The Offline Windows Password Editor (c) 1997-2014 Petter Nordahl-Hagen This is free software, licensed under the following: "ntreg" (the registry library) and "libsam" (SAM manipulation library, user, groups etc) is licensed under the GNU Lesser Public License. See LGPL.txt. "chntpw" (the password reset / registry editor frontend) "reged" (registry editor, export and import tool) "sampasswd" (password reset command line program) "samusrgrp" (user and group command line program) is licensed under the GNU General Public License, see GPL.txt. For manual to the different commands, see MANUAL.txt Also, all have some help built in, just use the -h option. See INSTALL.txt for compile instructions. Where to get more info: ----------------------- http://pogostick.net/~pnh/ntpasswd/ At that site there's a floppy and a bootable CD that use chntpw to access the NT/2k/XP/Vista/Win7/Win8 system it is booted on to edit password etc. The instructions below are for the standalone program itself, not the floppy. What does chntpw do? -------------------- This little program will enable you to view some information and change user passwords, change user/group memberships in a Windows (NT/XP/Vista/win7/win8) etc SAM userdatabase file. You do not need to know the old passwords. However, you need to get at the registry files some way or another yourself. In addition it contains a simple registry editor with full write support, and hex-editor which enables you to fiddle around with bits&bytes in the file as you wish yourself. Also have registry import or export ----------------------------------- "reged" is a program that can do import and export of .reg files into the registry hive (binary) files. Also has an editor, but still rudimentary text based command line type thing. And by popular request Even have programs that can be used in scripts! ----------------------------------------------- "sampasswd" can be used in scripts to get lists of users or reset passwords automatically "samusrgrp" can be used in scripts to list or change memberships in groups automatically. Why? ---- I often forget passwords. Especially on test installations (that I just _must_ have some stuff out of half a year later..) On most unix-based boxes you just boot the thingy off some kind of rescue bootmedia (cd/floppy etc), and simply edit the password file. On Windows however, as far as I know, there is no way except reinstalling the userdatabase, losing all users except admin. (ok, some companies let you pay lotsa $$$$$ for some rescue service..) (ok, from Windows Vista or something you can make a password reset file, but you have to remember to do that BEFORE you forget your password...) How? ---- Currently, this thing only runs under linux, but it may just happen to compile on other platforms, too. So, to set a new adminpassword on your Windows installation you either: 1) Take the harddrive and mount it on a linux-box or 2) Boot a "live" linux CD with full GUI (many available: Ubuntu, Knoppix and more. Search for them) In both those cases, use the "chntpw.static" program found in the "static" zip file on my website. or 3) Use my linux boot CD (or USB) at: http://pogostick.net/~pnh/ntpasswd/ Usage: ------ For manual to the different commands, see MANUAL.txt Also, all have some help built in, just use the -h option. Some old tech babble on how the password is stored -------------------------------------------------- (still mostly valid, but should be moved somewhere else than this file) A struct, called the V value of a key in the NT registry was suddenly somewhat documented through the pwdump utility included in the unix Samba distribution. This struct contains some info on a user of the NT machine, along with 2 crypted versions of the password associated with the account. One password is the NT console login password, the other the LANMAN network share password (which essentially is the first one in uppercase only, and no unicode) This is how NT encrypts the passwords: The logon cleartext password a user enters is: 1) Converted to unicode 2) A MD4 hash is made out of the unicode string 3) Then the hash is crypted with DES, using the RID (lower part of the SID, userid) as the crypt key. This is the so called "obfuscation" step, so it's not obvious on a hex dump of the file that two or more users have the same password. 4) The result of stage 3 (16 bytes) is put into the V struct. For the LANMAN password: 1) Uppercased (and illegal characters probably removed) 14 bytes max, if less the remaining bytes are zeroed. 2) A known (constant) string is DES-encrypted using 7 first characters of the password as the key. Another constant is encrypted using the last 7 chars as the key. The result of these two crypts are simply appended, resulting in a 16 byte string. 3) The same obfuscation DES stage as 3 above. 4) 16 bytes result put into the V struct. Since the number of possible combinations in the lanman password is relatively low compared to the other one, and it's easy to see if it's shorter than 8 chars or not it's used first in brute-force-crackers. This program, however, don't care at all what the old one is, it just overwrites it with the new one. Ok. So, how do we find and identify the V struct? Yeah.. that was the hard part.. The files structure is not documented (as far as I know..) But, with help from an unnamed German, and a lot of testing and guesswork from myself, it's now possible to follow the actual registry tree. (see source code for struct-defines and comments on the registry structure) The usernames are listed in: \SAM\Domains\Account\Users\Names\ [2d18] \SAM\Domains\Account\Users\Names> l ls of node at offset 0x2d1c Node has 4 subkeys and 1 values nk-offset name 0x003290 - 0x003630 - 0x001c88 - 0x003428 - Each name is a subkey, with one namless value containing the RID. [2d18] \SAM\Domains\Account\Users\Names> cd pnh [3428] \SAM\Domains\Account\Users\Names\pnh> l ls of node at offset 0x342c Node has 0 subkeys and 1 values vk-offs size type name 0x003688 0 (unknown) <> INLINE: val (in type field?): 1000 (0x3e8) To get the userinfo (V struct), access \SAM\Domains\Account\Users\\V [2c90] \SAM\Domains\Account\Users> l ls of node at offset 0x2c94 Node has 5 subkeys and 1 values nk-offset name 0x003320 - <000001F4> 0x0036b8 - <000001F5> 0x003550 - <000003E8> 0x001d00 - <000003E9> 0x002d18 - [2c90] \SAM\Domains\Account\Users> cd 000003E8 [3550] \SAM\Domains\Account\Users\000003E8> l ls of node at offset 0x3554 Node has 0 subkeys and 2 values vk-offs size type name 0x0035a8 80 REG_BINARY 0x003228 508 REG_BINARY For more techincal info, look it up in the source code.