?
Solved

Decrypting passwords stored using reversible encryption

Posted on 2004-07-31
7
Medium Priority
?
463 Views
Last Modified: 2007-12-19
I'm the system admin for a very small domain (<15 users).
I need to be able to log on with every user's account to do some work for them now and then.
I'm thinking of enabling this policy, but i need a tool to decrypt the passwords. Are there any available?

(Yea, security issue there... but consider that they were using a single administrative account with no password on the whole network up till last week.)
0
Comment
Question by:Giova322
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
7 Comments
 
LVL 34

Expert Comment

by:Dave_Dietz
ID: 11685220
Reversible encryption is really only needed if you are using Digest Authentication for a web server.

I believe the passwords are encrypted with a 3DES algorithm, but I honestly can't guarantee that to be correct.

There are tools out there to break strong encrytpion suites, but even knowing the cipher and having access to a file with encrypted passwords is still going to take a *log* time to crack.

There is no simple tools that will look at a Security Accounts database on a Windows domain and spit out UserID/Password combos in a trivial timeframe.

(Just because it's reversible doesn't mean its easy to decrypt...)

Sorry.

Dave Dietz
0
 

Author Comment

by:Giova322
ID: 11685298
at the moment i'm just enabling "User cannot change password" and "Password never expires" and creating the accounts myself.
i think 3DES is a one way encryption.
I might of course be mistaken, but i thought reversible meant that it is possible to go back... while cracking one way encrypted hashes is a matter of brute force.
So there might be no tools available, but i think if it's *decryptable* there is a way to recover the original password in a matter of seconds or even much less.
0
 
LVL 34

Expert Comment

by:Dave_Dietz
ID: 11685523
3DES (DES used 3 times with different keys) is a symmetric encryption algorythm - it is definately reversible.  It is actually the same suite used to encrypt shared session keys for SSL communications (not the public key encrytpion used to negotiate the session though).

There is no real way to decrypt a hash - those tend to be one way since there is possible duplication of hashes based on the hash algorythm used.

If something is decryptable you are correct about being able to decrypt it very quickly but that depends on your having acess to the key used to encrypt the data.  The key used to encrypt passwords stored in the SAM is something not made avaiable to a user (Admin or not) and without that you are back to brute forcing your way through the encryption used.  The OS has the key so it can decrypt the passwords wasily but there  si no way I know of to get that key for use by anything other than the OS.

If it were easy to decrypt passwords stored this way the passwords would be much too easy for a hacker to access if they gain control of the machine.

Dave Dietz
0
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

 

Author Comment

by:Giova322
ID: 11689104
well, they would still need to have admin rights, then enable the policy, and then wait for ppl to change their password.

I've heard that this policy is often enabled when dealing with macs, if that could be of any help.
0
 

Author Comment

by:Giova322
ID: 11925684
I object: no solution was given to the problem
I left the question open hoping for someone else's answer. In fact, i later increased the point value for that reason.
0
 
LVL 1

Accepted Solution

by:
DarthMod earned 0 total points
ID: 11969756
Submitted to PAQ with points refunded (300)

DarthMod
Community Support Moderator
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question