4

I'm trying to find a way of getting my current user password in plain text, is it possible?

I've seen here a way of doing it on Win7 but it's not working for Win10.

If it's not, could I, at least, read the password hash somewhere just like you can do in /etc/shadow on Linux?

Edit: I found this interesting post talking about this same matter and being able to do it, though it's a bit old, could this still be possible?

| improve this question | |
  • 2
    If you can acquire the hashed password , hashcat is your friend. – iainpb Jan 11 '17 at 16:01
  • @iain I'd prefer a solution where craking hashes is not involved if possible. – sysfiend Jan 11 '17 at 16:42
  • @SysFiend You won't be getting passwords in plain-text. They are stored as hashes. – defalt Jan 14 '17 at 5:53
5

Yes, all of that in your article should still work on Windows 10. Here is another great resource on using Mimikatz that I have found helpful: https://adsecurity.org/?page_id=1821.

One note though, Windows 10 Enterprise has the availability of Credential Guard. If the system is running Enterprise version and has Credential Guard enabled, the hashes are not currently accessible to the best of my knowledge.

Plain text? Simply, in Windows 10, no. In Windows 7, WDigest is still enabled by default so passwords ARE horrifically cached in plain text. In Windows 10, that is gone by default. Ref: https://blogs.technet.microsoft.com/kfalde/2014/11/01/kb2871997-and-wdigest-part-1/

| improve this answer | |
1

The password hashes are stored in the binary file C:\Windows\System32\Config\SAM and you can run the freeware Ophcrack to extract the password hashes the easy way. If you're using Windows 10 or 8, you can use Mimikatz to reveal the cached passwords in plain text only when you have enabled PIN or picture logon.

| improve this answer | |
  • Doesn't it require already logged in administrator account to access that directory and run that tool? And passwords are stored in hashes and not in plain-text. Do I require rainbow table or hashcat to retrieve the text from the hash? – defalt Jan 12 '17 at 6:23
  • The password hashes can be extracted easily by booting from Ophcrack Live CD (without rainbow table), and you need rainbow table only when you need to crack the password. While Mimikatz requires you to log into Windows as administrator. – Durfee Jan 18 '17 at 3:08
  • Ophcrack may extract the password hash but you need it in plain text. For that rainbow table will be required. – defalt Jan 18 '17 at 3:47
  • Directly from Wikipedia Ophcrack is a free open source (GPL licensed) program that cracks Windows log-in passwords by using LM hashes through rainbow tables. The program includes the ability to import the hashes from a variety of formats, including dumping directly from the SAM files of Windows. On most computers, ophcrack can crack most passwords within a few minutes. It uses rainbow table. – defalt Jan 18 '17 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.