6

I have a very uncommon scenario. I have a Windows 10 laptop with a specific configuration. On that configuration, there is a user (local user, not domain user) which I don't know its password. I want to migrate that user to another Windows 10 computer trying to keep its password.

Of course I already tried to decrypt the password. I already extracted the hash from the SAM file and tried some unsuccessful rainbow tables attacks using ophcrack, but the goal is not to hack the account, but to create the user in the same state on a new laptop.

I already have administrator rights on both laptops. I also tried metasploit+mimikatz unsuccessfully but the user never logged on the computer so I guess mimikatz can't work on this.

Does anybody know a way to achieve something like this?

Improve this question
4
  • 1
    I think chntpw can do this. You'll need to boot second computer off live CD/USB
    – paj28
    Commented Jun 24, 2017 at 10:39
  • Nice! I didn't know about this tool. I'll try it. Maybe you can put the same as an answer and if it works I'll mark it as resolved. Thanks.
    – OscarAkaElvis
    Commented Jun 24, 2017 at 10:41
  • It seems with that application you can reset the password... but can't inject the hash I already have. :/ Any alternative or idea? There are a lot of methods to reset the password but it seems there is no option for what I want to do.
    – OscarAkaElvis
    Commented Jun 25, 2017 at 23:32
  • Oh well. A simple source code change could probably add that feature, but looks like you got a better answer
    – paj28
    Commented Jun 26, 2017 at 5:42

2 Answers 2

Reset to default
3

This is definitely possible after a recent updates to both Mimikatz and Meterpreter. Please refer to the following links:

Improve this answer
0
0

I had a similar problem on Windows 10. I was upgrading my desktop to a 1050 ti and forgot the admin password to download new drivers. What I did:

  • Take out the SSD or the drive that stores Windows
  • Use an adapter and plug it into another computer where you have admin rights
  • Open the SAM file through regedit and hive edit the hash for a blank password (look it up on Google the hash should be somthing like x0) and hive save.
  • Plug the SSD or drive back in and you will be able to get in without a password.

Then you can migrate.

Improve this answer
2
  • 1
    Unless you used Bitlocker...
    – schroeder ♦
    Commented Feb 21 at 17:18
  • ...And a Bitlocker bypass method like the one in the news recently
    – Sir Muffington
    Commented Feb 21 at 20:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .