Mot de passe syskey perdu !!

Salut ^ ^)

Comment faire pour utiliser l'utilitaire SysKey pour sécuriser la base de données du gestionnaire des comptes de sécurité de Windows

https://support.microsoft.com/fr-fr/help/310105/how-to-use-the-syskey-utility-to-secure-the-windows-security-accounts

Résumé :

"La base de données du gestionnaire des comptes de sécurité (SAM, Security Accounts Manager) de Microsoft Windows 2000, Microsoft Windows XP et Microsoft Windows Server 2003 stocke des copies hachées des mots de passe des utilisateurs. Cette base de données est chiffrée avec une clé système stockée localement. Pour conserver la base de données SAM sécurisée, Windows requiert que les hachages des mots de passe soient chiffrés. Windows empêche l'utilisation de hachages de mots de passe stockés non chiffrés."

"Vous pouvez utiliser l'utilitaire SysKey pour sécuriser encore davantage la base de données SAM en stockant la clé de chiffrement de cette base de données en dehors de l'ordinateur Windows. L'utilitaire SysKey peut également être utilisé pour configurer un mot de passe initial qui doit être entré pour déchiffrer la clé système afin que Windows puisse accéder à la base de données SAM. Cet article explique comment utiliser l'utilitaire SysKey pour sécuriser la base de données SAM de Windows."

Merci :)

oui je comprends mais cela n'aide pas à récupérer le mot de passe perdu !!

T'es pas tout seul ;) Je sais que tu sais mais pas tous le monde.

j'ai pas compris ta phrase !! je veux récupérer le mot de passe de pon ordi , c'est urgent
je ne veux pas le formater :s:s! j'ai pleins d'exposés dedans que j'utilise !!

Windows 2k/NT/XP's syskey encryption

Syskey is a Windows feature that adds an additional encryption layer
to the password hashes stored in the SAM database. The main purpose of
this feature is to deter 'offline' attack. In fact one of the most
common ways to gather passwords is to copy the system SAM database and
then use one of the many good password crackers[1] to "recover" the
passwords; of course physical access is almost always required.

So with syskey the attacker needs to remove the additional encryption
layer to get the password hashes (this is not entirely true as some
tools can crack even syskeyed hashes while losing some performance).

The key used by Syskey to encrypt the password hashes (called bootkey
or system key) can be generated and stored in three ways. The method
to use is selected when running syskey.exe on the host.

1) Using a user supplied passphrase(actually the MD5 hash of it). The
system will prompt for the passphrase during startup.

2) Using a system generated key stored on a floppy. The system will
ask for the boot floppy during startup.

3) Using a system generated key stored on the "the local system using
a complex obfuscation algorithm" (citing Microsoft site[2]). This is
the default method used.

In the first two cases generally nothing can be done. If you cannot
get the passphrase or the boot floppy you are compelled to crack the
syskeyed hashes.

The last case is different.

This document describe the "complex obfuscation algorithm" and the
steps required to restore the password hashes from their syskeyed
equivalent. Some tools are also presented to automate the process.

From now on we will talk about the case when the bootkey is stored on
the system.

During Windows boot phase before user are allowed to logon to the
system, the main thread of Smss (Session Manager) starts the Winlogon
process. Winlogon is the process required to load the Local Security
Subsystem (Lsass) which in turn loads the Security Accounts Manager
(SAM) service (the interface to the SAM database).

The registry is accessed by the above-mentioned processes. In
particular the following keys are accessed:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\JD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Skew1
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Data
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\GBG

The same keys are also accessed during the bootkey generation phase by
the Syskey.exe tool.

A more in depth analysis of the code accessing these keys uncover that
the "complex obfuscation algorithm" is no more than a permutation of
the class name of the above-mentioned keys.

Is almost trivial to develop a tool to recover the syskey obfuscated
bootkey from the registry.

To make things simpler on pre SP4 system the ACL on the above keys
allows 'Users' read access so a "normal" user can retrieve the
registry stored bootkey.

The tool developed to make this operation is called Bkreg.

On SP4+ system it is still possible to recover the syskey bootkey. The
ACLs on the keys only allow Administrator access, so Bkreg can recover
the bootkey on SP4 system only if executed by the Administrator.

But there is another way to access the registry keys.

An attacker can steal (maybe at the same time of the SAM database) the
system hive and access from there the above mentioned keys to recover
the syskey bootkey.

The tool developed to make this operation is called Bkhive.

Now we have the bootkey, conveniently stored in a file, and the SAM
hive; we need to know how to remove the syskey encryption.

The process that decrypts the password hashes (using the bootkey) is
Samss.

The steps required to do so are:

1) The value 'F' of the registry key SAM\SAM\Domains\Account is
accessed. The contents of that value is of binary type. 16 byte
(starting at offset 0x70) from the F value are hashed (MD5) with the
bootkey and some constant. The result is used as the key to decrypt
(RC4) the 32 byte of the F value (starting from 0x80).
The first 16 byte of the result are used later in the algorithm. I
call them hbootkey.

2) For each rid subkey in SAM\SAM\Domains\Account\Users. The value 'V'
of the key is accessed. The content of that value is of binary type
and contain the syskey encrypted password hashes. The hbootkey
(computed in step 1), the user rid and a constant string( different if
decoding NT or lanman password) are hashed (MD5). The result is used
as the key to decrypt (RC4) the syskeyed password hashes.

So syskey encrypts the password hashes with the RC4 algorithm using as
key "something" derived (through MD5) from the syskey bootkey.

I've developed a tool to automate the above steps and include the
features of SAMDUMP. The tool is called SAMDUMP2; SAMDUMP2 can, when
given a SAM hive and a bootkey file (generated by Bkreg or Bkhive),
output the password hashes in SAMDUMP/PWDUMP format.

So an attacker with physical access can:

0) Boot using another OS (maybe Linux or DOS)
1) Steal the SAM and SYSTEM hive (from %WINDIR%\System32\config)
2) Recover the syskey bootkey from the SYSTEM hive using Bkhive (or
Bkreg on pre Sp4 system)
3) Dump the password hashes using SAMDUMP2
4) Crack them offline using his favorite cracking tool

References
[1] http://www.atstake.com/products/lc/
http://www.oxid.it/cain.html
https://www.openwall.com/john/
https://hashsuite.openwall.net/tutorial
[2] https://support.microsoft.com/support/kb/articles/q143/4/75.asp

Nicola Cuomo ncuomo(at)studenti.unina.it

Many thanks to Jason R. DePriest for 'patching' my english ^_^

moi je veux la solution , c'est quoi tout ce texte !!!!

svp je travaillais la sécurité max en mettant un mot de passe de 25 caractères alterné entre des lettre et des chiffres mais alors après je crois que c'est l'alternance qui m'a troublé pour le syskey je sais qu'il n'est pas facile de démontrer qu'on est de bonne foi ,aussi j'aimerai de l'aide sur les astuces de sécurité réseaux que j'ai choisi comme thème de stage académique

Salut

un logiciel de déblocage, crack mots de passe c'est pour les nuls (Hackers), je te propose de booter en mode texte ou avec un cd windows ton pc et tu recuperes tes trucs de démarrage, quand la machine démarre, tu vas sur CTRL + R puis tu tapes syskey tu valides puis tu mets mots de passe généré par le systeme.

je sais pas si j'étais assez claire mais je pense que tu y arrriveras, il suffit de comprendre seulement les procédures même en réseau c'est encore plus facile,

1 conseil : rester loin des soft de piratage si tu veux etre le meilleur

Chao