Reset Passwords on Windows XP and Vista Using Backtrack 4 - Captions and Voice Includ

[purehate]

Reset Passwords on Windows XP and Vista Using Backtrack 4 - Captions and Voice Included - Video

[Bella]

Hi!

I have used the tutorial to reset my password but unfortunately didnt work i have tried it several times by changing different parameteres from the commands issued but didnt succeed kindly assit.

My hard disk is sata

Here's what i have done

chtpw -i /mnt/sda1/windows/system32/config/SAM

ERROR

Unable to open/read a hive

Exiting

[Lincoln]

Is sda1 the location of your windows partition?

[Bella]

I need your guidence on this coz since i bought my laptop i knew that my HDD is SATA.But when i checked the boot priority this is what i found.

BOOT PRIORITY ORDER
1. ATAPI CD0: MATSHITADVD-RAM UJ-850 Z-(PM)
2.USB FDD.
3.USB CD.
4.ATA HDD0:WDC WD1600 BEVS-08VATI-S1
5.PCI LAN:IBA GE SLOT 00C8 V1245
6.-USB HDD
7.ATA HDD1

[Lincoln]

I watched the video over and came up with a few things. The video assumes that your Windows partition is mounted. If it isn't you get the error you received.

I mounted my Windows partition and it works fine. Also check the syntax for the location of the sam file might be different between Vista and XP (ex: Windows vs. WINDOWS)

Run fdisk -l and see where your ntfs partition is.

http://backtrack.offensive-security....hp/Chntpw_tool

[spawn]

Hi!

I have used the tutorial to reset my password but unfortunately didnt work i have tried it several times by changing different parameteres from the commands issued but didnt succeed kindly assit.

My hard disk is sata

Here's what i have done

chtpw -i /mnt/sda1/windows/system32/config/SAM

ERROR

Unable to open/read a hive

Exiting

are you using the ntfs-3g or native ntfs module ?

[Virchanza]

Here's what i have done

chtpw -i /mnt/sda1/windows/system32/config/SAM

ERROR

Unable to open/read a hive

Exiting

Try this

cd /mnt/sda1/windows/system32/config/
chntpw -i SAM userdiff

[Steve Thing]

There's an easier way:

1.) Mount the windows partition then go to C:\Windows\system32.
2.) rename sethc.exe to sethc.exe.old
3.) rename cmd.exe to sethc.exe
4.) unmount, reboot, select windoze partition, at login, hit shift 5 times to get a command prompt
5.) net user (find your account name)
6.) net user <account> *
7.) <type new password or leave blank>
8.) <confirm>
9.) net user \Active:yes <account> if it is locked...
10.) exit cmd
11.) Login and rename sethc.exe.old back.

At the login screen, you have more than Administrator rights (even in Win7 oddly). You can do some nasty damage to your PC though, so becareful.

-Steve Thing

[Archangel-Amael]

There's an easier way:

1.) Mount the windows partition then go to C:\Windows\system32.
2.) rename sethc.exe to sethc.exe.old
3.) rename cmd.exe to sethc.exe
4.) unmount, reboot, select windoze partition, at login, hit shift 5 times to get a command prompt
5.) net user (find your account name)
6.) net user <account> *
7.) <type new password or leave blank>
8.) <confirm>
9.) net user \Active:yes <account> if it is locked...
10.) exit cmd
11.) Login and rename sethc.exe.old back.

At the login screen, you have more than Administrator rights (even in Win7 oddly). You can do some nasty damage to your PC though, so becareful.

-Steve Thing

Apparently "an easier way" is subjective in your case.
With chntpw there is no need for commands to find an account, enter a new password, then confirm it. Not to mention renaming files and logging into and renaming more files.
Maybe you should re-look at the video, a simple boot mount a directory and run a command will do what you are talking about, far faster with less steps( equaling fewer things that may go wrong. Not to mention time may be of the essence).
Nothing wrong with your way but really it's not even BT specific which is what the thread/video is about.

[purehate]

He just wanted to steal a method that has already been documented all across the web (even in a offsec video) with out giving credit to the original author.

Good Show!