{"id":3343,"date":"2019-01-26T19:29:59","date_gmt":"2019-01-26T18:29:59","guid":{"rendered":"http:\/\/olivier.hoarau.org\/?p=3343"},"modified":"2019-01-26T19:30:06","modified_gmt":"2019-01-26T18:30:06","slug":"recuperez-un-mot-de-passe-windows-de-linux","status":"publish","type":"post","link":"https:\/\/olivier.hoarau.org\/?p=3343","title":{"rendered":"R\u00e9cup\u00e9rez un mot de passe windows de linux"},"content":{"rendered":"\n

Voulant r\u00e9installer le launchpad Novation MK2<\/a> sur le nouveau ThinkPad T440p <\/a>sous windows 7 professionnel pour ma fille, je me suis rendu compte que j’avais n\u00e9gligemment oubli\u00e9 le mot de passe d’administrateur ! C’est ballot, fort heureusement avec une partition sous linux, on peut faire pas mal de chose avec une commande qui s’appelle chntpw<\/strong> c’est \u00e0 dire \u00ab\u00a0change NT password\u00a0\u00bb tout un programme. A vrai dire c’est valable avec n’importe quel PC windows d\u00e8s lors que vous y avez acc\u00e8s physiquement et que vous pouvez acc\u00e9der au BIOS.<\/p>\n\n\n\n

\"\"
Launchpad Novation MK2 et le ThinkPad T440p en mode linux<\/figcaption><\/figure>\n\n\n\n

Il suffit de rep\u00e9rer la partition windows, la monter si ce n’est pas d\u00e9j\u00e0 fait et d’aller dans le r\u00e9pertoire Windows\/System32\/config<\/strong>. De mon c\u00f4t\u00e9 j’ai tap\u00e9 simplement en tant que root<\/p>\n\n\n\n

cd \/media\/win_d\/Windows\/System32\/config<\/strong><\/p>\n\n\n\n

Ensuite on tape la commande chntpw -l sam -i<\/strong> \u00e0 noter qu’il faut que vous ayez un fichier sam<\/strong> dans le r\u00e9pertoire, sur d’autres syst\u00e8mes ce fichier peut \u00eatre en majuscule. Voil\u00e0 le r\u00e9sultat :<\/p>\n\n\n\n

chntpw version 1.00 140201, (c) Petter N Hagen
Hive name (from header): <\\SystemRoot\\System32\\Config\\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c
File size 262144 [40000] bytes, containing 8 pages (+ 1 headerpage)
Used for data: 273\/87760 blocks\/bytes, unused: 18\/10288 blocks\/bytes.<\/strong><\/p>\n\n\n\n

<>========<> chntpw Main Interactive Menu <>========<><\/strong><\/p>\n\n\n\n

Loaded hives: <\/strong><\/p>\n\n\n\n

1 – Edit user data and passwords
2 – List groups
– – –
9 – Registry editor, now with full write support!
q – Quit (you will be asked if there is something to save)<\/strong><\/p>\n\n\n\n

What to do? [1] -><\/strong><\/p>\n\n\n\n\n\n\n\n

On tape 1 pour lister les utilisateurs et voil\u00e0 ce que \u00e7a donne<\/p>\n\n\n\n

===== chntpw Edit User Info & Passwords ====<\/strong><\/p>\n\n\n\n

| RID -|———- Username ————| Admin? |- Lock? –|
| 01f4 | Administrator | ADMIN | dis\/lock |
| 03e8 | Customer | ADMIN | dis\/lock |
| 01f5 | Gast | | dis\/lock |
| 03e9 | L\ufffdna | | <\/strong>BLANK<\/strong><\/em> |
| 03ea | Olivier | | <\/strong>BLANK<\/strong><\/em> |<\/strong><\/p>\n\n\n\n

Please enter user number (RID) or 0 to exit: [3e8]<\/strong><\/p>\n\n\n\n

Pour l’utilisateur Olivier on tapera 0x03ea <\/strong>et cela donnera<\/p>\n\n\n\n

================= USER EDIT ====================<\/strong><\/p>\n\n\n\n

RID : 1002 [03ea]
Username: Olivier
fullname: Olivier
comment :
homedir : <\/strong><\/p>\n\n\n\n

00000221 = Benutzer (which has 4 members)<\/strong><\/p>\n\n\n\n

Account bits: 0x0210 =
[ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account | [ ] NMS account |
[ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act |
[X] Pwd don’t expir | [ ] Auto lockout | [ ] (unknown 0x08) |
[ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | <\/strong><\/p>\n\n\n\n

Failed login count: 0, while max tries is: 0
Total login count: 3
** No NT MD4 hash found. This user probably has a BLANK password!
** No LANMAN hash found either. Try login with no password!<\/strong><\/p>\n\n\n\n