Getting the Admin password for Windows XP

So we recently had an issue where we needed to run Checkdisk on a XP box and we did not have the administrator password to proceed. This was a good oportunity to try out Ophcrack which we downloaded a few days earlier.

Ophcrack is an open source (GPL licensed) program that cracks Windows passwords by using LM hashes through rainbow tables. One must have physical access to the machine you wish to get the password from though. You can download a live CD for XP or Vista here

So it was that easy...not quite. The security files for the OS were corrupted and Ophcrack kept on coming up with the "Not Found" message for the NT Password. It seems XP keeps a copy of the security files in a folder called "Repair" on the system. Here are the steps I followed to get Ophcrack to determine the admin password from the backup.

In Ophcrack click "Load->Encrypted SAM file" and navigate to /mnt/sda1/windows/repair

Note:
c:\windows\system32\config\sam (windows main copy)
c:\windows\repair\sam (possible backups in subfolders)

Then click "Crack"

In under five minutes Ophcrack determined the password and we were good to go.

Good stuff.