1
00:00:00,660 --> 00:00:07,380
In this lesson, we will see how we can extract the exact password of Windows user.

2
00:00:07,980 --> 00:00:08,460
Right.

3
00:00:08,460 --> 00:00:15,330
In the previous videos we have seen how we can reset the password for users, either for standard user

4
00:00:15,330 --> 00:00:16,980
or for administrator user.

5
00:00:16,980 --> 00:00:20,190
But now we will not going to reset the password.

6
00:00:20,190 --> 00:00:23,910
Instead, we are going to extract the exact password.

7
00:00:24,420 --> 00:00:26,700
We will extract the original password.

8
00:00:27,420 --> 00:00:28,950
So let's see how to do this.

9
00:00:29,190 --> 00:00:31,890
For this, we are going to use three different tools.

10
00:00:31,890 --> 00:00:33,870
First one is p.w dam seven.

11
00:00:34,530 --> 00:00:40,200
So we are actually going to dumping and cracking the password hashes.

12
00:00:40,200 --> 00:00:40,860
Right.

13
00:00:40,860 --> 00:00:47,670
So there is a database, SAM database in your system, it stands for security access.

14
00:00:48,600 --> 00:00:50,730
So security account manager.

15
00:00:50,730 --> 00:00:51,240
Right.

16
00:00:51,510 --> 00:00:57,570
So SAM database is present in your Windows operating system which contain your user account details

17
00:00:57,570 --> 00:01:00,720
and password descriptors, security descriptors.

18
00:01:00,720 --> 00:01:09,000
So it will contain your password in hashes either on LEM hashes or all anti LEM hashes.

19
00:01:10,470 --> 00:01:16,860
Then we will use a tool called win athi gen that is window rainbow table generator.

20
00:01:17,190 --> 00:01:17,700
Right?

21
00:01:17,700 --> 00:01:25,710
So it will going to generate a table based on our specifications and it will create a password list.

22
00:01:25,710 --> 00:01:26,370
Right?

23
00:01:26,850 --> 00:01:37,530
Then we will use rainbow crack tool in order to extract the original password in plaintext format from

24
00:01:37,530 --> 00:01:39,420
the hashes that we have dumped.

25
00:01:39,930 --> 00:01:40,350
Right.

26
00:01:40,350 --> 00:01:42,120
So let's see how to do this.

27
00:01:42,420 --> 00:01:47,670
First of all, let's open command, prompt and run as administrator.

28
00:01:48,720 --> 00:01:49,470
Yes.

29
00:01:50,760 --> 00:02:00,270
Now let's go to the C drive and let's go to W dump seven to download page seven.

30
00:02:00,270 --> 00:02:03,600
Simply go to Google and type download p w dump seven.

31
00:02:04,530 --> 00:02:07,560
And if you don't find it over the internet then ask me.

32
00:02:07,560 --> 00:02:09,360
I will share a link with you.

33
00:02:10,110 --> 00:02:13,590
Now let's run the executable file.

34
00:02:17,400 --> 00:02:21,060
C This is the author name.

35
00:02:21,780 --> 00:02:29,970
So when you go to internet to download page seven, just verify whether you are visiting the original

36
00:02:29,970 --> 00:02:30,900
website or not.

37
00:02:30,900 --> 00:02:34,740
Right now it says yes.

38
00:02:34,740 --> 00:02:42,240
Here is the password for the one of the user on my main machine.

39
00:02:42,810 --> 00:02:43,230
Right?

40
00:02:43,230 --> 00:02:49,170
So let's save these passwords in a file called hashes dot text.

41
00:02:49,620 --> 00:02:50,220
Right.

42
00:02:50,220 --> 00:02:58,710
And let's assign location which is c colon backslash p.w w seven backslash and then.

43
00:03:03,140 --> 00:03:08,420
Hashes Dot text hit enter then.

44
00:03:09,290 --> 00:03:15,140
Now let's go to our window rainbow table generator.

45
00:03:15,680 --> 00:03:20,240
So C drive and then win RTG.

46
00:03:20,240 --> 00:03:21,200
And here it is.

47
00:03:23,510 --> 00:03:25,640
So let's run this application.

48
00:03:26,480 --> 00:03:29,240
And now let's create a password table.

49
00:03:29,810 --> 00:03:33,140
Go to a table, select the hash form.

50
00:03:33,530 --> 00:03:37,250
So let's say select the minimum length.

51
00:03:37,260 --> 00:03:38,420
Okay, to.

52
00:03:42,040 --> 00:03:43,120
Maximum length.

53
00:03:43,770 --> 00:03:48,790
Uh, let's say for now, it's asking for the total count.

54
00:03:49,030 --> 00:03:50,110
Total chain count.

55
00:03:50,110 --> 00:03:55,210
So let's say 40,000 or four lakh is sufficient.

56
00:03:56,260 --> 00:04:02,290
See, the more the chain count, the more are the possibilities that we are going to get the exact password

57
00:04:02,290 --> 00:04:05,950
in ten text format right now.

58
00:04:06,520 --> 00:04:08,230
Here you can select get a preset.

59
00:04:08,320 --> 00:04:12,550
So it says alpha, which means all alphabets in capital letters.

60
00:04:13,570 --> 00:04:22,300
Or you can go for Lower Alpha, where that means all alphabets are in lowercase, but we will go with

61
00:04:22,300 --> 00:04:27,550
the numeric OC as it is a demonstration.

62
00:04:27,670 --> 00:04:31,420
Then I know my password, so I will go with numeric one.

63
00:04:32,380 --> 00:04:33,280
Just click on.

64
00:04:33,280 --> 00:04:33,890
Okay.

65
00:04:35,470 --> 00:04:35,980
Right.

66
00:04:35,980 --> 00:04:38,470
And then again click on.

