Home page logo

basics logo Security Basics mailing list archives

RE: Syskey on Win2k
From: Lachlan McGill <Lachlan.McGill () au logical com>
Date: Fri, 7 Feb 2003 09:06:40 +1100

 If you create an emergency repair disk, then windows will copy the sam file
to c:\winnt\repair directory at which point you can then do what you like
with the sam file while the system is running.

-----Original Message-----
From: James Kelly
To: 'Pez Mohr'; simont () lantic net; 'Security-Basics'
Sent: 06/02/2003 12:16 PM
Subject: RE: Syskey on Win2k

I may be wrong in this, but im pretty sure from previous "exercises"
that you can't copy the sam data when windows is running.  It can be
accessed however, when you have admin writes.  Which gives LC4 access to
the data, and as far as the technet claim, I have seen in my own
personal experience, LC4 get passwords in minutes.  If it does have to
bruteforce, this takes considerably longer...


-----Original Message-----
From: Pez Mohr [mailto:boredMDer74 () msn com] 
Sent: Wednesday, February 05, 2003 3:11 PM
To: simont () lantic net; Security-Basics
Subject: Re: Syskey on Win2k

Simon Taplin wrote:
On Windows 2000, Syskey is enabled by default, can I copy the .sam
file from \winnt\system32 after booting from bootdisk and then
running LC4 or do I need to run something else first. Just wondering
since I know Syskey is supposed to be 128 encryption.


AFAIK, Syskey encrypts the SAM with 128 bit encryption, not just when
Windows is running. With appropriate permissions, grabbing the SAM after
booting from a bootdisk would yield the same result as grabbing it when
were logged in to Windows.

The following is taken from a TechNet page:
'Syskey thwarts this attack by encrypting the SAM database using strong
encryption. Even if an attacker did manage to obtain a copy of the
Syskey-protected SAM, he would first need to conduct a brute-force
attack to
determine the Syskey, then conduct a brute-force attack against the

I don't know quite what you're asking, but it looks like you mean how
exactly would one get the SAM. Again, if you have appropriate
one can merely copy over the SAM from '%WinDir%\system32\SAM' . If I've
unclear in any way, feel free to email me off-list so I can clear it up

Pez Mohr
boredMDer74 () msn com
PGP Key: http://tinyurl.com/3rmk
Fingerprint: 35F0 4088 BCA3 457C FDE4  3ABC 4E02 1AD7 9EBE 09FE

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]