0

I've forgotten my password to my home server.

It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too late, and now I've forgotten what I changed it to.

However, I know lots of credentials I could try.

Is there a tool or script out there that can run through a list of possible credentials one at a time sent to the VM to be authenticated? Almost like a brute force, but with a much smaller list, like 20-30 login pairs total (possibly capable of interpreting wildcards like ? or *) on Kali linux or PowerShell, or even something else if it exists?

Very much appreciated!

Improve this question
15
  • you can attempt to login remotely or only locally?
    – schroeder ♦
    Nov 10, 2015 at 17:50
  • 1
    If you're talking about an Admin account, I'd go for a script that tests accessibility to \\SEVERNAME\C$ with each set of credentials. Wouldn't take long to whip that up in PowerShell. Might do one later. That said, beware you may run up against Account Lockout policies that reject your logins even if you're using the right password just because you've failed too many times too quickly. Depending on how far down the list you need to go, and the Account Lockout policy in effect, your brute force check could take hours.
    – Iszi
    Nov 10, 2015 at 18:18
  • 2
    Boot it to an appropriate Linux Live CD and reset the Administrator password.
    – TessellatingHeckler
    Nov 10, 2015 at 18:39
  • 1
    That's the one I was thinking of, and I have used it before - although not recently. It's more reliable to blank the password than to try and set a new password. I assume that's using chntpw behind the scenes - and there were problems with some versions (see answers / comments there) - maybe you had one of those versions?
    – TessellatingHeckler
    Nov 10, 2015 at 19:01
  • 1
    @ITBear Perhaps that should be the definition of a true hacker: Someone that's good enough that they don't have to remember any passwords.
    – TTT
    Nov 10, 2015 at 21:46

1 Answer 1

Reset to default
0

Okay, I tried this earlier with some live systems that had PS Remoting enabled and just banged out a script that seems to manage itself o.k.:

#Pentest-RemotePSCredsList.ps1

$pusername = 'DOMAIN\Username' #possible username (FQDN)
$ppasswords = 'GoodPass','BadPass0','BadPass1','BadPass2' #list of possible passwords array variable
$hostname = 'hostname' #name of target machine, or IP addr

ForEach($p in $ppasswords) 
{
  echo Attempting password: $p
  $secpasswd = ConvertTo-SecureString "$p" -AsPlainText -Force
  $mycreds = New-Object System.Management.Automation.PSCredential ($pusername, $secpasswd)
  Enter-PSSession $hostname -Credential $mycreds
  pause
} # end foreach

I was surprised, even if a good command completes first without any errors and after if the others spit out a Access denied error at you, once the whole script is finished you still end up connected in a remote cmdline session. So as long as one of those passwords in your list is good, it should work.

After troubleshooting getting a Access Denied error and not anything else, I fleshed out the password list with about 15 of what I thought were most likely and got one to work right away! :D

Now this is weird because the real answer that solved my problem has nothing to do with the title of my question. It was thanks to everyone else that I just got it. Should I just delete this one entirely?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.