67
00:04:38,470 --> 00:04:39,100
Okay.

68
00:04:40,690 --> 00:04:46,690
So see guys, it has started its process but it is going to take some time.

69
00:04:46,690 --> 00:04:48,910
So let me pause this video till.

70
00:04:52,330 --> 00:04:55,060
Finally we have generated a rainbow table.

71
00:04:56,140 --> 00:05:04,720
Now I have used a tool called Window Rainbow Table Generator, but you can also use command prompt to

72
00:05:04,720 --> 00:05:06,580
generate a rainbow table.

73
00:05:07,420 --> 00:05:09,490
So let's see how to do it.

74
00:05:11,410 --> 00:05:14,830
See, our pigeon is the command for this OC.

75
00:05:15,970 --> 00:05:24,490
So arity gen then define your hash type whether it is Elm or Antietam or MD5 etc..

76
00:05:25,240 --> 00:05:32,290
Then define what kind of rainbow table you want to generate like numeric, alphanumeric, etc..

77
00:05:33,940 --> 00:05:41,590
Then this is the minimum number of length and this defines the maximum number of length of the password.

78
00:05:42,520 --> 00:05:43,090
Right.

79
00:05:45,520 --> 00:05:47,320
Then keep it zero.

80
00:05:47,470 --> 00:05:51,730
And this is the number of passwords you want to generate in total.

81
00:05:52,810 --> 00:05:58,450
So let's say you want to generate the total number of passwords to 90,000.

82
00:05:59,500 --> 00:06:01,660
So let's change it to 90,000

83
00:06:05,260 --> 00:06:10,810
and then define numbers like zero one, two, three, four, five, six, seven, eight, nine, ten

84
00:06:12,520 --> 00:06:15,820
and then leave the last option to zero.

85
00:06:15,850 --> 00:06:25,810
This way you will able to generate a table with 90,000 passwords, which are the combination of these

86
00:06:25,810 --> 00:06:26,530
numbers.

87
00:06:27,190 --> 00:06:27,760
Right.

88
00:06:29,530 --> 00:06:34,420
Now, after generating a table, it is important to sort that table.

89
00:06:34,450 --> 00:06:43,210
So to solve the table, we will use the command, RPG, sword, rainbow table, sword, and then the

90
00:06:43,210 --> 00:06:45,070
name of the file.

91
00:06:47,140 --> 00:06:48,430
Let's close this.

92
00:06:52,150 --> 00:06:55,300
Now let's open rainbow crack tool.

93
00:06:56,020 --> 00:06:56,990
So here it is.

94
00:06:57,010 --> 00:06:58,720
Let's run the application.

95
00:06:59,890 --> 00:07:04,770
So this is our rainbow crack tool, which helps us to.

96
00:07:06,820 --> 00:07:10,720
To extract password from hashes into plaintext.

97
00:07:11,560 --> 00:07:13,420
So let's see how to do this.

98
00:07:14,470 --> 00:07:17,740
First of all, let's say add hash.

99
00:07:18,340 --> 00:07:22,750
And now let's open our hash file, which is in pw7.

100
00:07:23,110 --> 00:07:25,150
So this is pw7.

101
00:07:25,780 --> 00:07:30,880
Let's open hashes file right now.

102
00:07:33,270 --> 00:07:34,800
Let's copy this one.

103
00:07:35,400 --> 00:07:37,020
Let's copy this hash.

104
00:07:39,110 --> 00:07:43,940
Because the rest of the users like administrator guest has no password.

105
00:07:43,940 --> 00:07:44,360
Right.

106
00:07:44,360 --> 00:07:46,580
But then user has a password.

107
00:07:47,090 --> 00:07:48,980
That's why I picked up this hash.

108
00:07:51,710 --> 00:07:53,240
Now paste here.

109
00:07:54,680 --> 00:07:54,950
Click.

110
00:07:54,950 --> 00:07:55,550
Okay.

111
00:07:56,360 --> 00:07:58,130
Now go to rainbow table.

112
00:07:58,130 --> 00:08:00,140
Search for rainbow tables.

113
00:08:00,590 --> 00:08:09,680
So let's say I want to open this file because it's a short file, right?

114
00:08:11,540 --> 00:08:20,180
If we go for this long file, which I have generated some time ago, then it will going to take around

115
00:08:20,180 --> 00:08:23,480
15 to 20 minutes or more just to scan this file.

116
00:08:23,570 --> 00:08:24,230
Right.

117
00:08:24,260 --> 00:08:30,440
But my aim is to show you a demo of how actually the Rainbow Connect tool works.

118
00:08:30,620 --> 00:08:31,160
Right.

119
00:08:31,280 --> 00:08:33,260
So let's open this file.

120
00:08:34,670 --> 00:08:39,620
See, it has detected our password, and password is one, two, three.

121
00:08:40,430 --> 00:08:46,400
Right now I have not changed password for this demonstration purpose, but I am actually using this

122
00:08:46,400 --> 00:08:49,910
simple password from last six months.

123
00:08:50,960 --> 00:08:53,770
Now let's verify whether this password works or not.

124
00:08:53,780 --> 00:09:00,680
So let's log out and type one, two, three, C one, two, three.

125
00:09:03,320 --> 00:09:10,940
So this way you can extract the exact password or the original password in plain text from hashes.

126
00:09:11,060 --> 00:09:21,020
So P.W. Dam help you to for dumping hashes and then window to table to help you to generate rainbow

127
00:09:21,020 --> 00:09:28,190
tables and then rainbow crack helps you to extract plaintext passwords from that generated table.

128
00:09:28,550 --> 00:09:29,090
Right.

129
00:09:29,090 --> 00:09:36,470
So I hope now you know how to use the bottom seven venality, gin and rainbow crack.