Welcome back to Windows registry forensics course for the SAM Hi file.
Section four password hashes.
Before we get started, this is not an encryption class and I'm not going
to go too far into this but I just want to talk a little bit about the process and
give you a method that you could use for decrypting these hashes.
Few things to remember that there is no plain text stored
password in the SAM file.
The sam file does contain the 60.
It is now a 56 bite.
NTLM hash of the password.
This hash is encrypted with an A E S.
Algorithm and this key this A S algorithm is stored in the system file.
So to decrypt these hashes and come up with the log on users password.
We are going to need bolt the SAM and the system files.
This is a password cracking methodology that is repeatable.
And this is tailored to the anti ML hash values.
The first thing we're going to do is go ahead and export the SAM and
the system Hives.
System files from our forensic image,
which we did in the beginning of this path.
Then we're going to need to utilize a tool to un encrypt the encrypted NTLM hashes.
There's several different tools you could use to do that.
The one I'm going to show you a slide of is Mimi cats.
The next thing, what you would need to do is create a wordless from your case.
And the reason you're doing this is you're hoping that there is a word
somewhere on that hard drive that will help you decrypt that password.
So you're going to export the word list.
You can do this with one of your forensic sweets.
X ways, FTK axiom.
All of them will export wordless.
Then what you're going to do is you're going to use another tool and
you're going to run a dictionary attack.
And if that doesn't work,
you can run a brute first attack against the N T M L Hash to recover the password.
In this particular example.
I did use Mimi cats like I said, and I had to put out the system file,
export the system file in the SAM file and
then I pointed Mimi Cats to those files and
it was able to give me the unencrypted 20 ml hashes.
For each user that had a password on the system.
And this was done from the Ivan computer, the even image.
And you can see, we use the Cis key from the system file and
that's outlined in blue.
And then we have the SAM hi file.
And then we have our hash values outlined in yellow down below.
For a password cracking tool.
I used cash cap, but you could use whatever tool you want you can use,
John the ripper, Kane and Abel.
And again,
you would run a dictionary attack using that word list that you exported.
And if that didn't work, you can go ahead and try a brute force attack
against the NTML hashes that you recovered using another tool,
whether it's Mimi cats or whatever tool you choose to use.
In the next section, we're going to take a look at internet user accounts and
different types besides local user accounts.