Vulnerability Development: Syskey

[Nicola Cuomo <ncuomo () studenti unina it>]

Hi,  I've written a small paper and some tools to work with "syskeyed"
SAM database.

The  paper  and the tools don't describe/exploit any new vulnerability
(in  the strict sense of the term) but some time ago (more than 1 year
-_-)  someone  posted  on this ml asking for some tool relating Syskey
so..

The  paper  describe  the  process  Syskey use to encrypt the password
hashes  and the tools allow to recover the bootkey/system key from the
registry  and  to  dump  the password hashes from a SAM database (like
SAMDUMP).

I've  only  tested  them on Windows 2000 Prof. and they _seem_ to work
-_-, feedback from NT/XP users is appreciated.

English is not my mother language so i hope only it's someway readable
^_^

You can find them on my web page at:

http://studenti.unina.it/~ncuomo/syskey/

Bye, bye.
-- 
 Nicola                          mailto:ncuomo () studenti unina it