Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Decrypting passwords stored using reversible encryption

Posted on 2004-07-31
7
Medium Priority
?
481 Views
Last Modified: 2007-12-19
I'm the system admin for a very small domain (<15 users).
I need to be able to log on with every user's account to do some work for them now and then.
I'm thinking of enabling this policy, but i need a tool to decrypt the passwords. Are there any available?

(Yea, security issue there... but consider that they were using a single administrative account with no password on the whole network up till last week.)
0
Comment
Question by:Giova322
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
7 Comments
 
LVL 34

Expert Comment

by:Dave_Dietz
ID: 11685220
Reversible encryption is really only needed if you are using Digest Authentication for a web server.

I believe the passwords are encrypted with a 3DES algorithm, but I honestly can't guarantee that to be correct.

There are tools out there to break strong encrytpion suites, but even knowing the cipher and having access to a file with encrypted passwords is still going to take a *log* time to crack.

There is no simple tools that will look at a Security Accounts database on a Windows domain and spit out UserID/Password combos in a trivial timeframe.

(Just because it's reversible doesn't mean its easy to decrypt...)

Sorry.

Dave Dietz
0
 

Author Comment

by:Giova322
ID: 11685298
at the moment i'm just enabling "User cannot change password" and "Password never expires" and creating the accounts myself.
i think 3DES is a one way encryption.
I might of course be mistaken, but i thought reversible meant that it is possible to go back... while cracking one way encrypted hashes is a matter of brute force.
So there might be no tools available, but i think if it's *decryptable* there is a way to recover the original password in a matter of seconds or even much less.
0
 
LVL 34

Expert Comment

by:Dave_Dietz
ID: 11685523
3DES (DES used 3 times with different keys) is a symmetric encryption algorythm - it is definately reversible.  It is actually the same suite used to encrypt shared session keys for SSL communications (not the public key encrytpion used to negotiate the session though).

There is no real way to decrypt a hash - those tend to be one way since there is possible duplication of hashes based on the hash algorythm used.

If something is decryptable you are correct about being able to decrypt it very quickly but that depends on your having acess to the key used to encrypt the data.  The key used to encrypt passwords stored in the SAM is something not made avaiable to a user (Admin or not) and without that you are back to brute forcing your way through the encryption used.  The OS has the key so it can decrypt the passwords wasily but there  si no way I know of to get that key for use by anything other than the OS.

If it were easy to decrypt passwords stored this way the passwords would be much too easy for a hacker to access if they gain control of the machine.

Dave Dietz
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Giova322
ID: 11689104
well, they would still need to have admin rights, then enable the policy, and then wait for ppl to change their password.

I've heard that this policy is often enabled when dealing with macs, if that could be of any help.
0
 

Author Comment

by:Giova322
ID: 11925684
I object: no solution was given to the problem
I left the question open hoping for someone else's answer. In fact, i later increased the point value for that reason.
0
 
LVL 1

Accepted Solution

by:
DarthMod earned 0 total points
ID: 11969756
Submitted to PAQ with points refunded (300)

DarthMod
Community Support Moderator
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…
This lesson discusses how to use a Mainform + Subforms in Microsoft Access to find and enter data for payments on orders. The sample data comes from a custom shop that builds and sells movable storage structures that are delivered to your property. …
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question