{"id":886,"date":"2017-01-04T15:07:22","date_gmt":"2017-01-04T12:07:22","guid":{"rendered":"http:\/\/decrypthash.ru\/en\/?page_id=886"},"modified":"2017-01-04T15:19:26","modified_gmt":"2017-01-04T12:19:26","slug":"restore-windows-password","status":"publish","type":"page","link":"https:\/\/decrypthash.ru\/en\/articles-and-help\/restore-windows-password\/","title":{"rendered":"Restore\\reset the password of windows account."},"content":{"rendered":"<h2>Export of hashes of system files and sam system.<\/h2>\n<p><span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\"><span class=\"\">Before<\/span> we can <strong>recover the password of your account windows<\/strong>, we need to first extract the <span class=\"\">encrypted<\/span> hashes of <span class=\"\">these passwords<\/span>. <span class=\"\">To remove the<\/span> <span class=\"\">password<\/span><span class=\"\">, we need<\/span> <strong>sam<\/strong> system files <span class=\"\">and<\/span> <span class=\"\"><strong>system<\/strong>.<\/span> Typically, <span class=\"\">they are located<\/span> in the directory<\/span> <strong>%windir%\/system32\/config\/<\/strong><\/p>\n<p><span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">Remove the hashes can be in many ways, for example to make it even while running or copy files to boot from any bootable diska.My consider the way while running. For this, we will set the following programs:<\/span><\/p>\n<ul>\n<li><a href=\"http:\/\/soft.wpacracker.ru\/ophcrack-win32-installer-3.6.0.exe\">Ophcrack-x32 <\/a><\/li>\n<li><a href=\"http:\/\/soft.wpacracker.ru\/ophcrack-win64-installer-3.6.0.exe\">Ophcrack-x64<\/a><\/li>\n<li><a href=\"http:\/\/soft.wpacracker.ru\/PwDumpRelease.zip\">pwdump<\/a><\/li>\n<li><a href=\"http:\/\/soft.wpacracker.ru\/fgdump-2.1.0-exeonly.zip\">fgdump<\/a><\/li>\n<\/ul>\n<p><span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">Download the program data currently on your hard drive. Briefly describe the different methods:<\/span><\/p>\n<h3>Brief description of the program PwDump.<\/h3>\n<p><span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">Unfortunately, it <span class=\"\">is determined by many<\/span> <span class=\"\">anti-virus programs<\/span> <span class=\"\">as a<\/span> <span class=\"\">&#8220;<strong>hack tool<\/strong>&#8220;.<\/span> <span class=\"\">Do not<\/span> worry, <span class=\"\">because it<\/span> is in fact <span class=\"\">the product.<\/span> <span class=\"\">It all depends on<\/span> <span class=\"\">how<\/span> <span class=\"\">you use it<\/span> <span class=\"\">\ud83d\ude42<\/span><\/span><span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\"><span class=\"\">If you need<\/span> <span class=\"\">the source code<\/span>, you can download on the official. site. <span class=\"\">Remove programs<\/span> <span class=\"\">for example<\/span> in <span class=\"\">the root directory<\/span> and run the file start.bat <span class=\"\">an administrator<\/span>, go to the program <span class=\"\">directory<\/span><span class=\"\">.<\/span> <span class=\"\">You can<\/span> <span class=\"\">for example<\/span> open <span class=\"\">a<\/span> <span class=\"\">command line<\/span> (CMD.EXE) with Administrator rights.<\/span> <span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\"><span class=\"\">Once you&#8217;ve<\/span> logged into the directory program, write or paste the following text<\/span> &#8220;<strong>PwDump<\/strong> -x localhost &gt; hash.txt&#8221; <span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">Where -x option indicates the capacity of your system<\/span> (64).<span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">If your OS is not a 64 bit, you can perform simple command<\/span> &#8220;PwDump localhost &gt; hash.txt&#8221;.<span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">If you want to know the other team, then type the command<\/span> &#8220;PwDump &#8211;help&#8221; <span id=\"result_box\" class=\"short_text\" lang=\"en\" tabindex=\"-1\">In file<\/span> <strong>hash.txt<\/strong> \u0431<span id=\"result_box\" class=\"short_text\" lang=\"en\" tabindex=\"-1\">will be your desired hashes<\/span>. <span id=\"result_box\" class=\"\" lang=\"en\" tabindex=\"-1\">These hashes transmit to us to decipher and eventually you will get your password.<\/span><\/p>\n<h3>A brief description of the work to Ophcrack programk<\/h3>\n<p>We save to your hard drive install. Before starting the program by right mouse clicking (RMB), select &#8220;From an administrator.&#8221; Then click on the point &#8220;LOAD&#8221; and select the appropriate option to us. If we want to have with the system is turned on from the current PC to remove hashes, we will approach two options:<\/p>\n<ol>\n<li>Local SAM with samdump2<\/li>\n<li>Local SAM with pwdump6<\/li>\n<li>PWDUMP file<\/li>\n<li>Session file.<\/li>\n<\/ol>\n<p>In the first and in the second case the program will autorun. In the third and the fourth case, you need a little extra action, namely cooperation with the program fgdump.<\/p>\n<h3>Brief description of the program fgdump<\/h3>\n<p>We save to your hard drive, extract the archive and enters the directory fgdump program. After clicking on the icon, right-click the program fgdump choose &#8220;From an administrator.&#8221; On the screen for some time appear black dialog box, when it will disappear in a directory fgdump will have new file, for example: 127.0.0.1.pwdump, 2016-02-03-22-57-27.fgdump-log.<\/p>\n<p>And now the program in the way ophcrack 3 and 4, we specify file 127.0.0.1.pwdump and on the screen we will show the new data :<\/p>\n<p><a href=\"http:\/\/decrypthash.ru\/wp-content\/uploads\/2017\/01\/2017-01-04_13-58-15.png\" rel=\"lightbox[886]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-899 size-medium\" src=\"http:\/\/decrypthash.ru\/wp-content\/uploads\/2017\/01\/2017-01-04_13-58-15-300x254.png\" alt=\"Ophcrack ntlm\" width=\"300\" height=\"254\" srcset=\"https:\/\/decrypthash.ru\/wp-content\/uploads\/2017\/01\/2017-01-04_13-58-15-300x254.png 300w, https:\/\/decrypthash.ru\/wp-content\/uploads\/2017\/01\/2017-01-04_13-58-15.png 747w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<h3>Hash algorithms passwords in windows environment.<\/h3>\n<p>Operating systems to windows xp and below passwords hashed using <strong>LM hash<\/strong>. Even in systems windows vista, windows 7, windows 8, windows 10 &#8212;\u00a0 LM hash is supported for backward compatibility, but is disabled by default. The latest systems use <strong>NTLM<\/strong> and it supports a password longer than 14 characters.<\/p>\n<blockquote><p>Example LM hash :<\/p>\n<pre>Administrator:500:01FC5A6BE7BC6929AAD3B435B51404EE:0CB6948805F797BF2A82807973B89537:::\r\n<\/pre>\n<\/blockquote>\n<blockquote>\n<pre>Example NTLM hash :\r\nAdministrator:500:NO PASSWORD*********************:0CB6948805F797BF2A82807973B89537:::<\/pre>\n<\/blockquote>\n<p><span id=\"result_box\" class=\"\" lang=\"ru\" tabindex=\"-1\">The first field is the username. The second field is a unique security identifier for the user. The third field is the LM hash and the fourth is the NTLM hash.<\/span> Sometimes, when a user&#8217;s name is displayed &#8220;kryakozyabry&#8221;, do not panic! This account name were written in Cyrillic user.<\/p>\n<h4>Recovery (&#8220;hacking&#8221;) password of windows account you can already order on our website.<\/h4>\n<p>To date, this is the end. There are of course many more ways to extract hashes from sam file from memory. Description of password cracking windows and so on. I think the methods described above for the first time will suffice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Export of hashes of system files and sam system. Before we can recover the password of your account windows, we need to first extract the encrypted hashes of these passwords. To remove the password, we need sam system files and system. Typically, they are located in the directory %windir%\/system32\/config\/ Remove the hashes can be in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":446,"menu_order":8,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-886","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/pages\/886","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/comments?post=886"}],"version-history":[{"count":3,"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/pages\/886\/revisions"}],"predecessor-version":[{"id":901,"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/pages\/886\/revisions\/901"}],"up":[{"embeddable":true,"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/pages\/446"}],"wp:attachment":[{"href":"https:\/\/decrypthash.ru\/en\/wp-json\/wp\/v2\/media?parent=886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}