How to recover VMware Player Virtual Machine OS password? (Windows XP Professional SP3)

Question

I'm just learning Tomcat, and have successfully deployed a simple test WAR to a Tomcat server. However, when I attempt to add a library via Maven, Tomcat's JarScanner then fails to load the class files for my program, saying it can't find anything

09-Feb-2020 05:36:42.568 INFO [http-nio-80-exec-8] org.apache.catalina.startup.HostConfig.deployWAR Deploying web application archive [/opt/tomcat/apache-tomcat-9.0.30/webapps/api.war]
09-Feb-2020 05:36:42.668 FINE [http-nio-80-exec-8] org.apache.jasper.servlet.TldScanner.scanResourcePaths No TLD files were found in resource path [/WEB-INF/].
09-Feb-2020 05:36:42.686 INFO [http-nio-80-exec-8] org.apache.catalina.startup.HostConfig.deployWAR Deployment of web application archive [/opt/tomcat/apache-tomcat-9.0.30/webapps/api.war] has finished in [117] ms

However, if I remove the library from pom.xml (and hence from the WAR), it loads fine. Here are the libraries being loaded:

• JDA
• Trove4J
• jsr305
• opus-java
• opus-java-natives
• opus-java-api
• jna
• annotations
• okhttp
• commons-collections4
• nv-websocket-client
• slf4j-api
• jackson-databind
• jackson-annotations
• jackson-core

Further, I've already tried telling the JARScanner to not scan any JAR files, both in context.xml and in catalina.properties.

tomcat.util.scan.StandardJarScanFilter.jarsToSkip=\
*.jar

<JarScanner scanClassPath="false" scanAllDirectories="false" scanManifest="false" scanAllFiles="false"/>

Neither of these have resulted in the deployment working. If I don't exclude the main library (JDA), then Tomcat reports an ArrayIndexOutOfBounds exception. The server is running Tomcat 9 on JDK 8, as is my IDE.

Solution

Ophcrack is one of the easiest ways to actually recover the password. Simply download the ISO and boot the VM using the ISO. For the most part, Ophcrack will take care of the rest. Once booted, it will grab the hashes off the Windows partition and start cracking away. Provided it's relatively simple password, it should crack it handily.

If it's too complex, you could copy the hash and start cracking it using Hashcat or something similar.

You probably don't need to actually recover the original password however. If you don't have any files encrypted using your Windows credentials, you can simply reset the password using a variety of boot CDs. I like to use TRK personally, it's handy CD to keep around.

Comments

[Jason H]

chntpw on a backtrack 5 live CD. This will let you "zero" out the administrator password. Just do a little googling on how to use it and how to boot a vm with it.

[Ethan]

Here's catalina.out if I remove JDA from pom.xml: pastebin.com/hwQvPDqQ. The fact that it correctly finds my Class file when I remove the dependency from Maven's pom file is what makes me thing it's the library.

[Mark Bramnik]

Yes, if you remove JDA - it clearly deploys. How does the log look with JDA actually? can you add the full log like this?

[Ethan]

Here you go. Nearly same output as from the question post. Just added JDA back, recompiled, and uploaded to Tomcat.

[Mark Bramnik]

Both snippets have line: org.apache.catalina.startup.HostConfig.deployWAR Deployment of web application archive [/opt/tomcat/apache-tomcat- 9.0.30/webapps/api.war] has finished in [XXX] ms which means that in both cases the WAR is deployed in tomcat (there is a manager application in tomcat where you can view all the deployed WARs) - however internally the WAR might be different. It all depends on what does it do... Again, From the tomcat's standpoint in both cases the WAR is technically OK and its deployed...

[Ethan]

Ended up figuring out the issue, just putting the fix here. Either JDA or one of its libraries was compiled for a higher version of Java than the version of Jersey Servlet I was using was (My guess, Java 8 vs Java 7), resulting in an ArrayIndexOOB exception when it hit lambda methods. Upgrading Jersey Servlet to a newer version resolved the issue.