Dump Windows Hash's (No Boot, Limited User)

[level42]

My friend needs help getting a dump of her local computer. It was configured for her years ago and she wants to get into the admin account but can't figure out the password.

How can she get the admin hash's by being a local limited user, and with out the option of booting any other software.

Thanks for the help :)

[Eviltechie]

I would just boot with a linux live cd, and then take a copy of C:\WINDOWS\system32\config\

Then just use ophcrack.

[level42]

Is there anyway to get it without booting a CD?

[SWFu]

Is there anyway to get it without booting a CD?

Why can't you boot from a CD?

[DingleBerries]

Is there anyway to get it without booting a CD?

Have an account that is > limited user.

[level42]

Why can't you boot from a CD?

She doesn't know how, nor does she have a CD burner.

[Loony Guitarist]

all you need to do to boot from a CD is put it in your CD drive and turn on your computer. When the CD loads you should be able to copy the SAM file and run it against rainbow tables. I recomend Ophcrack (http://ophcrack.sourceforge.net/) as it automatically gets the SAM file and will start cracking the password against a limited Rainbow Table as soon as it boots. if the password is too complex however, you'll need to copy the SAM and run it against a better Table.

Does she know anyone that can download a live distro and burn the CD for her?

[charm_quark]

install cain and able it can get the hash's for the local system

[Tcstool]

install cain and able it can get the hash's for the local system

That would work. You could also use FGDump to dump the local system hashes into a text file if her computer doesn't have the resources to do hardcore password cracking.