crack the Windows password with ophcrack:

 

After loading Live kali linux  go to the system menu  > ophcrack click ok

 

Ophcrack  uses Rainbow Tables to crack NTLM and LM hashes into plain text, its a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. If you have a complex password it will take a lot longer than simple passwords, and with the free tables your password may never be cracked.

 

Once the crack is done you will see the password in plain text, write it down and reboot the machine to login. If your password isn’t cracked, you can also log in as one of the other users with admin rights and then change your password from within Windows.

 

With the free tables available you will not be able to crack every password, but the paid tables range from $100 to $1000.Windows uses NTLM hashes to encrypt the password file which gets stored in SAM file. We simply need to target this file to retrieve the password

 

Now you can see the ophcrack application windows. Here, click on Load > Encrypted SAM

 

After that we need to give the path to SAM directory which is by default /mnt/hda1/WINDOWS/System32 click choose

 

 

Here we can see the saved hashed now with the username and userid.

 

 

Now click on Crack button and wait for the password. Its quick and easy

 

 

That’s it. It’ll show the password , if you unsuccessfully go with free tables.  I downloaded the xp free small and the Vista free tables. Once you have downloaded the tables you will need to unzip them in separate folders. I made a folder called “hash-tables” and then made 2 more folders within for each table to unzip to.

 

Run the program and click on “Tables” button. Select the table you downloaded and click “Install”, navigate to the folder where you unzipped the table, select it and then click “ok.” You should see green lights next to the tables you installed.

 

 

 

 

 

 

Reset Windows password with chntpw:

 

Navigate to the Windows password database file. Almost all versions of windows password is saved in SAM file. This file is usually located under /Windows/System32/config. On your system it may look something like this: /media/hda1/Windows/System32/config.

 

The SAM database is usually in the /media/name_of_hard_drive/Windows/System32/config

 

Type command chntpw -l SAM and it will list out all the usernames that are contained on the Windows system.

 

#chntpw -l   SAM

The command gives us a list of usernames on the system. When we have the username we want to modify and we simply run the command chntpw -u “username” SAM

 

 

 

In the example below we typed: chntpw -u “Sanjai sathish” SAM and we get the following menu:

#chntpw -u Sanjai sathish

 

 

We now have the option of clearing the password, changing the password, or promoting the user to administrator. Changing the password does not always work on Windows 7,8 systems. it may works on XP system, so it is recommended to clear the password. Therefore you will be able to log in with a blank password. You can also promote the user to a local administrator as well.

 

 

 

Crack the password in Linux using John the ripper:

 

John the Ripper is a fast password cracker, Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version

 

John the ripper is a popular dictionary based password cracking tool. It uses a wordlist full of passwords and then tries to crack a given password hash using each of the password from the wordlist. In other words its called brute force password cracking and is the most basic form of password cracking. It is also the most time and cpu consuming technique. More the passwords to try, more the time required.

 

But still if you want to crack a password locally on your system then john is one of the good tools to try. John is in the top 10 security tools in Kali linux.

 

In this topic i am going to show you, how to use the unshadow command along with john to crack the password of users on a linux system. On linux the username/password details are stored in the following 2 files

 

#/etc/passwd

#/etc/shadow

 

The actual password hash is stored in /etc/shadow and this file is accessible on with root access to the machine. So try to get this file from your own linux system. Or first create a new user with a simple password. I will create a new user on my linux system named happy, with password chess.

 

Now that our new user is already created its time to crack his password.

 

#unshadow

 

The unshadow command will basically combine the data of /etc/passwd and /etc/shadow to create 1 file with username and password details. Usage is quite simple.

 

#unshadow /etc/passwd /etc/shadow > ~/crack

 

We redirected the output of unshadow command to a new file called crack.

 

Now this new file shall be cracked by john. For the wordlist we shall be using the password list that comes with john on kali linux. It is located at the following path /usr/share/john/password.lst or you can use your own password lists too.

 

#john –wordlist=/usr/share/john/password.lst ~/crack

Use the “–show” option to display all of the cracked passwords reliably

 

 

So in the above command john was able to crack the hash and get us the password “chess” for the user “happy”. Now john was able to crack, only because the password “chess” was present in the password list. If it were not there then john would have failed.

 

Use the show option to list all the cracked passwords.

 

#john –show ~/crack