Cracking Windows XP Pro password problem

[turbulence]

I'm having trouble cracking a Windows XP pro password. That is because I can not find the correct account that I am looking to crack. When I use the backtrack live cd and run bkhive and then samdump2, the usernames that it finds are not the one that I am looking for. I think this is because the username that I am trying to crack is not stored in that SAM file because they do not log into a different domain or workgroup at startup. What I mean by domain or workgroup is the "log on to:" field at the startup screen. There is several different choices in the pull down menu one of which is followed by "(this computer)". I think that is the one that I cracked the passwords for. Even though when i put in those usernames and passwords with that log in chosen, none worked.

If any one has any ideas of how Windows XP pro works and were the usernames for the different "log on to:" fields are stored please let me know.

[imported_=Tron=]

As I understand you simply have the wrong SAM file. If it is a network login, which you seem to imply with the log on to, the username and password hash will not be stored on the local computer, unless the admin has this setting enabled. Using the SAM file you currently have you will therefore be out of luck.

[turbulence]

As I understand you simply have the wrong SAM file. If it is a network login, which you seem to imply with the log on to, the username and password hash will not be stored on the local computer, unless the admin has this setting enabled. Using the SAM file you currently have you will therefore be out of luck.

I'm almost positive that it has to be stored on the computer somewhere because the user is able to log on to that domain even when the computer is not docked in its network docking station. I was wondering if anyone had any idea were the user information would be stored for different domains in Windows XP Pro edition. Because at WINDOWS/system32/config/ there is only accounts like Aspnet, Client-Admin, and Client-Guest. So if anyone can offer any further advice it would be greatly appreciated.

[bofh28]

I'm almost positive that it has to be stored on the computer somewhere because the user is able to log on to that domain even when the computer is not docked in its network docking station. I was wondering if anyone had any idea were the user information would be stored for different domains in Windows XP Pro edition. Because at WINDOWS/system32/config/ there is only accounts like Aspnet, Client-Admin, and Client-Guest. So if anyone can offer any further advice it would be greatly appreciated.

The local SAM (C:\WINDOWS\system32\config\) only contains password information about local user accounts. Domain users passwords are stored in Active Directory, or the SAM on a domain controller in case it is a NT4 domain.

What you are talking about is Cached Credentials. When a domain user logs on a PC the users credentials are cached so that in the event that the domain controller goes down, or the network connecting the user to a domain controller goes down the user can still login and work using the locally installed applications. I have no idea where the users password is stored in this case. My best guess is it is somewhere in the users profile, probably C:\Documents and Settings\username\ntuser.dat but I don't know for sure.

[thorin]

http://www.irongeek.com/i.php?page=security/cachecrack

[williamc]

This should help:

http://forums.remote-exploit.org/showthread.php?t=12942

[turbulence]

Thank you for the link Thorin, it was very helpful. Who knew they would be cached in the registry?