Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker.


wmic useraccount list full

Description=Used to deliver NVIDIA program updates

EDIT: I've dumped the hash now and it looks like this:


The hash starting iwth AAD3 and ends with 4EE is just LM hash for blank password and in this case it means that the password is over 14 characters and it cannot be stored as LM hash. The last hash (F100) is the NTLM hash which I would like to see cracked :)

share|improve this question
Can you dump the password hash from the SAM? –  Zzz Jul 5 '12 at 0:38
I don't, but maybe you could find out using and tell us more ;) –  Tie-fighter Jul 5 '12 at 2:01
I'll try dump it later today and start cracking it. If it is LANMAN it should not take so long. –  Chris Dale Jul 5 '12 at 8:30
If you are worried just disable the Nvidia update service itself. –  Ramhound Jul 5 '12 at 11:53
@Ramhound, not so worried. I am more interested in using it in pentests myself. –  Chris Dale Jul 5 '12 at 19:26

1 Answer 1

up vote 2 down vote accepted

NVidia seem to have done a reasonable job of locking this down appropriately.

I ran cain and abel, and dumped the service accounts password from LSA, it is using a very random looking password comprised of > 15 characters, using upper and lower case alphanumeric and specials like _(!, etc.

Additionally, the account is added to the deny log on locally security policies, so they appear to have thought about security on this. This is far better than having a service run under system with way more privileges.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.