Get password of a user

Question

Is it possible to get the password of a user in Windows Server 2003? I am an administrator and have full access rights to the machine. I just need to get the passwords of a couple regular users on the machine.

Thanks in advance

Solution

Normally, it should not be possible – user passwords are stored in hashed form, using a one-way hash that was designed to be irreversible. Not even the administrator is allowed access the stored hashes, too, so they never get to see the actual passwords.

However, if I remember correctly, by default Server 2003 still stores the old "LM hashes" in addition to "NT hashes". The former are so insecure that they can be bruteforced in very little time, using tools like Ophcrack. Even the latter – NT hashes, which are based on MD4 – have become relatively easy to break using rainbow tables and all sorts of other attacks.

Comments

[grvpanchal]

I guess administrator can change password but i dont think Security Account Manager (SAM) shows actual password

[Frank Thomas]

Look at l0phtcrack (windows)/ 0phtcrack (cross-platform) l0phtcrack.com ophcrack.sourceforge.net Note: this tool may allow you to do illegal things, so its use is often questioned. do not misuse it.

[ganesh]

There is an easy way to get the password. You explain to the user why you absolutely need his or her password; ask them to tell it to you and let them change their password immediately after you used it.

[Icemanind]

@Hennes - This isn't a real user. Whats happening is one of our servers is being decommissioned and moved to another server. We have in house apps though that run under a different account. When the app runs, its trying to log into that account. But since I don't know the password to the account, the app is failing.

[Keltari]

Why not just change the password for the user and in the app? Thats far easier and quicker

[Icemanind]

@Keltari - That would be far easier. The problem is, we stupidly lost the source code to the application and unfortunately the username and password is hard coded in the app.

[ganesh]

In that case read the applications documentation or your organisation's emergency recovery document? (If you do not have one: Hint... make one. With all the HW stuff, OS and software settings, password etc etc. Then lock it in a local safe and in an off-site safe (e.g. in a second office).

[Frank Thomas]

ophcrack now uses rainbow tables, and can now break NTML hashing.