Patient: Forgotten Password


cc photo by Mirko Macari

A friend of mine brought me his brother’s laptop. His brother just got home from the hospital after a stroke and couldn’t remember the password. I never tried retrieving a forgotten password before, so I jumped at the opportunity.

The laptop was a Dell Latitude D630 running Windows XP. I used Google to do a little research on Windows XP password recovery, and a method using Ophcrack was popular.

I downloaded the open source Ophcrack live CD from here…
http://ophcrack.sourceforge.net/download.php?type=livecd

I burned the live CD to a disc, and booted the laptop from it. Ophcrack started up, and there was a display error. No text was showing up in the desktop environment.

During startup, there was an option to choose “Ophcrack Graphic VESA mode”. I restarted using that option instead, and everything looked fine this time. The thing that I thought was really cool is that I didn’t have to press anything for Ophcrack to start cracking the Windows XP password. It just started doing it automatically, and after 9 minutes, I had the password for the administrator account. Also, it told me two other limited accounts on there had no passwords.

So, I tried logging in to the Windows XP administrator account using the password Ophcrack gave me, and it worked! Then, I was able to change my friend’s bro’s limited account to an administrator one.

Needless to say, I’ve added Ophcrack to my arsenal of live CD’s which also include SystemRescueCD and BackTrack.

Alpha Mesh

Advertisements
This entry was posted in jorel314 and tagged , , , , , , , , , , , , , . Bookmark the permalink.

One Response to Patient: Forgotten Password

  1. Serpico says:

    Useful tips… thanks for the post

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s